hawkeye_reborn | 6ca1b643bb4cc47a8a0575a66753de2fd2f8d01f9ed658254534e678515b71a8

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 18:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DAILY PICK UP DETAILS.exe
Size

925KB
MD5

5bf757b62ee654ad58118227ffc8ef5d
SHA1

81f0a4c130ec7ac0fc61a40856c20ce0e3f0b1bf
SHA256

faf2bc046695592f8a809a0864f71a326206f9dd4075ac36fedc95654f99ce91
SHA512

d17e8b3c10a613a9af5a04e901862bf179dab8320895ee94ad1a9ac6d06b7378d2ee7dca8bc95f5489aaaff328632b24055cf1c13723fb19eb356d910ba2ed9c
SSDEEP

24576:hQiSpPmlPPUTBW8LoaTVDcolx3UeT0vpJ0rmQKH5/t9AA:uiSAlndGd3xkeovpJ0rqH5

Score

10^/10

hawkeye_reborn m00nd3v_logger collection evasion infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol: smtp
Host:
mail.oppobihar.in
Port:
587
Username:
[email protected]
Password:
oppo@12345

Mutex

ba1e53be-21d5-4b75-92f5-e24f34036bcb

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:oppo@12345 _EmailPort:587 _EmailSSL:false _EmailServer:mail.oppobihar.in _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:ba1e53be-21d5-4b75-92f5-e24f34036bcb _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	DAILY PICK UP DETAILS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	DAILY PICK UP DETAILS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	DAILY PICK UP DETAILS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	DAILY PICK UP DETAILS.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	DAILY PICK UP DETAILS.exe

M00nD3v Logger payload 5 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral1/memory/1644-20-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1644-18-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1644-16-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1644-13-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger
behavioral1/memory/1644-12-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/memory/2032-51-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral1/memory/2032-52-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral1/memory/2032-54-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 3 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral1/memory/1628-35-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1628-34-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral1/memory/1628-38-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 6 IoCs

resource	yara_rule
behavioral1/memory/1628-35-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1628-34-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/1628-38-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral1/memory/2032-51-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/2032-52-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/2032-54-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	DAILY PICK UP DETAILS.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DAILY PICK UP DETAILS.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DAILY PICK UP DETAILS.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	DAILY PICK UP DETAILS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	DAILY PICK UP DETAILS.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	DAILY PICK UP DETAILS.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	DAILY PICK UP DETAILS.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2136 set thread context of 1644	2136	DAILY PICK UP DETAILS.exe	34
PID 1644 set thread context of 1628	1644	DAILY PICK UP DETAILS.exe	35
PID 1644 set thread context of 2032	1644	DAILY PICK UP DETAILS.exe	36

