hawkeye_reborn | a0045765610bd2c41ad8266c0e2266f6efb04c2767349ef323f35e6a47c6c6be

Analysis

max time kernel
93s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe
Size

934KB
MD5

27bd91c235d7f7418c9c3f47b42971f4
SHA1

9f6e15ed59774b97ae042481aec6de9ed0e2647b
SHA256

a0045765610bd2c41ad8266c0e2266f6efb04c2767349ef323f35e6a47c6c6be
SHA512

99b6190411eb4d4f804abf0da0ab2b1d4ae1f0948ef97126de91ec2ade086abfa18b978be755553d51113a27a6eb7d554b5a7a580f3763ea8b8eb62fb4da235c
SSDEEP

24576:5/ddQnLF6sBVJxZjmdZ45M4Mi1kwZLFkOh:QLb7Fv64zbZpkOh

Score

10^/10

hawkeye_reborn m00nd3v_logger collection infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.1.0.0

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
@mexicod1.,

Mutex

2a6eb065-9bf5-4623-a737-661362f8f971

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:@mexicod1., _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:2a6eb065-9bf5-4623-a737-661362f8f971 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:10.1.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - RebornX, Version=10.1.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/memory/1620-8-0x0000000000400000-0x00000000004AA000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/5436-25-0x0000000000400000-0x0000000000455000-memory.dmp	MailPassView
behavioral2/memory/5436-26-0x0000000000400000-0x0000000000455000-memory.dmp	MailPassView
behavioral2/memory/5436-28-0x0000000000400000-0x0000000000455000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/5592-14-0x0000000000400000-0x0000000000477000-memory.dmp	WebBrowserPassView
behavioral2/memory/5592-16-0x0000000000400000-0x0000000000477000-memory.dmp	WebBrowserPassView
behavioral2/memory/5592-17-0x0000000000400000-0x0000000000477000-memory.dmp	WebBrowserPassView
behavioral2/memory/5592-22-0x0000000000400000-0x0000000000477000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

resource	yara_rule
behavioral2/memory/5592-14-0x0000000000400000-0x0000000000477000-memory.dmp	Nirsoft
behavioral2/memory/5592-16-0x0000000000400000-0x0000000000477000-memory.dmp	Nirsoft
behavioral2/memory/5592-17-0x0000000000400000-0x0000000000477000-memory.dmp	Nirsoft
behavioral2/memory/5592-22-0x0000000000400000-0x0000000000477000-memory.dmp	Nirsoft
behavioral2/memory/5436-25-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral2/memory/5436-26-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral2/memory/5436-28-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2372 set thread context of 1620	2372	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	86
PID 1620 set thread context of 5592	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	94
PID 1620 set thread context of 5436	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4628	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5592	vbc.exe
5592	vbc.exe
5592	vbc.exe
5592	vbc.exe
1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe
1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4628	2372	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	84
PID 2372 wrote to memory of 4628	2372	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	84
PID 2372 wrote to memory of 4628	2372	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	84
PID 2372 wrote to memory of 1620	2372	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	86
PID 2372 wrote to memory of 1620	2372	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	86
PID 2372 wrote to memory of 1620	2372	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	86
PID 2372 wrote to memory of 1620	2372	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	86
PID 2372 wrote to memory of 1620	2372	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	86
PID 2372 wrote to memory of 1620	2372	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	86
PID 2372 wrote to memory of 1620	2372	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	86
PID 2372 wrote to memory of 1620	2372	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	86
PID 1620 wrote to memory of 5592	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	94
PID 1620 wrote to memory of 5592	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	94
PID 1620 wrote to memory of 5592	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	94
PID 1620 wrote to memory of 5592	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	94
PID 1620 wrote to memory of 5592	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	94
PID 1620 wrote to memory of 5592	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	94
PID 1620 wrote to memory of 5592	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	94
PID 1620 wrote to memory of 5592	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	94
PID 1620 wrote to memory of 5592	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	94
PID 1620 wrote to memory of 5436	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	95
PID 1620 wrote to memory of 5436	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	95
PID 1620 wrote to memory of 5436	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	95
PID 1620 wrote to memory of 5436	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	95
PID 1620 wrote to memory of 5436	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	95
PID 1620 wrote to memory of 5436	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	95
PID 1620 wrote to memory of 5436	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	95
PID 1620 wrote to memory of 5436	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	95
PID 1620 wrote to memory of 5436	1620	27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe	95

C:\Users\Admin\AppData\Local\Temp\27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fJNAmc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp496D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4628
- C:\Users\Admin\AppData\Local\Temp\27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe
  "{path}"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp74E2.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5592
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp78EA.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:5436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\27bd91c235d7f7418c9c3f47b42971f4_JaffaCakes118.exe.log

Filesize
667B

MD5
fad44290d2f569240416a287677a6b34

SHA1
0799266664e37852987cc24398f9a70c7e56742b

SHA256
e955c99499359471526e95c22a084d1578997c39ecab988badf6798cfbd995b0

SHA512
ee4136ac147d41646368eeb16390598c1da2b9e3bb8331b43062a72e4ad1d05eec56dcc727f9b5b447756c3edc855b08ef0c241073a5f88e749714f2beb98bc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp496D.tmp

Filesize
1KB

MD5
1e9be2319d70d76475412a173504d181

SHA1
c2a5918211e393b6dafe069c122ed4a704e405c0

SHA256
368960bfd9126af41936c830764a34ca5427a2c92f4168206a9155f898c97911

SHA512
98c2aaaf233b29f7d0ae3b4b34caaef2ef1d7fd929a94b955c1052a92a5add1e1ab3c9d1ba9d6f6a879645851ede42dc7d688aa8b1fc2aaacae8e8daa9bf9463

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp74E2.tmp

Filesize
4KB

MD5
73ddf6cd83c2ad8a2fbb2383e322ffbc

SHA1
05270f8bb7b5cc6ab9a61ae7453d047379089147

SHA256
0ef9194c6e90b23c416316fc5a15f549ee5b2472014fcd7648d72ca9a865b409

SHA512
714db1956faa795005b15324b9604105881d6b484fe899876fe0df85783c61a72f556a875833af8625625212503b95eea2eb353a1d98f6a7af47a3658ea5262d

Download Submit
memory/1620-11-0x0000000074A50000-0x0000000075001000-memory.dmp

Filesize
5.7MB

Download
memory/1620-29-0x0000000074A50000-0x0000000075001000-memory.dmp

Filesize
5.7MB

Download
memory/1620-8-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2372-0-0x0000000074A52000-0x0000000074A53000-memory.dmp

Filesize
4KB

Download
memory/2372-12-0x0000000074A50000-0x0000000075001000-memory.dmp

Filesize
5.7MB

Download
memory/2372-2-0x0000000074A50000-0x0000000075001000-memory.dmp

Filesize
5.7MB

Download
memory/2372-1-0x0000000074A50000-0x0000000075001000-memory.dmp

Filesize
5.7MB

Download
memory/5436-25-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5436-26-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5436-27-0x0000000000460000-0x0000000000529000-memory.dmp

Filesize
804KB

Download
memory/5436-28-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/5592-14-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5592-16-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5592-17-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/5592-22-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download