hawkeye | 517a83a2bab64041edfcba42d9f2e407f50e8beaca0cbde44a250a790cf0c9c0

General

Target

12f463eaf4dcb88c65728d93a2ca6736.exe
Size

686KB
MD5

12f463eaf4dcb88c65728d93a2ca6736
SHA1

edfdb10111cfabc4b3cc37b869f15d9c35950dae
SHA256

517a83a2bab64041edfcba42d9f2e407f50e8beaca0cbde44a250a790cf0c9c0
SHA512

57055ef137e29cec68a784276d59139cc70e9f5979752669b8b20903df2cb2aa676237e3fe7a3dcfacc5a13667adc740bd92520a8d22f8b4c26e5eb6ddb55907

Score

10^/10

keylogger trojan stealer spyware hawkeye persistence

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 whatismyipaddress.com
4 whatismyipaddress.com
6 whatismyipaddress.com

flow	ioc
7	whatismyipaddress.com
4	whatismyipaddress.com
6	whatismyipaddress.com

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

12f463eaf4dcb88c65728d93a2ca6736.exeRegSvcs.exe

description	pid	process	target process
PID 1448 wrote to memory of 680	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 680	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 680	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 680	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 680	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 680	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 680	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 284	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 284	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 284	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 284	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 284	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 284	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 284	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 284	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 284	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 284	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 284	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 1448 wrote to memory of 284	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 284 wrote to memory of 1916	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1916	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1916	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1916	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1916	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1916	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1916	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1916	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1916	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1916	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1660	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1660	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1660	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1660	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1660	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1660	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1660	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1660	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1660	284	RegSvcs.exe	vbc.exe
PID 284 wrote to memory of 1660	284	RegSvcs.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 824 IoCs

Processes:

12f463eaf4dcb88c65728d93a2ca6736.exeRegSvcs.exe

pid	process
1448	12f463eaf4dcb88c65728d93a2ca6736.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe
284	RegSvcs.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

12f463eaf4dcb88c65728d93a2ca6736.exeRegSvcs.exe

description	pid	process	target process
PID 1448 set thread context of 284	1448	12f463eaf4dcb88c65728d93a2ca6736.exe	RegSvcs.exe
PID 284 set thread context of 1916	284	RegSvcs.exe	vbc.exe
PID 284 set thread context of 1660	284	RegSvcs.exe	vbc.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	RegSvcs.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

12f463eaf4dcb88c65728d93a2ca6736.exeRegSvcs.exe

description pid process

Token: SeDebugPrivilege 1448 12f463eaf4dcb88c65728d93a2ca6736.exe
Token: SeDebugPrivilege 284 RegSvcs.exe
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	pid	process
Token: SeDebugPrivilege	1448	12f463eaf4dcb88c65728d93a2ca6736.exe
Token: SeDebugPrivilege	284	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\12f463eaf4dcb88c65728d93a2ca6736.exe
"C:\Users\Admin\AppData\Local\Temp\12f463eaf4dcb88c65728d93a2ca6736.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1448

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"{path}"
2⤵
PID:680

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"{path}"
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Adds Run entry to start application
- Suspicious use of AdjustPrivilegeToken
PID:284

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
3⤵
PID:1916

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
3⤵
PID:1660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Scripting

1

T1064

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Download Submit
memory/284-0-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/284-1-0x0000000000480BEE-mapping.dmp

Download
memory/284-2-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/284-3-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1660-7-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1660-8-0x0000000000442628-mapping.dmp

Download
memory/1660-9-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1916-4-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1916-5-0x0000000000411654-mapping.dmp

Download
memory/1916-6-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads