hawkeye | e4b792f8d07c013c8dddeb023f23482518567b126c3ec51a07eecda4b26fc63b

Analysis

max time kernel
145s
max time network
105s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
order14062020849992334.exe
Size 933KB
Sample201109-ltdd76h57s
SHA256 e4b792f8d07c013c8dddeb023f23482518567b126c3ec51a07eecda4b26fc63b
MD5 f75c9cd637f6b4be2f7f3a70015fb27d
SHA1 77d102e814bb58db5f53d8d61946057a9b48f330
SHA512 bce48daff2246a7c702e341361e85fdcd92edd3c014ead830175e3983c12e3c290dde2d4d55558dac0ec2484753d853633c0fdf691a09dc3655c5f86090c10d7
MD5 SHA1 SHA512

Score

10^/10

hawkeye keylogger persistence spyware stealer trojan upx

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.urban.co.th
Port
587
Username
[email protected]
Password
Urban@1143

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

Executes dropped EXE 2 IoCs

pid	Process
3908	Windows Update.exe
3164	Windows Update.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5104-0-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/5104-2-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/5104-3-0x0000000000400000-0x000000000051D000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
3164	Windows Update.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	Windows Update.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	whatismyipaddress.com
12	whatismyipaddress.com

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4756 set thread context of 5104	4756	order14062020849992334.exe	72
PID 3908 set thread context of 3164	3908	Windows Update.exe	77
PID 3164 set thread context of 1608	3164	Windows Update.exe	81
PID 3164 set thread context of 1920	3164	Windows Update.exe	82

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4756	order14062020849992334.exe
4756	order14062020849992334.exe
3908	Windows Update.exe
3908	Windows Update.exe
1920	vbc.exe
1920	vbc.exe
3164	Windows Update.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4756	order14062020849992334.exe
3908	Windows Update.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3164	Windows Update.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3164	Windows Update.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 5104	4756	order14062020849992334.exe	72
PID 4756 wrote to memory of 5104	4756	order14062020849992334.exe	72
PID 4756 wrote to memory of 5104	4756	order14062020849992334.exe	72
PID 5104 wrote to memory of 3908	5104	order14062020849992334.exe	76
PID 5104 wrote to memory of 3908	5104	order14062020849992334.exe	76
PID 5104 wrote to memory of 3908	5104	order14062020849992334.exe	76
PID 3908 wrote to memory of 3164	3908	Windows Update.exe	77
PID 3908 wrote to memory of 3164	3908	Windows Update.exe	77
PID 3908 wrote to memory of 3164	3908	Windows Update.exe	77
PID 3164 wrote to memory of 1608	3164	Windows Update.exe	81
PID 3164 wrote to memory of 1608	3164	Windows Update.exe	81
PID 3164 wrote to memory of 1608	3164	Windows Update.exe	81
PID 3164 wrote to memory of 1608	3164	Windows Update.exe	81
PID 3164 wrote to memory of 1608	3164	Windows Update.exe	81
PID 3164 wrote to memory of 1608	3164	Windows Update.exe	81
PID 3164 wrote to memory of 1608	3164	Windows Update.exe	81
PID 3164 wrote to memory of 1608	3164	Windows Update.exe	81
PID 3164 wrote to memory of 1608	3164	Windows Update.exe	81
PID 3164 wrote to memory of 1920	3164	Windows Update.exe	82
PID 3164 wrote to memory of 1920	3164	Windows Update.exe	82
PID 3164 wrote to memory of 1920	3164	Windows Update.exe	82
PID 3164 wrote to memory of 1920	3164	Windows Update.exe	82
PID 3164 wrote to memory of 1920	3164	Windows Update.exe	82
PID 3164 wrote to memory of 1920	3164	Windows Update.exe	82
PID 3164 wrote to memory of 1920	3164	Windows Update.exe	82
PID 3164 wrote to memory of 1920	3164	Windows Update.exe	82
PID 3164 wrote to memory of 1920	3164	Windows Update.exe	82

C:\Users\Admin\AppData\Local\Temp\order14062020849992334.exe
"C:\Users\Admin\AppData\Local\Temp\order14062020849992334.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Local\Temp\order14062020849992334.exe
  "C:\Users\Admin\AppData\Local\Temp\order14062020849992334.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Users\Admin\AppData\Roaming\Windows Update.exe
    "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Users\Admin\AppData\Roaming\Windows Update.exe
      "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
      4⤵
      Executes dropped EXE
      Deletes itself
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3164
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
        5⤵
        
        PID:1608
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1608-17-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1608-19-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/1920-22-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/1920-20-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/3164-15-0x0000000000A02000-0x0000000000A03000-memory.dmp

Download

memory/3164-14-0x00000000022F0000-0x0000000002378000-memory.dmp

Download

memory/5104-5-0x00000000006C2000-0x00000000006C3000-memory.dmp

Download

memory/5104-2-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/5104-3-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/5104-4-0x0000000002320000-0x00000000023A8000-memory.dmp

Download

memory/5104-0-0x0000000000400000-0x000000000051D000-memory.dmp

Download