hawkeye | db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad

General

Target
db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe
Size 1.1MB
Sample201112-fr9lctv89n
SHA256 db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad
MD5 b7bcb9c26a781ba45f54ec8c22055137
SHA1 bc9c333708df0f83f8d982ac6bd814fad67f955e
SHA512 fd470c7d4e033f84ca795dba6c099b911e52e3eac8120bbb58d0436e38bef001635b678e400aa13b01aa2495af53064159441dd92268082dd1818251706a9dfb
MD5 SHA1 SHA512

Score

10^/10

hawkeye keylogger persistence spyware stealer trojan upx

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.casalsmd.com
Port
587
Username
[email protected]
Password
Carolina123

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3984-1-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/3984-3-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral2/memory/3984-4-0x0000000000400000-0x000000000051D000-memory.dmp	upx

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	whatismyipaddress.com
13	whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2724 set thread context of 3984	2724	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	75
PID 3984 set thread context of 928	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	78
PID 3984 set thread context of 2124	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	80

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2724	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe
2724	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe
2124	vbc.exe
2124	vbc.exe
3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2724	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3984	2724	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	75
PID 2724 wrote to memory of 3984	2724	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	75
PID 2724 wrote to memory of 3984	2724	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	75
PID 3984 wrote to memory of 928	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	78
PID 3984 wrote to memory of 928	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	78
PID 3984 wrote to memory of 928	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	78
PID 3984 wrote to memory of 928	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	78
PID 3984 wrote to memory of 928	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	78
PID 3984 wrote to memory of 928	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	78
PID 3984 wrote to memory of 928	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	78
PID 3984 wrote to memory of 928	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	78
PID 3984 wrote to memory of 928	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	78
PID 3984 wrote to memory of 2124	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	80
PID 3984 wrote to memory of 2124	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	80
PID 3984 wrote to memory of 2124	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	80
PID 3984 wrote to memory of 2124	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	80
PID 3984 wrote to memory of 2124	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	80
PID 3984 wrote to memory of 2124	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	80
PID 3984 wrote to memory of 2124	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	80
PID 3984 wrote to memory of 2124	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	80
PID 3984 wrote to memory of 2124	3984	db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe	80

C:\Users\Admin\AppData\Local\Temp\db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe
"C:\Users\Admin\AppData\Local\Temp\db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe
  "C:\Users\Admin\AppData\Local\Temp\db761ccd842c1538233f685f57dae831da1cb09187eb7fbb1c962f769142ccad.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    PID:928
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Scripting

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-7-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/928-9-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2124-12-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2124-10-0x0000000000400000-0x0000000000458000-memory.dmp

Download

memory/2724-0-0x0000000000400000-0x0000000000517000-memory.dmp

Download

memory/3984-3-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/3984-6-0x0000000000A52000-0x0000000000A53000-memory.dmp

Download

memory/3984-5-0x00000000022C0000-0x0000000002348000-memory.dmp

Download

memory/3984-4-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/3984-1-0x0000000000400000-0x000000000051D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads