hawkeye | 6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc

General

Target

6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
Size

452KB
MD5

43344c56bd5ddc32f2b23e84ca2fedc3
SHA1

46ba23be893b83479cfa6781adcd2c9080cad34f
SHA256

6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc
SHA512

ef82d1aa1137bc62163ee92e32aaebe85bd044707568530fa6d1540b3baf26ad825df0a6d28e79313a6f49070be21f9f7a6ea901250bde128e26d47df58ebe12
SSDEEP

6144:DPd9CRAwDgrPqXkRaz61RHqGTcdzg5KBY1DXiXv6PxJ6F7aAcRbdyDBAFlHj6s45:bnRigrPD1RX++KSJ47ZckAX/U

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

NirSoft MailPassView 8 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/5028-135-0x0000000000000000-mapping.dmp	MailPassView
behavioral2/memory/5028-136-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral2/memory/5028-137-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral2/memory/5028-138-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral2/memory/1116-143-0x0000000000000000-mapping.dmp	MailPassView
behavioral2/memory/1116-144-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/1116-146-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/1116-147-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/5028-135-0x0000000000000000-mapping.dmp	WebBrowserPassView
behavioral2/memory/5028-136-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral2/memory/5028-137-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral2/memory/5028-138-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView

Nirsoft 8 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5028-135-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/5028-136-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral2/memory/5028-137-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral2/memory/5028-138-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral2/memory/1116-143-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/1116-144-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/1116-146-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/1116-147-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

59 whatismyipaddress.com

flow	ioc
59	whatismyipaddress.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe

description	pid	process	target process
PID 1528 set thread context of 5028	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
PID 5028 set thread context of 1116	5028	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3664 schtasks.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe

description pid process

Token: SeDebugPrivilege 5028 6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe

pid process

5028 6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe

pid	process
3664	schtasks.exe

description	pid	process
Token: SeDebugPrivilege	5028	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe

pid	process
5028	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe

description	pid	process	target process
PID 1528 wrote to memory of 3664	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	schtasks.exe
PID 1528 wrote to memory of 3664	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	schtasks.exe
PID 1528 wrote to memory of 3664	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	schtasks.exe
PID 1528 wrote to memory of 1860	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
PID 1528 wrote to memory of 1860	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
PID 1528 wrote to memory of 1860	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
PID 1528 wrote to memory of 5028	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
PID 1528 wrote to memory of 5028	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
PID 1528 wrote to memory of 5028	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
PID 1528 wrote to memory of 5028	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
PID 1528 wrote to memory of 5028	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
PID 1528 wrote to memory of 5028	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
PID 1528 wrote to memory of 5028	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
PID 1528 wrote to memory of 5028	1528	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
PID 5028 wrote to memory of 1116	5028	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	vbc.exe
PID 5028 wrote to memory of 1116	5028	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	vbc.exe
PID 5028 wrote to memory of 1116	5028	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	vbc.exe
PID 5028 wrote to memory of 1116	5028	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	vbc.exe
PID 5028 wrote to memory of 1116	5028	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	vbc.exe
PID 5028 wrote to memory of 1116	5028	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	vbc.exe
PID 5028 wrote to memory of 1116	5028	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	vbc.exe
PID 5028 wrote to memory of 1116	5028	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	vbc.exe
PID 5028 wrote to memory of 1116	5028	6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
"C:\Users\Admin\AppData\Local\Temp\6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Update\Windows" /XML "C:\Users\Admin\AppData\Local\Temp\385729054.xml"
2⤵
- Creates scheduled task(s)
PID:3664

C:\Users\Admin\AppData\Local\Temp\6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
"C:\Users\Admin\AppData\Local\Temp\6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe"
2⤵
PID:1860

C:\Users\Admin\AppData\Local\Temp\6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe
"C:\Users\Admin\AppData\Local\Temp\6c8b8c667a462285e9c52d0371b087879c3c93b481e6afc0482ed0cd3797f6dc.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5028

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
3⤵
- Accesses Microsoft Outlook accounts
PID:1116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\385729054.xml
Filesize
1KB

MD5
b1460274a8d0fc307d3f6a1be491eb16

SHA1
73f6e06db45c880fea9e937f5c41319534c72401

SHA256
bbf52db0cb8944642ba6463e052370f82189e774b0f0ad686ca3f797968f81cb

SHA512
bb68ac11452c83d9c7100e9ddfe237f6a497fdedd3ac24bb9a2c3a17d330ab1e012c554058d290286e581257ea1db59a12c07be1f789895d5cb6f511a5ee4692

Download Submit
memory/1116-143-0x0000000000000000-mapping.dmp

Download
memory/1116-147-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1116-146-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1116-144-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1528-132-0x0000000074A80000-0x0000000075031000-memory.dmp

Filesize
5.7MB

Download
memory/1528-140-0x0000000074A80000-0x0000000075031000-memory.dmp

Filesize
5.7MB

Download
memory/3664-133-0x0000000000000000-mapping.dmp

Download
memory/5028-138-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/5028-142-0x0000000074A80000-0x0000000075031000-memory.dmp

Filesize
5.7MB

Download
memory/5028-141-0x0000000074A80000-0x0000000075031000-memory.dmp

Filesize
5.7MB

Download
memory/5028-137-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/5028-136-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/5028-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads