hawkeye_reborn | 572f51e149ac61321c96e85d1f88e17ff4269ea68c02b968ca86779b22ecd542

General

Target
jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe
Size 2.1MB
Sample261009-v21xjasx2m
SHA256 572f51e149ac61321c96e85d1f88e17ff4269ea68c02b968ca86779b22ecd542
MD5 ecdbaba92e550eeb96a91c2baa92995a
SHA1 1832ddee4f88723a7f7c490d8182df0081e8cff6
SHA512 10701c90a72b1c053b7bc43aff3bd7f9e7ec431b98c93ed36c3f7f879431a7bf66eafdfd8b28c58e73e4b584303b24c7ea4d1390721353df59d954c155b11cf5
SSDEEP 24576:zCdxte/80jYLT3U1jfsWauCXCYfmj/gCZ/4u5KG6X0AqKp6hpKNi+Q:aw80cTsjkWauZt06Oa
TLSH
T1DAA5D0D6A39D82E1CD157AF2FD2827835F3A59324A3430193F5A2D5D9E231B2412DEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery hawkeye_reborn m00nd3v_logger infostealer keylogger persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

hawkeye_reborn

Version

9.0.1.6

Credentials

Protocol
smtp
Host
mail.privateemail.com
Port
587
Username
[email protected]
Password
unlimitedmoney2019@

Mutex

f5b72013-3c74-465c-8a70-83f417b1e4d4

Attributes

fields
map[_AntiDebugger:false _AntiVirusKiller:false _BotKiller:false _ClipboardLogger:true _Delivery:0 _DisableCommandPrompt:false _DisableRegEdit:false _DisableTaskManager:false _Disablers:false _EmailPassword:unlimitedmoney2019@ _EmailPort:587 _EmailSSL:true _EmailServer:mail.privateemail.com _EmailUsername:[email protected] _ExecutionDelay:10 _FTPPort:0 _FTPSFTP:false _FakeMessageIcon:0 _FakeMessageShow:false _FileBinder:false _HideFile:false _HistoryCleaner:false _Install:false _InstallLocation:0 _InstallStartup:false _InstallStartupPersistance:false _KeyStrokeLogger:true _LogInterval:10 _MeltFile:false _Mutex:f5b72013-3c74-465c-8a70-83f417b1e4d4 _PasswordStealer:true _ProcessElevation:false _ProcessProtection:false _ScreenshotLogger:false _SystemInfo:false _Version:9.0.1.6 _WebCamLogger:false _WebsiteBlocker:false _WebsiteVisitor:false _WebsiteVisitorVisible:false _ZoneID:false]
name
HawkEye Keylogger - Reborn v9, Version=9.0.1.6, Culture=neutral, PublicKeyToken=null

Signatures

Family: HawkEye Reborn
HawkEye Reborn is an enhanced version of the HawkEye malware kit.
keylogger trojan stealer spyware hawkeye_reborn
Family: M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware m00nd3v_logger

Detected Nirsoft tools 2 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/3448-14-0x0000000000400000-0x000000000045B000-memory.dmp	Nirsoft
behavioral2/memory/2268-16-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

M00nD3v Logger payload 1 IoCs

Detects M00nD3v Logger payload in memory.

infostealer

resource	yara_rule
behavioral2/memory/2520-4-0x0000000000400000-0x0000000000490000-memory.dmp	m00nd3v_logger

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2268-16-0x0000000000400000-0x000000000041C000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3448-14-0x0000000000400000-0x000000000045B000-memory.dmp	WebBrowserPassView

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.url	jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral2/memory/2520-4-0x0000000000400000-0x0000000000490000-memory.dmp	ConfuserEx

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1072 set thread context of 2520	1072	jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe	88
PID 2520 set thread context of 3448	2520	RegAsm.exe	90
PID 2520 set thread context of 2268	2520	RegAsm.exe	92

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2520	RegAsm.exe
2520	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	RegAsm.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1072	jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe
1072	jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe
1072	jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1072	jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe
1072	jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe
1072	jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2520	RegAsm.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2520	1072	jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe	88
PID 1072 wrote to memory of 2520	1072	jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe	88
PID 2520 wrote to memory of 3448	2520	RegAsm.exe	90
PID 2520 wrote to memory of 3448	2520	RegAsm.exe	90
PID 2520 wrote to memory of 3448	2520	RegAsm.exe	90
PID 2520 wrote to memory of 3448	2520	RegAsm.exe	90
PID 2520 wrote to memory of 3448	2520	RegAsm.exe	90
PID 2520 wrote to memory of 3448	2520	RegAsm.exe	90
PID 2520 wrote to memory of 2268	2520	RegAsm.exe	92
PID 2520 wrote to memory of 2268	2520	RegAsm.exe	92
PID 2520 wrote to memory of 2268	2520	RegAsm.exe	92
PID 2520 wrote to memory of 2268	2520	RegAsm.exe	92
PID 2520 wrote to memory of 2268	2520	RegAsm.exe	92
PID 2520 wrote to memory of 2268	2520	RegAsm.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Autit.cam.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp2DF7.tmp"
    3⤵
    PID:3448
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\Admin\AppData\Local\Temp\tmp1CDC.tmp"
    3⤵
    PID:2268