hawkeye | 1423053f90855d33858db47f354055b660943104c1c18f848c9b7b415979dc5f

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

NirSoft MailPassView 5 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral6/memory/1476-13-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral6/memory/1476-14-0x000000000047EAEE-mapping.dmp	MailPassView
behavioral6/memory/3140-20-0x0000000000411654-mapping.dmp	MailPassView
behavioral6/memory/3140-19-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral6/memory/3140-21-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 5 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral6/memory/1476-13-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral6/memory/1476-14-0x000000000047EAEE-mapping.dmp	WebBrowserPassView
behavioral6/memory/3604-23-0x0000000000442628-mapping.dmp	WebBrowserPassView
behavioral6/memory/3604-22-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral6/memory/3604-24-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

Nirsoft 8 IoCs

Processes:

resource	yara_rule
behavioral6/memory/1476-13-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral6/memory/1476-14-0x000000000047EAEE-mapping.dmp	Nirsoft
behavioral6/memory/3140-20-0x0000000000411654-mapping.dmp	Nirsoft
behavioral6/memory/3140-19-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral6/memory/3140-21-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral6/memory/3604-23-0x0000000000442628-mapping.dmp	Nirsoft
behavioral6/memory/3604-22-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral6/memory/3604-24-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

Executes dropped EXE 2 IoCs

Processes:

odm.exeodm.exe

pid process

3548 odm.exe
3568 odm.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

odm.exeRegSvcs.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 whatismyipaddress.com
21 whatismyipaddress.com

flow	ioc
19	whatismyipaddress.com
21	whatismyipaddress.com

Suspicious use of SetThreadContext 4 IoCs

Processes:

odm.exeRegSvcs.exe

description	pid	process	target process
PID 3568 set thread context of 1476	3568	odm.exe	RegSvcs.exe
PID 3568 set thread context of 1976	3568	odm.exe	RegSvcs.exe
PID 1476 set thread context of 3140	1476	RegSvcs.exe	vbc.exe
PID 1476 set thread context of 3604	1476	RegSvcs.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

odm.exeRegSvcs.exe

pid	process
3548	odm.exe
3548	odm.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe
1976	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 1476 RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	1476	RegSvcs.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

2c01b007729230c415420ad641ad92eb.exeodm.exeodm.exeRegSvcs.exe

description	pid	process	target process
PID 796 wrote to memory of 3548	796	2c01b007729230c415420ad641ad92eb.exe	odm.exe
PID 796 wrote to memory of 3548	796	2c01b007729230c415420ad641ad92eb.exe	odm.exe
PID 796 wrote to memory of 3548	796	2c01b007729230c415420ad641ad92eb.exe	odm.exe
PID 3548 wrote to memory of 3568	3548	odm.exe	odm.exe
PID 3548 wrote to memory of 3568	3548	odm.exe	odm.exe
PID 3548 wrote to memory of 3568	3548	odm.exe	odm.exe
PID 3568 wrote to memory of 1476	3568	odm.exe	RegSvcs.exe
PID 3568 wrote to memory of 1476	3568	odm.exe	RegSvcs.exe
PID 3568 wrote to memory of 1476	3568	odm.exe	RegSvcs.exe
PID 3568 wrote to memory of 1476	3568	odm.exe	RegSvcs.exe
PID 3568 wrote to memory of 1476	3568	odm.exe	RegSvcs.exe
PID 3568 wrote to memory of 1476	3568	odm.exe	RegSvcs.exe
PID 3568 wrote to memory of 1476	3568	odm.exe	RegSvcs.exe
PID 3568 wrote to memory of 1476	3568	odm.exe	RegSvcs.exe
PID 3568 wrote to memory of 1976	3568	odm.exe	RegSvcs.exe
PID 3568 wrote to memory of 1976	3568	odm.exe	RegSvcs.exe
PID 3568 wrote to memory of 1976	3568	odm.exe	RegSvcs.exe
PID 3568 wrote to memory of 1976	3568	odm.exe	RegSvcs.exe
PID 3568 wrote to memory of 1976	3568	odm.exe	RegSvcs.exe
PID 1476 wrote to memory of 3140	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3140	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3140	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3140	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3140	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3140	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3140	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3140	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3140	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3604	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3604	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3604	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3604	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3604	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3604	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3604	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3604	1476	RegSvcs.exe	vbc.exe
PID 1476 wrote to memory of 3604	1476	RegSvcs.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe
"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:796
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  "C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\KGDSU
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3568
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1476
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
        5⤵
        
        PID:3140
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
        5⤵
        
        PID:3604
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\KGDSU
      4⤵
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Download Submit
C:\Users\Admin\AppData\Roaming\wou\KGDSU

Download Submit
C:\Users\Admin\AppData\Roaming\wou\kja-pex

Download Submit
C:\Users\Admin\AppData\Roaming\wou\odm.exe

Download Submit
C:\Users\Admin\AppData\Roaming\wou\odm.exe

Download Submit
C:\Users\Admin\AppData\Roaming\wou\odm.exe

Download Submit
C:\Users\Admin\AppData\Roaming\wou\rid.ico

Download Submit
C:\Users\Admin\AppData\Roaming\wou\spd

Download Submit
memory/1476-13-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1476-14-0x000000000047EAEE-mapping.dmp

Download
memory/1976-17-0x0000000000700000-0x00000000007CC000-memory.dmp

Filesize
816KB

Download
memory/1976-16-0x00000000007164E1-mapping.dmp

Download
memory/1976-15-0x0000000000700000-0x00000000007CC000-memory.dmp

Filesize
816KB

Download
memory/3140-20-0x0000000000411654-mapping.dmp

Download
memory/3140-19-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3140-21-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3548-2-0x0000000000000000-mapping.dmp

Download
memory/3548-5-0x00000000738C0000-0x0000000073953000-memory.dmp

Filesize
588KB

Download
memory/3568-9-0x0000000000000000-mapping.dmp

Download
memory/3568-11-0x00000000738C0000-0x0000000073953000-memory.dmp

Filesize
588KB

Download
memory/3604-23-0x0000000000442628-mapping.dmp

Download
memory/3604-22-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/3604-24-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download