hawkeye | 5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115

Analysis

max time kernel
153s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe
Size

4.1MB
MD5

bcf2d47e89eae5e561786e67e18944b8
SHA1

8df0dec10fcb6f6ca6127a84f4eb79ee40f77ddd
SHA256

5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115
SHA512

56df6ee44deafb76dd781d1e9261076634aeda0a3a04f175e382f3f4f3c417349e5662fec69401e3b2958209f8db270a7fa8a8f5201b6d61a2dd2fb1ef25aa30
SSDEEP

98304:Qzi78zCdEFvizhzP0jkWnQBCfBr/XG5rMBD:qNCaiNAjYkt/XG5rMh

Score

10^/10

hawkeye collection keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
[email protected]
Password:
rune1234

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

NirSoft MailPassView 5 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2036-138-0x0000000000400000-0x00000000004FA000-memory.dmp	MailPassView
behavioral2/memory/4604-147-0x0000000000000000-mapping.dmp	MailPassView
behavioral2/memory/4604-148-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/4604-150-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/4604-151-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 6 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2036-138-0x0000000000400000-0x00000000004FA000-memory.dmp	WebBrowserPassView
behavioral2/memory/4260-153-0x0000000000000000-mapping.dmp	WebBrowserPassView
behavioral2/memory/4260-154-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/4260-156-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/4260-157-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/4260-159-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

Nirsoft 10 IoCs

resource	yara_rule
behavioral2/memory/2036-138-0x0000000000400000-0x00000000004FA000-memory.dmp	Nirsoft
behavioral2/memory/4604-147-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/4604-148-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/4604-150-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/4604-151-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/4260-153-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/4260-154-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/4260-156-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/4260-157-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/4260-159-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

Executes dropped EXE 2 IoCs

pid	Process
5020	6rlgMYXOxB800ra8.exe
4144	EBFile_1.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jagax = "C:\\Users\\Admin\\AppData\\Roaming\\jagax\\kBaH7aMMyHMW.exe"	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\regedit = "C:\\Users\\Admin\\AppData\\Roaming\\regedit\\LR20Ho83Jihf.exe"	EBFile_1.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4404 set thread context of 2036	4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	82
PID 2036 set thread context of 4604	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	85
PID 2036 set thread context of 4260	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe
4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe
4260	vbc.exe
4260	vbc.exe
2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe
Token: SeDebugPrivilege	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe
Token: SeDebugPrivilege	4144	EBFile_1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 5020	4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	81
PID 4404 wrote to memory of 5020	4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	81
PID 4404 wrote to memory of 5020	4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	81
PID 4404 wrote to memory of 2036	4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	82
PID 4404 wrote to memory of 2036	4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	82
PID 4404 wrote to memory of 2036	4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	82
PID 4404 wrote to memory of 2036	4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	82
PID 4404 wrote to memory of 2036	4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	82
PID 4404 wrote to memory of 2036	4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	82
PID 4404 wrote to memory of 2036	4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	82
PID 4404 wrote to memory of 2036	4404	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	82
PID 2036 wrote to memory of 4144	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	84
PID 2036 wrote to memory of 4144	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	84
PID 2036 wrote to memory of 4144	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	84
PID 2036 wrote to memory of 4604	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	85
PID 2036 wrote to memory of 4604	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	85
PID 2036 wrote to memory of 4604	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	85
PID 2036 wrote to memory of 4604	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	85
PID 2036 wrote to memory of 4604	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	85
PID 2036 wrote to memory of 4604	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	85
PID 2036 wrote to memory of 4604	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	85
PID 2036 wrote to memory of 4604	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	85
PID 2036 wrote to memory of 4604	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	85
PID 2036 wrote to memory of 4260	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	86
PID 2036 wrote to memory of 4260	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	86
PID 2036 wrote to memory of 4260	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	86
PID 2036 wrote to memory of 4260	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	86
PID 2036 wrote to memory of 4260	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	86
PID 2036 wrote to memory of 4260	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	86
PID 2036 wrote to memory of 4260	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	86
PID 2036 wrote to memory of 4260	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	86
PID 2036 wrote to memory of 4260	2036	5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe	86

