hawkeye | 286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

Analysis

max time kernel
150s
max time network
137s
platform
windows7_x64
resource
win7v20201028
submitted
18-11-2020 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prueba de pago.exe
Size

1.1MB
MD5

b3a244a097904a4d6689a582d7ec9985
SHA1

b16032d83c91ee333221fafadd5f2381ca659d78
SHA256

286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7
SHA512

533cbddf7d78740e2586d58588c5d0ad4407417c835c0407d93d86b3202626f160d664b69aefb3d32f94416d7558d6ba9377a28f44be3ff21ace2fd4e51f0748

Score

10^/10

hawkeye keylogger persistence spyware stealer trojan upx

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.jif-asesores.com
Port:
587
Username:
administracion@jif-asesores.com
Password:
Aa122334455

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Executes dropped EXE 2 IoCs

Processes:

Windows Update.exeWindows Update.exe

pid process

1660 Windows Update.exe
968 Windows Update.exe

pid	process
1660	Windows Update.exe
968	Windows Update.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1796-1-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/1796-3-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/1796-4-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/968-25-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/968-26-0x0000000000400000-0x000000000051D000-memory.dmp	upx

Deletes itself 1 IoCs

Processes:

Windows Update.exe

pid process

968 Windows Update.exe

pid	process
968	Windows Update.exe

Loads dropped DLL 8 IoCs

Processes:

Prueba de pago.exeWindows Update.exeWindows Update.exe

pid	process
1796	Prueba de pago.exe
1660	Windows Update.exe
1660	Windows Update.exe
1660	Windows Update.exe
1660	Windows Update.exe
968	Windows Update.exe
968	Windows Update.exe
968	Windows Update.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Windows Update.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	Windows Update.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 whatismyipaddress.com
8 whatismyipaddress.com
9 whatismyipaddress.com

flow	ioc
6	whatismyipaddress.com
8	whatismyipaddress.com
9	whatismyipaddress.com

Suspicious use of SetThreadContext 4 IoCs

Processes:

Prueba de pago.exeWindows Update.exeWindows Update.exe

description	pid	process	target process
PID 1072 set thread context of 1796	1072	Prueba de pago.exe	Prueba de pago.exe
PID 1660 set thread context of 968	1660	Windows Update.exe	Windows Update.exe
PID 968 set thread context of 1572	968	Windows Update.exe	vbc.exe
PID 968 set thread context of 1996	968	Windows Update.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

Prueba de pago.exeWindows Update.exeWindows Update.exe

pid process

1072 Prueba de pago.exe
1660 Windows Update.exe
968 Windows Update.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Prueba de pago.exeWindows Update.exe

pid process

1072 Prueba de pago.exe
1660 Windows Update.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Windows Update.exe

description pid process

Token: SeDebugPrivilege 968 Windows Update.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Windows Update.exe

pid process

968 Windows Update.exe

pid	process
1072	Prueba de pago.exe
1660	Windows Update.exe
968	Windows Update.exe

pid	process
1072	Prueba de pago.exe
1660	Windows Update.exe

description	pid	process
Token: SeDebugPrivilege	968	Windows Update.exe

pid	process
968	Windows Update.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

