hawkeye_reborn | facf1d25162e381b5a0520ac954c19fa5cdf3f557e29eacb044dcb88a3d9f84e

Analysis

max time kernel
140s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-05-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

59b3bb669ab455352931a361d586413a_JaffaCakes118.exe
Size

763KB
MD5

59b3bb669ab455352931a361d586413a
SHA1

73a05e565f276f4d85d192eb318fa99647cfb54f
SHA256

facf1d25162e381b5a0520ac954c19fa5cdf3f557e29eacb044dcb88a3d9f84e
SHA512

e077bfc3d777669a5bcf3044b394a53093587d9b1a780f110ac5fffe516a029593ccb54c595874b271e7746bbfc03f64bf7d9b3a0b1fa011a846f32f9bade7d9
SSDEEP

12288:+mafYuDX8lGlOwafYuejB4D5aRTA9aG88m7PPVxJVs1E3AU0eAT0VqdoJOrh2KQl:zkO1DQ29aG8PtxJe1E3AdT0VNsQ1

Score

10^/10

hawkeye_reborn collection keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

10.0.0.0

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
bigGod1234@

Mutex

4446e880-0442-49ca-8fd8-2fd9e40755c1

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:bigGod1234@ _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:4446e880-0442-49ca-8fd8-2fd9e40755c1 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:true _SystemInfo:false _Version:10.0.0.0 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye RebornX, Version=10.0.0.0, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/2200-29-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/2200-30-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/2200-32-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/860-17-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/860-19-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/860-20-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView
behavioral2/memory/860-27-0x0000000000400000-0x000000000045C000-memory.dmp	WebBrowserPassView

Nirsoft 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/860-17-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/860-19-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/860-20-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/860-27-0x0000000000400000-0x000000000045C000-memory.dmp	Nirsoft
behavioral2/memory/2200-29-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/2200-30-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/2200-32-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

59b3bb669ab455352931a361d586413a_JaffaCakes118.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
59	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

59b3bb669ab455352931a361d586413a_JaffaCakes118.exe59b3bb669ab455352931a361d586413a_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3496 set thread context of 848	3496	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	99
PID 848 set thread context of 860	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	101
PID 848 set thread context of 2200	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	102

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exe

pid	Process
4716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

vbc.exe59b3bb669ab455352931a361d586413a_JaffaCakes118.exe

pid	Process
860	vbc.exe
860	vbc.exe
860	vbc.exe
860	vbc.exe
848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe
848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

59b3bb669ab455352931a361d586413a_JaffaCakes118.exe

description	pid	Process
Token: SeDebugPrivilege	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

59b3bb669ab455352931a361d586413a_JaffaCakes118.exe

pid	Process
848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

59b3bb669ab455352931a361d586413a_JaffaCakes118.exe59b3bb669ab455352931a361d586413a_JaffaCakes118.exe

description	pid	Process	procid_target
PID 3496 wrote to memory of 4716	3496	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	97
PID 3496 wrote to memory of 4716	3496	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	97
PID 3496 wrote to memory of 4716	3496	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	97
PID 3496 wrote to memory of 848	3496	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	99
PID 3496 wrote to memory of 848	3496	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	99
PID 3496 wrote to memory of 848	3496	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	99
PID 3496 wrote to memory of 848	3496	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	99
PID 3496 wrote to memory of 848	3496	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	99
PID 3496 wrote to memory of 848	3496	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	99
PID 3496 wrote to memory of 848	3496	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	99
PID 3496 wrote to memory of 848	3496	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	99
PID 848 wrote to memory of 860	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	101
PID 848 wrote to memory of 860	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	101
PID 848 wrote to memory of 860	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	101
PID 848 wrote to memory of 860	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	101
PID 848 wrote to memory of 860	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	101
PID 848 wrote to memory of 860	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	101
PID 848 wrote to memory of 860	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	101
PID 848 wrote to memory of 860	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	101
PID 848 wrote to memory of 860	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	101
PID 848 wrote to memory of 2200	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	102
PID 848 wrote to memory of 2200	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	102
PID 848 wrote to memory of 2200	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	102
PID 848 wrote to memory of 2200	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	102
PID 848 wrote to memory of 2200	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	102
PID 848 wrote to memory of 2200	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	102
PID 848 wrote to memory of 2200	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	102
PID 848 wrote to memory of 2200	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	102
PID 848 wrote to memory of 2200	848	59b3bb669ab455352931a361d586413a_JaffaCakes118.exe	102

C:\Users\Admin\AppData\Local\Temp\59b3bb669ab455352931a361d586413a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59b3bb669ab455352931a361d586413a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LfbKzuBPos" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2D54.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4716
- C:\Users\Admin\AppData\Local\Temp\59b3bb669ab455352931a361d586413a_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\59b3bb669ab455352931a361d586413a_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp58C9.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:860
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp5CD2.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\59b3bb669ab455352931a361d586413a_JaffaCakes118.exe.log

Filesize
686B

MD5
2da5d49e592515901f6adb84aa66860d

SHA1
37017ffa66b85c8e1d00fa426733caad0887cf61

SHA256
b147333035afc91552bb35c2c97a15496204b134877672a18cb1987d2d8d762d

SHA512
6151e54e7efcb14d4b7842b9860438e1cd77036b2e61a72025ff204d35e1181130a0d9522f2ff92f3e960d55e6dda95bbadff0aa5e0799bb51c11316e89c9dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2D54.tmp

Filesize
1KB

MD5
b915c8a9915d48bff1dacf6a6d200e63

SHA1
f140d8309ac8fd29881cc28d472644e3fe147916

SHA256
1d2923ab2765098d65b860cfccaafba23248673485731d0cb7435bcb143dd548

SHA512
bf6ecad48bef9c443a8b6390236359e6029011d5e31288f5701b5db027000c2dba1d62d2ac2068e410105eed7629400602a430579b798873a02e2cc9f9a58ddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp58C9.tmp

Filesize
4KB

MD5
25a7e8d624c2bfdb2facdc50a1d9b965

SHA1
bbf90e7e78dcba692d6a35716d72cd1affc8cf9c

SHA256
880d0a92fcd2d68631b413e0cc98d71fc68337abb19f59901c075e058c694b47

SHA512
35e57b1fd68fd64c325d179323c3383c39cb00e37b42480c0962517eb8ffdffd5d3a95b77122161f651e45ab2fee4a8e5c3f604bd80351a2680f087ea2b9517f

Download Submit
memory/848-11-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/848-14-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/848-33-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/860-25-0x0000000000460000-0x0000000000529000-memory.dmp

Filesize
804KB

Download
memory/860-27-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/860-17-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/860-19-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/860-20-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2200-32-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2200-30-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2200-29-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3496-5-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3496-15-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3496-0-0x0000000074C62000-0x0000000074C63000-memory.dmp

Filesize
4KB

Download
memory/3496-4-0x0000000074C62000-0x0000000074C63000-memory.dmp

Filesize
4KB

Download
memory/3496-3-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3496-2-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download
memory/3496-1-0x0000000074C60000-0x0000000075211000-memory.dmp

Filesize
5.7MB

Download