hawkeye_reborn | 5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982

General

Target

5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
Size

891KB
MD5

c1fefa5e30a28bde6fb94d7ba38e8871
SHA1

806489a3ce606cf49aae8b10258678e4d642b3c4
SHA256

5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982
SHA512

9031e9bc36a9e652e3f99c758b79be250ea40b07c4ce0a8e65219b01d6de446bf299c26e01f6337b54e74ee9b3016551e10405cc39fc09605a3d63b8d1430bb0

Score

10^/10

hawkeye_reborn m00nd3v_logger infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
sales@satamwa.com
Password:
?MZMRQzTKx)6!

Mutex

934d85c8-1cb2-4e89-ab40-c756a0f268d8

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:?MZMRQzTKx)6! _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:sales@satamwa.com _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:934d85c8-1cb2-4e89-ab40-c756a0f268d8 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 6 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

Processes:

resource	yara_rule
behavioral1/memory/1464-62-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1464-64-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1464-63-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1464-65-0x000000000048B2FE-mapping.dmp	m00nd3v_logger
behavioral1/memory/1464-67-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1464-69-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

NirSoft WebBrowserPassView 5 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/1072-83-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1072-84-0x000000000044472E-mapping.dmp	WebBrowserPassView
behavioral1/memory/1072-87-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1072-88-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1072-89-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1072-83-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1072-84-0x000000000044472E-mapping.dmp	Nirsoft
behavioral1/memory/1072-87-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1072-88-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1072-89-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 2 IoCs

Processes:

5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe

description	pid	process	target process
PID 2036 set thread context of 1464	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
PID 1464 set thread context of 1072	1464	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1968 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

vbc.exe

pid process

1072 vbc.exe
1072 vbc.exe
1072 vbc.exe
1072 vbc.exe
1072 vbc.exe

pid	process
1968	schtasks.exe

pid	process
1072	vbc.exe
1072	vbc.exe
1072	vbc.exe
1072	vbc.exe
1072	vbc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe

description	pid	process	target process
PID 2036 wrote to memory of 1968	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	schtasks.exe
PID 2036 wrote to memory of 1968	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	schtasks.exe
PID 2036 wrote to memory of 1968	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	schtasks.exe
PID 2036 wrote to memory of 1968	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	schtasks.exe
PID 2036 wrote to memory of 1464	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
PID 2036 wrote to memory of 1464	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
PID 2036 wrote to memory of 1464	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
PID 2036 wrote to memory of 1464	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
PID 2036 wrote to memory of 1464	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
PID 2036 wrote to memory of 1464	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
PID 2036 wrote to memory of 1464	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
PID 2036 wrote to memory of 1464	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
PID 2036 wrote to memory of 1464	2036	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
PID 1464 wrote to memory of 1072	1464	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	vbc.exe
PID 1464 wrote to memory of 1072	1464	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	vbc.exe
PID 1464 wrote to memory of 1072	1464	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	vbc.exe
PID 1464 wrote to memory of 1072	1464	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	vbc.exe
PID 1464 wrote to memory of 1072	1464	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	vbc.exe
PID 1464 wrote to memory of 1072	1464	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	vbc.exe
PID 1464 wrote to memory of 1072	1464	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	vbc.exe
PID 1464 wrote to memory of 1072	1464	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	vbc.exe
PID 1464 wrote to memory of 1072	1464	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	vbc.exe
PID 1464 wrote to memory of 1072	1464	5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
"C:\Users\Admin\AppData\Local\Temp\5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FbVYyxTrFSsUq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8B11.tmp"
2⤵
- Creates scheduled task(s)
PID:1968

C:\Users\Admin\AppData\Local\Temp\5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe
"C:\Users\Admin\AppData\Local\Temp\5fd6730d57f594b6172948dcf888e76d522015e731560e76178944a2fcd46982.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1464

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp9AAB.tmp"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1072

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp8B11.tmp
Filesize
1KB

MD5
407bbb627c5875a764cbe214746f705a

SHA1
a8da9b338b98f892c803440e3b58397882750c71

SHA256
c787a5103ee2077b1d91f22eb0f9a86af1c6ac47c2a08b3cf1d9ea121f037389

SHA512
2af607186b05d2250c327ffbae88cd156a26c74599a94c91e15f4d5ff89e51aa612c275e668cf619afe34105fe8434419d4ef28272fa9518cb82d1cdd377de0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9AAB.tmp
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1072-75-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1072-89-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1072-88-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1072-87-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1072-84-0x000000000044472E-mapping.dmp

Download
memory/1072-83-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1072-81-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1072-79-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1072-77-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1072-74-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1464-60-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1464-63-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1464-72-0x00000000746C0000-0x0000000074C6B000-memory.dmp

Filesize
5.7MB

Download
memory/1464-73-0x00000000746C0000-0x0000000074C6B000-memory.dmp

Filesize
5.7MB

Download
memory/1464-69-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1464-67-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1464-65-0x000000000048B2FE-mapping.dmp

Download
memory/1464-59-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1464-64-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1464-62-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1968-57-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000075481000-0x0000000075483000-memory.dmp

Filesize
8KB

Download
memory/2036-71-0x00000000746C0000-0x0000000074C6B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-56-0x00000000746C0000-0x0000000074C6B000-memory.dmp

Filesize
5.7MB

Download
memory/2036-55-0x00000000746C0000-0x0000000074C6B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads