hawkeye_reborn | 8e78bf76075b5946c932aacd4d8f10132b06124bf2b7bdb954277b016b5ef42c

Analysis

max time kernel
87s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
01-05-2024 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe
Size

777KB
MD5

0b35d66e57ac2fd0a8d0f5b3559e0285
SHA1

cbe9f230712b51556dbec84a4ad287cd24550724
SHA256

8e78bf76075b5946c932aacd4d8f10132b06124bf2b7bdb954277b016b5ef42c
SHA512

32598d1d1f5769bf9591da75c75e024f874fbc8a3b527832bd4c83beafbad8ad7b079370e97be002d215c6b8561fa1b4126e8601820b9d65779575b924dc9c32
SSDEEP

12288:l7sZ/OAac3cwHolLoTtgGUcOumN8Op7bhHTfXuuT2I6ZY:ZsHxMwHqLoeGSN8OZb1bH

Score

10^/10

hawkeye_reborn m00nd3v_logger collection infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Attributes

fields
name

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 2 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/memory/3540-23-0x0000000005AC0000-0x0000000005B50000-memory.dmp	m00nd3v_logger
behavioral2/memory/4364-25-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/1128-43-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/1128-44-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/1128-46-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2168-32-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/2168-34-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/2168-35-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/2168-41-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

resource	yara_rule
behavioral2/memory/2168-32-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/2168-34-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/2168-35-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/2168-41-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/1128-43-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/1128-44-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/1128-46-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3540 set thread context of 4364	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	93
PID 4364 set thread context of 2168	4364	RegAsm.exe	95
PID 4364 set thread context of 1128	4364	RegAsm.exe	96

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe
3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe
3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe
3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe
3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe
3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe
2168	vbc.exe
2168	vbc.exe
2168	vbc.exe
2168	vbc.exe
2168	vbc.exe
2168	vbc.exe
2168	vbc.exe
2168	vbc.exe
2168	vbc.exe
2168	vbc.exe
2168	vbc.exe
2168	vbc.exe
4364	RegAsm.exe
4364	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe
Token: SeDebugPrivilege	4364	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4364	RegAsm.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 4592	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	86
PID 3540 wrote to memory of 4592	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	86
PID 3540 wrote to memory of 4592	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	86
PID 4592 wrote to memory of 1712	4592	csc.exe	89
PID 4592 wrote to memory of 1712	4592	csc.exe	89
PID 4592 wrote to memory of 1712	4592	csc.exe	89
PID 3540 wrote to memory of 4212	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	91
PID 3540 wrote to memory of 4212	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	91
PID 3540 wrote to memory of 4212	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	91
PID 3540 wrote to memory of 3060	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	92
PID 3540 wrote to memory of 3060	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	92
PID 3540 wrote to memory of 3060	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	92
PID 3540 wrote to memory of 4364	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	93
PID 3540 wrote to memory of 4364	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	93
PID 3540 wrote to memory of 4364	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	93
PID 3540 wrote to memory of 4364	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	93
PID 3540 wrote to memory of 4364	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	93
PID 3540 wrote to memory of 4364	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	93
PID 3540 wrote to memory of 4364	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	93
PID 3540 wrote to memory of 4364	3540	0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe	93
PID 4364 wrote to memory of 2168	4364	RegAsm.exe	95
PID 4364 wrote to memory of 2168	4364	RegAsm.exe	95
PID 4364 wrote to memory of 2168	4364	RegAsm.exe	95
PID 4364 wrote to memory of 2168	4364	RegAsm.exe	95
PID 4364 wrote to memory of 2168	4364	RegAsm.exe	95
PID 4364 wrote to memory of 2168	4364	RegAsm.exe	95
PID 4364 wrote to memory of 2168	4364	RegAsm.exe	95
PID 4364 wrote to memory of 2168	4364	RegAsm.exe	95
PID 4364 wrote to memory of 2168	4364	RegAsm.exe	95
PID 4364 wrote to memory of 1128	4364	RegAsm.exe	96
PID 4364 wrote to memory of 1128	4364	RegAsm.exe	96
PID 4364 wrote to memory of 1128	4364	RegAsm.exe	96
PID 4364 wrote to memory of 1128	4364	RegAsm.exe	96
PID 4364 wrote to memory of 1128	4364	RegAsm.exe	96
PID 4364 wrote to memory of 1128	4364	RegAsm.exe	96
PID 4364 wrote to memory of 1128	4364	RegAsm.exe	96
PID 4364 wrote to memory of 1128	4364	RegAsm.exe	96
PID 4364 wrote to memory of 1128	4364	RegAsm.exe	96

C:\Users\Admin\AppData\Local\Temp\0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b35d66e57ac2fd0a8d0f5b3559e0285_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uxvvvgbn\uxvvvgbn.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3B05.tmp" "c:\Users\Admin\AppData\Local\Temp\uxvvvgbn\CSCFBC51AFEECAC46E9B269E01DADB3B96E.TMP"
    3⤵
    PID:1712
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:4212
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:3060
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp67A3.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2168
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp6BAB.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES3B05.tmp

Filesize
1KB

MD5
713a3c6c8a5095f94514b87b2d42a469

SHA1
b0f54c88e3bb6e9a0d0c2a7151574905ef258e81

SHA256
07a268572edb3be03b72df7c79df667a85c880110d047961da4ecb9df0bb5ca8

SHA512
949b3feeddd096b4328e268c32d626c37321de4e6e0e83d01ab3f2f0c8f30c2ed86073ca68b7a377985033dfa195c9fb67bf5b9cdc60cd10f5c7891fa31d1bb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp67A3.tmp