C:\Users\Admin\AppData\Local\Temp\5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe
"C:\Users\Admin\AppData\Local\Temp\5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Users\Admin\AppData\Local\Temp\6rlgMYXOxB800ra8.exe
  "C:\Users\Admin\AppData\Local\Temp\6rlgMYXOxB800ra8.exe"
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Users\Admin\AppData\Local\Temp\5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe
  "C:\Users\Admin\AppData\Local\Temp\5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe
    "C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    - Accesses Microsoft Outlook accounts
    PID:4604
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4260

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\5f3647bb8dcd43051d9c101e8d1b748bc4a85805079faf4f91881e9012946115.exe.log

Filesize
400B

MD5
0a9b4592cd49c3c21f6767c2dabda92f

SHA1
f534297527ae5ccc0ecb2221ddeb8e58daeb8b74

SHA256
c7effe9cb81a70d738dee863991afefab040290d4c4b78b4202383bcb9f88fcd

SHA512
6b878df474e5bbfb8e9e265f15a76560c2ef151dcebc6388c82d7f6f86ffaf83f5ade5a09f1842e493cb6c8fd63b0b88d088c728fd725f7139f965a5ee332307

Download Submit
C:\Users\Admin\AppData\Local\Temp\6rlgMYXOxB800ra8.exe

Filesize
3.4MB

MD5
78c6235c46c14c40f83d1d0514dab9a5

SHA1
8bda9e7585865eee408eb7157dc8b07aaf440c80

SHA256
4691662a75311acfedd1b7d9ca147239c3cd477367633407735bf924bb0ba967

SHA512
6a5038944d2576cfd68f1b7294b00a1b39bba44eb8b378fd2750a43151f2208f3595b8e4900afabce558a40d398e84c342da34b4f9b41b93fb4b7053d1dcc8c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\6rlgMYXOxB800ra8.exe

Filesize
3.4MB

MD5
78c6235c46c14c40f83d1d0514dab9a5

SHA1
8bda9e7585865eee408eb7157dc8b07aaf440c80

SHA256
4691662a75311acfedd1b7d9ca147239c3cd477367633407735bf924bb0ba967

SHA512
6a5038944d2576cfd68f1b7294b00a1b39bba44eb8b378fd2750a43151f2208f3595b8e4900afabce558a40d398e84c342da34b4f9b41b93fb4b7053d1dcc8c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe

Filesize
163KB

MD5
9142396d079b60d74253b1154a92a0d0

SHA1
c1737af21104fb2b8890569a0aedcd11cd9cba58

SHA256
cad2df8cfab6d9c134f7fbec9b16d402970e1539811d33a3f6df4be474b59b21

SHA512
0c80b6cfc3c7a5215a6d605ac6c4349b85ef28ce7c5d235041ff245825da2e05d0767b2b562f06932af62c27f8e5dae8508d9a37352be7434b7d7c8cf2d701c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\EBFile_1.exe

Filesize
163KB

MD5
9142396d079b60d74253b1154a92a0d0

SHA1
c1737af21104fb2b8890569a0aedcd11cd9cba58

SHA256
cad2df8cfab6d9c134f7fbec9b16d402970e1539811d33a3f6df4be474b59b21

SHA512
0c80b6cfc3c7a5215a6d605ac6c4349b85ef28ce7c5d235041ff245825da2e05d0767b2b562f06932af62c27f8e5dae8508d9a37352be7434b7d7c8cf2d701c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\holdermail.txt

Filesize
3KB

MD5
f94dc819ca773f1e3cb27abbc9e7fa27

SHA1
9a7700efadc5ea09ab288544ef1e3cd876255086

SHA256
a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

SHA512
72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

Download Submit
memory/2036-138-0x0000000000400000-0x00000000004FA000-memory.dmp

Filesize
1000KB

Download
memory/2036-142-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/2036-140-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/2036-137-0x0000000000000000-mapping.dmp

Download
memory/4144-152-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/4144-146-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/4144-143-0x0000000000000000-mapping.dmp

Download
memory/4260-153-0x0000000000000000-mapping.dmp

Download
memory/4260-154-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4260-156-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4260-157-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4260-159-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4404-132-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/4404-141-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/4404-133-0x0000000075590000-0x0000000075B41000-memory.dmp

Filesize
5.7MB

Download
memory/4604-147-0x0000000000000000-mapping.dmp

Download
memory/4604-148-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4604-150-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4604-151-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/5020-134-0x0000000000000000-mapping.dmp

Download