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2324	powershell.exe
1628	vbc.exe
1628	vbc.exe
1628	vbc.exe
1628	vbc.exe
1628	vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2324	powershell.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2324	2136	DAILY PICK UP DETAILS.exe	31
PID 2136 wrote to memory of 2324	2136	DAILY PICK UP DETAILS.exe	31
PID 2136 wrote to memory of 2324	2136	DAILY PICK UP DETAILS.exe	31
PID 2136 wrote to memory of 2324	2136	DAILY PICK UP DETAILS.exe	31
PID 2136 wrote to memory of 1644	2136	DAILY PICK UP DETAILS.exe	34
PID 2136 wrote to memory of 1644	2136	DAILY PICK UP DETAILS.exe	34
PID 2136 wrote to memory of 1644	2136	DAILY PICK UP DETAILS.exe	34
PID 2136 wrote to memory of 1644	2136	DAILY PICK UP DETAILS.exe	34
PID 2136 wrote to memory of 1644	2136	DAILY PICK UP DETAILS.exe	34
PID 2136 wrote to memory of 1644	2136	DAILY PICK UP DETAILS.exe	34
PID 2136 wrote to memory of 1644	2136	DAILY PICK UP DETAILS.exe	34
PID 2136 wrote to memory of 1644	2136	DAILY PICK UP DETAILS.exe	34
PID 2136 wrote to memory of 1644	2136	DAILY PICK UP DETAILS.exe	34
PID 1644 wrote to memory of 1628	1644	DAILY PICK UP DETAILS.exe	35
PID 1644 wrote to memory of 1628	1644	DAILY PICK UP DETAILS.exe	35
PID 1644 wrote to memory of 1628	1644	DAILY PICK UP DETAILS.exe	35
PID 1644 wrote to memory of 1628	1644	DAILY PICK UP DETAILS.exe	35
PID 1644 wrote to memory of 1628	1644	DAILY PICK UP DETAILS.exe	35
PID 1644 wrote to memory of 1628	1644	DAILY PICK UP DETAILS.exe	35
PID 1644 wrote to memory of 1628	1644	DAILY PICK UP DETAILS.exe	35
PID 1644 wrote to memory of 1628	1644	DAILY PICK UP DETAILS.exe	35
PID 1644 wrote to memory of 1628	1644	DAILY PICK UP DETAILS.exe	35
PID 1644 wrote to memory of 1628	1644	DAILY PICK UP DETAILS.exe	35
PID 1644 wrote to memory of 2032	1644	DAILY PICK UP DETAILS.exe	36
PID 1644 wrote to memory of 2032	1644	DAILY PICK UP DETAILS.exe	36
PID 1644 wrote to memory of 2032	1644	DAILY PICK UP DETAILS.exe	36
PID 1644 wrote to memory of 2032	1644	DAILY PICK UP DETAILS.exe	36
PID 1644 wrote to memory of 2032	1644	DAILY PICK UP DETAILS.exe	36
PID 1644 wrote to memory of 2032	1644	DAILY PICK UP DETAILS.exe	36
PID 1644 wrote to memory of 2032	1644	DAILY PICK UP DETAILS.exe	36
PID 1644 wrote to memory of 2032	1644	DAILY PICK UP DETAILS.exe	36
PID 1644 wrote to memory of 2032	1644	DAILY PICK UP DETAILS.exe	36
PID 1644 wrote to memory of 2032	1644	DAILY PICK UP DETAILS.exe	36

C:\Users\Admin\AppData\Local\Temp\DAILY PICK UP DETAILS.exe
"C:\Users\Admin\AppData\Local\Temp\DAILY PICK UP DETAILS.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Windows security modification
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2324
- C:\Users\Admin\AppData\Local\Temp\DAILY PICK UP DETAILS.exe
  "C:\Users\Admin\AppData\Local\Temp\DAILY PICK UP DETAILS.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp14D8.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1628
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp687.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Scripting

T1064

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp14D8.tmp

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1628-23-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1628-38-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1628-25-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1628-27-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1628-29-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1628-31-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1628-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1628-34-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1628-35-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1644-10-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1644-20-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1644-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1644-13-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1644-12-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1644-11-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1644-16-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/1644-18-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/2032-48-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2032-44-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2032-54-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2032-52-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2032-42-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2032-46-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2032-51-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2032-40-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2136-1-0x00000000743E0000-0x000000007498B000-memory.dmp

Filesize
5.7MB

Download
memory/2136-2-0x00000000743E0000-0x000000007498B000-memory.dmp

Filesize
5.7MB

Download
memory/2136-3-0x00000000743E0000-0x000000007498B000-memory.dmp

Filesize
5.7MB

Download
memory/2136-0-0x00000000743E1000-0x00000000743E2000-memory.dmp

Filesize
4KB

Download
memory/2136-21-0x00000000743E0000-0x000000007498B000-memory.dmp

Filesize
5.7MB

Download
memory/2324-7-0x00000000743E0000-0x000000007498B000-memory.dmp

Filesize
5.7MB

Download
memory/2324-6-0x00000000743E0000-0x000000007498B000-memory.dmp

Filesize
5.7MB

Download
memory/2324-8-0x00000000743E0000-0x000000007498B000-memory.dmp

Filesize
5.7MB

Download
memory/2324-9-0x00000000743E0000-0x000000007498B000-memory.dmp

Filesize
5.7MB

Download