Filesize
4KB

MD5
e255c36d21183acb0a1a38b1344443f0

SHA1
9fd09dd85a76f8211e9ba81929a1f10d3c499917

SHA256
00459ae0cad2abd0641bc5e9fb35d08bccec2d498173adc35810ae820eb55b47

SHA512
0e1319f62957c7b3bf1d6573bf24a0bb1cbaf8a0665de6584483885f8c340545cacf36800436892073979a02f3739526569b8c01f862ca9a4b3940c31ad51d4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\uxvvvgbn\uxvvvgbn.dll

Filesize
7KB

MD5
a9503c892a0ff63ee27a405c662c19f9

SHA1
9d6b90de6b6ec02e249287e738a62bee14937f41

SHA256
b04df1c78afca3037dba2da3cbc28a588f989ec418abed174f8fefc6b83d2580

SHA512
13b293af6d90d5ea2914f9b7a25e02f676d666afe6317e302f5ced5cf91c96b3d04e4e6506035676a804418154f9818c74d0af4d0ca822c7af2772627e679c3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\uxvvvgbn\uxvvvgbn.pdb

Filesize
21KB

MD5
26321ff4a3884e89ef86e5c4fe12cea3

SHA1
6e78d2095c8d1ded74e4f2aa7cc008a36ff554c1

SHA256
b40abbd68085ee6f8a596ac8d9a7bdd83883c819bca42bf94e6cd6cd5db7b096

SHA512
56d85df8ba344183402e6479ae37e1ca7410fa991e453a8ab492362b87e2162f44ce6f059093a789940f66d296661dd724f014e0d80f2022613a55823c5d7c79

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uxvvvgbn\CSCFBC51AFEECAC46E9B269E01DADB3B96E.TMP

Filesize
1KB

MD5
33c9e6d21c86c0e577789d8247586c54

SHA1
2084ac6b6e1141f21839c97b907fe7eb39ec1095

SHA256
12e8dba8a8fc2aaeed7b2bd5e3dcb5bf68b4ed658b7c013238706a212f2c66e7

SHA512
dc5ed8c727a97f8cd117fb61e95240d34f5c9e787d379f5869792214260d79dce681c0b04ffebf230cce38d34e32c13f630830396390afba5702235d6035ec42

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uxvvvgbn\uxvvvgbn.0.cs

Filesize
8KB

MD5
258c35777fd602112b03331197b00773

SHA1
2a46b959f87c13f78a2f221ac599564ab351685c

SHA256
be9d0925f33046b192edabe5e03ec7545afb0b7f08821845153850120a719f70

SHA512
b37973a144c5715d495db3da7d1df5d09b706c361ee978e023112507a1fddf60ed718db90efc1f4fb5f04348df10639a1584aed5cf4ed03ad5f4bc141a6f4e08

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\uxvvvgbn\uxvvvgbn.cmdline

Filesize
312B

MD5
9be1c9d6ceeb65f325f8502f9b5b74ac

SHA1
17a02fb2961548426a942e8125bb86056d0e2b8e

SHA256
3c979c87839b6b989461dd29b32ab2d077cdcdc5c936c1c43b42060610f41a1f

SHA512
c759a8c53379a87132b86458fea346c22943f3c535338a456cb1336ae14d1548d2b144d4135da39bb4bb8884985edb49cfccea803cda44c963fd89313e66edfe

Download Submit
memory/1128-45-0x0000000000420000-0x00000000004E9000-memory.dmp

Filesize
804KB

Download
memory/1128-46-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1128-44-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1128-43-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2168-41-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2168-32-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2168-35-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2168-34-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3540-27-0x0000000074A10000-0x00000000751C0000-memory.dmp

Filesize
7.7MB

Download
memory/3540-2-0x0000000074A10000-0x00000000751C0000-memory.dmp

Filesize
7.7MB

Download
memory/3540-21-0x0000000005A20000-0x0000000005ABA000-memory.dmp

Filesize
616KB

Download
memory/3540-1-0x00000000053B0000-0x0000000005442000-memory.dmp

Filesize
584KB

Download
memory/3540-3-0x0000000005340000-0x0000000005350000-memory.dmp

Filesize
64KB

Download
memory/3540-4-0x0000000005390000-0x0000000005398000-memory.dmp

Filesize
32KB

Download
memory/3540-24-0x0000000005BF0000-0x0000000005C8C000-memory.dmp

Filesize
624KB

Download
memory/3540-23-0x0000000005AC0000-0x0000000005B50000-memory.dmp

Filesize
576KB

Download
memory/3540-22-0x00000000054F0000-0x00000000054FC000-memory.dmp

Filesize
48KB

Download
memory/3540-0-0x00000000009D0000-0x0000000000A64000-memory.dmp

Filesize
592KB

Download
memory/3540-19-0x00000000053A0000-0x00000000053A8000-memory.dmp

Filesize
32KB

Download
memory/4364-30-0x0000000074C00000-0x00000000751B1000-memory.dmp

Filesize
5.7MB

Download
memory/4364-29-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download
memory/4364-25-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4364-28-0x0000000074C00000-0x00000000751B1000-memory.dmp

Filesize
5.7MB

Download
memory/4364-47-0x0000000074C00000-0x00000000751B1000-memory.dmp

Filesize
5.7MB

Download
memory/4364-48-0x0000000002840000-0x0000000002850000-memory.dmp

Filesize
64KB

Download