Prueba de pago.exePrueba de pago.exeWindows Update.exeWindows Update.exe

description	pid	process	target process
PID 1072 wrote to memory of 1796	1072	Prueba de pago.exe	Prueba de pago.exe
PID 1072 wrote to memory of 1796	1072	Prueba de pago.exe	Prueba de pago.exe
PID 1072 wrote to memory of 1796	1072	Prueba de pago.exe	Prueba de pago.exe
PID 1072 wrote to memory of 1796	1072	Prueba de pago.exe	Prueba de pago.exe
PID 1796 wrote to memory of 1660	1796	Prueba de pago.exe	Windows Update.exe
PID 1796 wrote to memory of 1660	1796	Prueba de pago.exe	Windows Update.exe
PID 1796 wrote to memory of 1660	1796	Prueba de pago.exe	Windows Update.exe
PID 1796 wrote to memory of 1660	1796	Prueba de pago.exe	Windows Update.exe
PID 1796 wrote to memory of 1660	1796	Prueba de pago.exe	Windows Update.exe
PID 1796 wrote to memory of 1660	1796	Prueba de pago.exe	Windows Update.exe
PID 1796 wrote to memory of 1660	1796	Prueba de pago.exe	Windows Update.exe
PID 1660 wrote to memory of 968	1660	Windows Update.exe	Windows Update.exe
PID 1660 wrote to memory of 968	1660	Windows Update.exe	Windows Update.exe
PID 1660 wrote to memory of 968	1660	Windows Update.exe	Windows Update.exe
PID 1660 wrote to memory of 968	1660	Windows Update.exe	Windows Update.exe
PID 1660 wrote to memory of 968	1660	Windows Update.exe	Windows Update.exe
PID 1660 wrote to memory of 968	1660	Windows Update.exe	Windows Update.exe
PID 1660 wrote to memory of 968	1660	Windows Update.exe	Windows Update.exe
PID 968 wrote to memory of 1572	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1572	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1572	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1572	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1572	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1572	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1572	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1572	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1572	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1572	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1572	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1572	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1572	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1996	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1996	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1996	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1996	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1996	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1996	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1996	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1996	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1996	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1996	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1996	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1996	968	Windows Update.exe	vbc.exe
PID 968 wrote to memory of 1996	968	Windows Update.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\Prueba de pago.exe
"C:\Users\Admin\AppData\Local\Temp\Prueba de pago.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1072

C:\Users\Admin\AppData\Local\Temp\Prueba de pago.exe
"C:\Users\Admin\AppData\Local\Temp\Prueba de pago.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1796

C:\Users\Admin\AppData\Roaming\Windows Update.exe
"C:\Users\Admin\AppData\Roaming\Windows Update.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1660

C:\Users\Admin\AppData\Roaming\Windows Update.exe
"C:\Users\Admin\AppData\Roaming\Windows Update.exe"
4⤵
- Executes dropped EXE
- Deletes itself
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
5⤵
PID:1572

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
5⤵
PID:1996

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Scripting

T1064

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt
MD5
3e780c29d47d9f9d3f0d5838fe149240

SHA1
5b46a5be69ac636f69e813e0c8f813e841e5a008

SHA256
36d52b903d281f2ce0f457b401e4af731431cf16cd53f34ab79f7ef8508375d9

SHA512
049a9ce3a983e7f418994876ec005babe462815116114469c90ce584a1aebf3f707b2e6c6f53014af7532830afcf3bf8b345dc0aaf98ad04dbcf48bebcb5328c

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderwb.txt
MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe
MD5
b3a244a097904a4d6689a582d7ec9985

SHA1
b16032d83c91ee333221fafadd5f2381ca659d78

SHA256
286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

SHA512
533cbddf7d78740e2586d58588c5d0ad4407417c835c0407d93d86b3202626f160d664b69aefb3d32f94416d7558d6ba9377a28f44be3ff21ace2fd4e51f0748

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe
MD5
b3a244a097904a4d6689a582d7ec9985

SHA1
b16032d83c91ee333221fafadd5f2381ca659d78

SHA256
286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

SHA512
533cbddf7d78740e2586d58588c5d0ad4407417c835c0407d93d86b3202626f160d664b69aefb3d32f94416d7558d6ba9377a28f44be3ff21ace2fd4e51f0748

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe
MD5
b3a244a097904a4d6689a582d7ec9985

SHA1
b16032d83c91ee333221fafadd5f2381ca659d78

SHA256
286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

SHA512
533cbddf7d78740e2586d58588c5d0ad4407417c835c0407d93d86b3202626f160d664b69aefb3d32f94416d7558d6ba9377a28f44be3ff21ace2fd4e51f0748

Download Submit
\Users\Admin\AppData\Roaming\Windows Update.exe
MD5
b3a244a097904a4d6689a582d7ec9985

SHA1
b16032d83c91ee333221fafadd5f2381ca659d78

SHA256
286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

SHA512
533cbddf7d78740e2586d58588c5d0ad4407417c835c0407d93d86b3202626f160d664b69aefb3d32f94416d7558d6ba9377a28f44be3ff21ace2fd4e51f0748

Download Submit
\Users\Admin\AppData\Roaming\Windows Update.exe
MD5
b3a244a097904a4d6689a582d7ec9985

SHA1
b16032d83c91ee333221fafadd5f2381ca659d78

SHA256
286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

SHA512
533cbddf7d78740e2586d58588c5d0ad4407417c835c0407d93d86b3202626f160d664b69aefb3d32f94416d7558d6ba9377a28f44be3ff21ace2fd4e51f0748

Download Submit
\Users\Admin\AppData\Roaming\Windows Update.exe
MD5
b3a244a097904a4d6689a582d7ec9985

SHA1
b16032d83c91ee333221fafadd5f2381ca659d78

SHA256
286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

SHA512
533cbddf7d78740e2586d58588c5d0ad4407417c835c0407d93d86b3202626f160d664b69aefb3d32f94416d7558d6ba9377a28f44be3ff21ace2fd4e51f0748

Download Submit
\Users\Admin\AppData\Roaming\Windows Update.exe
MD5
b3a244a097904a4d6689a582d7ec9985

SHA1
b16032d83c91ee333221fafadd5f2381ca659d78

SHA256
286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

SHA512
533cbddf7d78740e2586d58588c5d0ad4407417c835c0407d93d86b3202626f160d664b69aefb3d32f94416d7558d6ba9377a28f44be3ff21ace2fd4e51f0748

Download Submit
\Users\Admin\AppData\Roaming\Windows Update.exe
MD5
b3a244a097904a4d6689a582d7ec9985

SHA1
b16032d83c91ee333221fafadd5f2381ca659d78

SHA256
286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

SHA512
533cbddf7d78740e2586d58588c5d0ad4407417c835c0407d93d86b3202626f160d664b69aefb3d32f94416d7558d6ba9377a28f44be3ff21ace2fd4e51f0748

Download Submit
\Users\Admin\AppData\Roaming\Windows Update.exe
MD5
b3a244a097904a4d6689a582d7ec9985

SHA1
b16032d83c91ee333221fafadd5f2381ca659d78

SHA256
286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

SHA512
533cbddf7d78740e2586d58588c5d0ad4407417c835c0407d93d86b3202626f160d664b69aefb3d32f94416d7558d6ba9377a28f44be3ff21ace2fd4e51f0748

Download Submit
\Users\Admin\AppData\Roaming\Windows Update.exe
MD5
b3a244a097904a4d6689a582d7ec9985

SHA1
b16032d83c91ee333221fafadd5f2381ca659d78

SHA256
286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

SHA512
533cbddf7d78740e2586d58588c5d0ad4407417c835c0407d93d86b3202626f160d664b69aefb3d32f94416d7558d6ba9377a28f44be3ff21ace2fd4e51f0748

Download Submit
\Users\Admin\AppData\Roaming\Windows Update.exe
MD5
b3a244a097904a4d6689a582d7ec9985

SHA1
b16032d83c91ee333221fafadd5f2381ca659d78

SHA256
286b416351f4ca6cc215c58692af9be6b9f4eb54c4641160e2a31dfd16c43ec7

SHA512
533cbddf7d78740e2586d58588c5d0ad4407417c835c0407d93d86b3202626f160d664b69aefb3d32f94416d7558d6ba9377a28f44be3ff21ace2fd4e51f0748

Download Submit
memory/968-28-0x00000000003F2000-0x00000000003F3000-memory.dmp

Filesize
4KB

Download
memory/968-19-0x000000000051B4F0-mapping.dmp

Download
memory/968-25-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/968-26-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/968-27-0x0000000001FC0000-0x0000000002048000-memory.dmp

Filesize
544KB

Download
memory/1072-0-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/1452-39-0x000007FEF7800000-0x000007FEF7A7A000-memory.dmp

Filesize
2.5MB

Download
memory/1572-34-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1572-32-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1572-33-0x0000000000411654-mapping.dmp

Download
memory/1660-16-0x0000000000400000-0x0000000000519000-memory.dmp

Filesize
1.1MB

Download
memory/1660-10-0x0000000000000000-mapping.dmp

Download
memory/1796-6-0x0000000000392000-0x0000000000393000-memory.dmp

Filesize
4KB

Download
memory/1796-2-0x000000000051B4F0-mapping.dmp

Download
memory/1796-3-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1796-4-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1796-5-0x0000000001EB0000-0x0000000001F38000-memory.dmp

Filesize
544KB

Download
memory/1796-7-0x0000000000520000-0x00000000005A3000-memory.dmp

Filesize
524KB

Download
memory/1796-1-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1996-36-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1996-37-0x0000000000442628-mapping.dmp

Download
memory/1996-38-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download