hawkeye_reborn | ca691249fc974266ee192fc81d993db419770095497fa58913219c06bc58a368

Analysis

max time kernel
131s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe
Size

873KB
MD5

8533c945b368586fe1e08da4d80f83fc
SHA1

54726c1276e6b64ec137cb3a120af1eae429347c
SHA256

ca691249fc974266ee192fc81d993db419770095497fa58913219c06bc58a368
SHA512

95d9e2c41fce3c0f903e2a15e626a43d08d8363e4de8b8aa7a670ab614de453b0c86358dd4d5b54a1b6638d29ccb1ef31881b2763a813509b0cdbc9c6fdcef4a
SSDEEP

12288:u1Ago61eEnBmGXIjuj+5rTb8IhBiFOMiToyMTdaEGGWClASpC7OOnOUdra5SSVZ1:4bNI6j+1Tb9zuiEycdaxMCXLrZy

Score

10^/10

hawkeye_reborn m00nd3v_logger collection infostealer keylogger spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol: smtp
Host:
mail.privateemail.com
Port:
587
Username:
[email protected]
Password:
elvoman876

Mutex

55eac834-e547-4829-a0cd-89e4bf262cba

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:elvoman876 _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:55eac834-e547-4829-a0cd-89e4bf262cba _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Signatures

HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

M00nD3v Logger payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/memory/3684-10-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2116-28-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/2116-30-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/2116-31-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView
behavioral2/memory/2116-33-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/5004-17-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/5004-19-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/5004-20-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView
behavioral2/memory/5004-26-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Nirsoft 8 IoCs

resource	yara_rule
behavioral2/memory/5004-17-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/5004-19-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/5004-20-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/5004-26-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/2116-28-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/2116-30-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/2116-31-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral2/memory/2116-33-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
65	bot.whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 548 set thread context of 3684	548	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	105
PID 3684 set thread context of 5004	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	106
PID 3684 set thread context of 2116	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	108

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
5004	vbc.exe
5004	vbc.exe
5004	vbc.exe
5004	vbc.exe
5004	vbc.exe
5004	vbc.exe
5004	vbc.exe
5004	vbc.exe
5004	vbc.exe
5004	vbc.exe
5004	vbc.exe
5004	vbc.exe
3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe
3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 548 wrote to memory of 3056	548	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	103
PID 548 wrote to memory of 3056	548	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	103
PID 548 wrote to memory of 3056	548	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	103
PID 548 wrote to memory of 3684	548	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	105
PID 548 wrote to memory of 3684	548	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	105
PID 548 wrote to memory of 3684	548	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	105
PID 548 wrote to memory of 3684	548	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	105
PID 548 wrote to memory of 3684	548	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	105
PID 548 wrote to memory of 3684	548	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	105
PID 548 wrote to memory of 3684	548	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	105
PID 548 wrote to memory of 3684	548	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	105
PID 3684 wrote to memory of 5004	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	106
PID 3684 wrote to memory of 5004	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	106
PID 3684 wrote to memory of 5004	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	106
PID 3684 wrote to memory of 5004	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	106
PID 3684 wrote to memory of 5004	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	106
PID 3684 wrote to memory of 5004	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	106
PID 3684 wrote to memory of 5004	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	106
PID 3684 wrote to memory of 5004	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	106
PID 3684 wrote to memory of 5004	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	106
PID 3684 wrote to memory of 2116	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	108
PID 3684 wrote to memory of 2116	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	108
PID 3684 wrote to memory of 2116	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	108
PID 3684 wrote to memory of 2116	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	108
PID 3684 wrote to memory of 2116	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	108
PID 3684 wrote to memory of 2116	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	108
PID 3684 wrote to memory of 2116	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	108
PID 3684 wrote to memory of 2116	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	108
PID 3684 wrote to memory of 2116	3684	8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe	108

C:\Users\Admin\AppData\Local\Temp\8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TkVefAFugzdI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1587.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3056
- C:\Users\Admin\AppData\Local\Temp\8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3684
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp4205.tmp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5004
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp460E.tmp"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scripting

T1064

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\8533c945b368586fe1e08da4d80f83fc_JaffaCakes118.exe.log

Filesize
588B

MD5
49461f799113a05a28d6b992090c22ce

SHA1
4049a26ca32ff9ed84fd748b75b36b73e17510ce

SHA256
efa0ab0bd196baf69522d0e11a8bb384a1f0e1806590db7b6ed34abcf6faf5c3

SHA512
dffd0fc9f13c5821f9a55bbfb0e1cb980b29903228805fda0331de68ef1ecfa7e716ebcb50c1a2429e5373f6c9e31977472e04769adf9feac8c7fe10f1814bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1587.tmp

Filesize
1KB

MD5
9a4b2b8596e2aeb25010fff71bdcc404

SHA1
6441d96efef524269cc04d17a741c68f9d630b38

SHA256
d1d7d3777b60f794de2c0ffe08e0d72f5c22cfa3ba24e2d564a04a1914742217

SHA512
1e5a14161ea72f9ccb2da818829c211037e611daa2a153b006287d49697e459f401a6c3a048818a36e1a228543b5f17decae8a7b33584dee90e67e4b678900b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4205.tmp

Filesize
4KB

MD5
25a7e8d624c2bfdb2facdc50a1d9b965

SHA1
bbf90e7e78dcba692d6a35716d72cd1affc8cf9c

SHA256
880d0a92fcd2d68631b413e0cc98d71fc68337abb19f59901c075e058c694b47

SHA512
35e57b1fd68fd64c325d179323c3383c39cb00e37b42480c0962517eb8ffdffd5d3a95b77122161f651e45ab2fee4a8e5c3f604bd80351a2680f087ea2b9517f

Download Submit
memory/548-0-0x0000000074F82000-0x0000000074F83000-memory.dmp

Filesize
4KB

Download
memory/548-3-0x0000000074F82000-0x0000000074F83000-memory.dmp

Filesize
4KB

Download
memory/548-1-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/548-4-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/548-15-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/548-2-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/2116-33-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2116-32-0x0000000000420000-0x00000000004E9000-memory.dmp

Filesize
804KB

Download
memory/2116-31-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2116-30-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2116-28-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3684-14-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/3684-34-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/3684-13-0x0000000074F80000-0x0000000075531000-memory.dmp

Filesize
5.7MB

Download
memory/3684-10-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/5004-20-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5004-26-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5004-17-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5004-19-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download