hawkeye | 712e38d6f7ec0cb09be6fea727a3748b2de1c7c8286b33bb227f68dca34b6073

General

Target

E1418893649007.PDF.exe
Size

1.1MB
MD5

21491189acd58edf2ffcc5829abbb7a6
SHA1

97439584bd72e0ea470085983cf18a02581b76b4
SHA256

712e38d6f7ec0cb09be6fea727a3748b2de1c7c8286b33bb227f68dca34b6073
SHA512

0f0cb57475a5ba07f00c8993febec95cb953b4d1b5f13229db9463e81e4cf584d15b8b1d58a3ffafb459baf0b67dda46efdb445b128ed0470784faef6b8cd716

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

NirSoft MailPassView 5 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/2644-143-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral2/memory/3760-149-0x0000000000000000-mapping.dmp	MailPassView
behavioral2/memory/3760-150-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/3760-152-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/3760-153-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/2644-143-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView

Nirsoft 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2644-143-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral2/memory/3760-149-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/3760-150-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/3760-152-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/3760-153-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

E1418893649007.PDF.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Control Panel\International\Geo\Nation	E1418893649007.PDF.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3463845317-933582289-45817732-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

62 whatismyipaddress.com
64 whatismyipaddress.com

flow	ioc
62	whatismyipaddress.com
64	whatismyipaddress.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

E1418893649007.PDF.exeE1418893649007.PDF.exe

description	pid	process	target process
PID 524 set thread context of 2644	524	E1418893649007.PDF.exe	E1418893649007.PDF.exe
PID 2644 set thread context of 3760	2644	E1418893649007.PDF.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3936 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

4304 powershell.exe
4304 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeE1418893649007.PDF.exe

description pid process

Token: SeDebugPrivilege 4304 powershell.exe
Token: SeDebugPrivilege 2644 E1418893649007.PDF.exe

pid	process
3936	schtasks.exe

pid	process
4304	powershell.exe
4304	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	2644	E1418893649007.PDF.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

E1418893649007.PDF.exeE1418893649007.PDF.exe

description	pid	process	target process
PID 524 wrote to memory of 4304	524	E1418893649007.PDF.exe	powershell.exe
PID 524 wrote to memory of 4304	524	E1418893649007.PDF.exe	powershell.exe
PID 524 wrote to memory of 4304	524	E1418893649007.PDF.exe	powershell.exe
PID 524 wrote to memory of 3936	524	E1418893649007.PDF.exe	schtasks.exe
PID 524 wrote to memory of 3936	524	E1418893649007.PDF.exe	schtasks.exe
PID 524 wrote to memory of 3936	524	E1418893649007.PDF.exe	schtasks.exe
PID 524 wrote to memory of 2644	524	E1418893649007.PDF.exe	E1418893649007.PDF.exe
PID 524 wrote to memory of 2644	524	E1418893649007.PDF.exe	E1418893649007.PDF.exe
PID 524 wrote to memory of 2644	524	E1418893649007.PDF.exe	E1418893649007.PDF.exe
PID 524 wrote to memory of 2644	524	E1418893649007.PDF.exe	E1418893649007.PDF.exe
PID 524 wrote to memory of 2644	524	E1418893649007.PDF.exe	E1418893649007.PDF.exe
PID 524 wrote to memory of 2644	524	E1418893649007.PDF.exe	E1418893649007.PDF.exe
PID 524 wrote to memory of 2644	524	E1418893649007.PDF.exe	E1418893649007.PDF.exe
PID 524 wrote to memory of 2644	524	E1418893649007.PDF.exe	E1418893649007.PDF.exe
PID 2644 wrote to memory of 3760	2644	E1418893649007.PDF.exe	vbc.exe
PID 2644 wrote to memory of 3760	2644	E1418893649007.PDF.exe	vbc.exe
PID 2644 wrote to memory of 3760	2644	E1418893649007.PDF.exe	vbc.exe
PID 2644 wrote to memory of 3760	2644	E1418893649007.PDF.exe	vbc.exe
PID 2644 wrote to memory of 3760	2644	E1418893649007.PDF.exe	vbc.exe
PID 2644 wrote to memory of 3760	2644	E1418893649007.PDF.exe	vbc.exe
PID 2644 wrote to memory of 3760	2644	E1418893649007.PDF.exe	vbc.exe
PID 2644 wrote to memory of 3760	2644	E1418893649007.PDF.exe	vbc.exe
PID 2644 wrote to memory of 3760	2644	E1418893649007.PDF.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\E1418893649007.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\E1418893649007.PDF.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QqCeeJqNyu.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QqCeeJqNyu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4CAF.tmp"
2⤵
- Creates scheduled task(s)
PID:3936

C:\Users\Admin\AppData\Local\Temp\E1418893649007.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\E1418893649007.PDF.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
3⤵
- Accesses Microsoft Outlook accounts
PID:3760

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4CAF.tmp
Filesize
1KB

MD5
7acfbae56484f61df07eca3a2210f7dd

SHA1
a9496ce2e476d3d373df8020e30dab335b48d4b5

SHA256
1f8a21e86e2ec275462ab54172ac3bba278279c1e8dda736ab92c2777b06c05b

SHA512
f7140e6839cf6d57f4c9e7d31d9b4f5ab0e4d0b8de8c3492d0d79ef883a9aebe03d618d9f4b527cac3b49201792e9d5609364721f07ac8696222ae9a3181e3b1

Download Submit
memory/524-135-0x0000000005560000-0x000000000556A000-memory.dmp

Filesize
40KB

Download
memory/524-133-0x00000000059B0000-0x0000000005F54000-memory.dmp

Filesize
5.6MB

Download
memory/524-134-0x00000000054B0000-0x0000000005542000-memory.dmp

Filesize
584KB

Download
memory/524-136-0x0000000001400000-0x000000000149C000-memory.dmp

Filesize
624KB

Download
memory/524-137-0x0000000007B10000-0x0000000007B76000-memory.dmp

Filesize
408KB

Download
memory/524-132-0x0000000000A00000-0x0000000000B18000-memory.dmp

Filesize
1.1MB

Download
memory/2644-143-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2644-142-0x0000000000000000-mapping.dmp

Download
memory/2644-145-0x00000000059B0000-0x0000000005A06000-memory.dmp

Filesize
344KB

Download
memory/3760-153-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3760-149-0x0000000000000000-mapping.dmp

Download
memory/3760-152-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3760-150-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3936-139-0x0000000000000000-mapping.dmp

Download
memory/4304-138-0x0000000000000000-mapping.dmp

Download
memory/4304-148-0x0000000006100000-0x000000000611E000-memory.dmp

Filesize
120KB

Download
memory/4304-147-0x0000000005740000-0x00000000057A6000-memory.dmp

Filesize
408KB

Download
memory/4304-146-0x00000000055A0000-0x00000000055C2000-memory.dmp

Filesize
136KB

Download
memory/4304-144-0x00000000058A0000-0x0000000005EC8000-memory.dmp

Filesize
6.2MB

Download
memory/4304-140-0x00000000050B0000-0x00000000050E6000-memory.dmp

Filesize
216KB

Download
memory/4304-154-0x0000000006CC0000-0x0000000006CF2000-memory.dmp

Filesize
200KB

Download
memory/4304-155-0x000000006FF00000-0x000000006FF4C000-memory.dmp

Filesize
304KB

Download
memory/4304-156-0x0000000006AE0000-0x0000000006AFE000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads