hawkeye | a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe
Size

988KB
MD5

43bce7d2d4566464370caaed1ddc3e8d
SHA1

d141faa5ec358cdf27d46abb00ab42b09d8b7561
SHA256

a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978
SHA512

99fac90d8c38faea3cb58e78814d24c60e42788b6159c94bd7f87ce026f0beccf4994a2accec4b04b2825067d37fd02c88e930ae49d5afc45e90771a9b64dff7
SSDEEP

24576:TIEd98/23P+JcpDNTRK/yr4+OCx9fr4WdH:cEdC/QWETKvEyWt

Score

10^/10

hawkeye collection keylogger persistence spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

NirSoft MailPassView 5 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/2768-135-0x0000000000400000-0x00000000004B8000-memory.dmp	MailPassView
behavioral2/memory/2968-152-0x0000000000000000-mapping.dmp	MailPassView
behavioral2/memory/2968-153-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/2968-155-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/2968-156-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 6 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/2768-135-0x0000000000400000-0x00000000004B8000-memory.dmp	WebBrowserPassView
behavioral2/memory/4236-157-0x0000000000000000-mapping.dmp	WebBrowserPassView
behavioral2/memory/4236-158-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/4236-160-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/4236-161-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/4236-163-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

Nirsoft 10 IoCs

resource	yara_rule
behavioral2/memory/2768-135-0x0000000000400000-0x00000000004B8000-memory.dmp	Nirsoft
behavioral2/memory/2968-152-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/2968-153-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/2968-155-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/2968-156-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/4236-157-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/4236-158-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/4236-160-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/4236-161-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/4236-163-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

Executes dropped EXE 2 IoCs

pid	Process
2024	Windows Update.exe
3672	Windows Update.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	Windows Update.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	whatismyipaddress.com

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1260 set thread context of 2768	1260	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe	84
PID 2024 set thread context of 3672	2024	Windows Update.exe	88
PID 3672 set thread context of 2968	3672	Windows Update.exe	89
PID 3672 set thread context of 4236	3672	Windows Update.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1260	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe
1260	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe
2024	Windows Update.exe
2024	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe
3672	Windows Update.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1260	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe
Token: SeDebugPrivilege	2024	Windows Update.exe
Token: SeDebugPrivilege	3672	Windows Update.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3672	Windows Update.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2768	1260	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe	84
PID 1260 wrote to memory of 2768	1260	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe	84
PID 1260 wrote to memory of 2768	1260	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe	84
PID 1260 wrote to memory of 2768	1260	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe	84
PID 1260 wrote to memory of 2768	1260	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe	84
PID 1260 wrote to memory of 2768	1260	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe	84
PID 1260 wrote to memory of 2768	1260	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe	84
PID 1260 wrote to memory of 2768	1260	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe	84
PID 2768 wrote to memory of 2024	2768	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe	87
PID 2768 wrote to memory of 2024	2768	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe	87
PID 2768 wrote to memory of 2024	2768	a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe	87
PID 2024 wrote to memory of 3672	2024	Windows Update.exe	88
PID 2024 wrote to memory of 3672	2024	Windows Update.exe	88
PID 2024 wrote to memory of 3672	2024	Windows Update.exe	88
PID 2024 wrote to memory of 3672	2024	Windows Update.exe	88
PID 2024 wrote to memory of 3672	2024	Windows Update.exe	88
PID 2024 wrote to memory of 3672	2024	Windows Update.exe	88
PID 2024 wrote to memory of 3672	2024	Windows Update.exe	88
PID 2024 wrote to memory of 3672	2024	Windows Update.exe	88
PID 3672 wrote to memory of 2968	3672	Windows Update.exe	89
PID 3672 wrote to memory of 2968	3672	Windows Update.exe	89
PID 3672 wrote to memory of 2968	3672	Windows Update.exe	89
PID 3672 wrote to memory of 2968	3672	Windows Update.exe	89
PID 3672 wrote to memory of 2968	3672	Windows Update.exe	89
PID 3672 wrote to memory of 2968	3672	Windows Update.exe	89
PID 3672 wrote to memory of 2968	3672	Windows Update.exe	89
PID 3672 wrote to memory of 2968	3672	Windows Update.exe	89
PID 3672 wrote to memory of 2968	3672	Windows Update.exe	89
PID 3672 wrote to memory of 4236	3672	Windows Update.exe	90
PID 3672 wrote to memory of 4236	3672	Windows Update.exe	90
PID 3672 wrote to memory of 4236	3672	Windows Update.exe	90
PID 3672 wrote to memory of 4236	3672	Windows Update.exe	90
PID 3672 wrote to memory of 4236	3672	Windows Update.exe	90
PID 3672 wrote to memory of 4236	3672	Windows Update.exe	90
PID 3672 wrote to memory of 4236	3672	Windows Update.exe	90
PID 3672 wrote to memory of 4236	3672	Windows Update.exe	90
PID 3672 wrote to memory of 4236	3672	Windows Update.exe	90

C:\Users\Admin\AppData\Local\Temp\a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe
"C:\Users\Admin\AppData\Local\Temp\a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe
  "C:\Users\Admin\AppData\Local\Temp\a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Users\Admin\AppData\Roaming\Windows Update.exe
    "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Users\Admin\AppData\Roaming\Windows Update.exe
      "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3672
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:2968
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
        5⤵
        
        PID:4236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978.exe.log

Filesize
408B

MD5
04ad5d645afd4aad8257d37d2b197bd9

SHA1
f27458933c22a18ed06c3ef023d9356bae6f5e89

SHA256
519a7b0a515b09c8d149c48a26e782e13decd80c2a2957a751f58801bed026d0

SHA512
34097f7ec87c917ebb2f38a156a33ff1b5f8570141acd666a1fce2cd5d40e464762a3a596a44f078318f92823a7d7b961751c4399040a09e5eddb941f22c4754

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
102B

MD5
f1cb9d842d3741847a1636b09a8809b5

SHA1
0ccd48d839bf422bad1fa8ec375efa991536d630

SHA256
76b6f817981b2010bdcb62781b377bfe53abda1a0838818528243fe791a35803

SHA512
664dc68d8a3430d309e840d8bb17692ffabd9cab09cf423136f90e0b111ddfdc49b6e840d2daa13dc7c7be380f282a455add90b3baa63a94a01eb1ec7442324c

Download Submit
C:\Users\Admin\AppData\Local\Temp\holdermail.txt

Filesize
3KB

MD5
f94dc819ca773f1e3cb27abbc9e7fa27

SHA1
9a7700efadc5ea09ab288544ef1e3cd876255086

SHA256
a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

SHA512
72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
988KB

MD5
43bce7d2d4566464370caaed1ddc3e8d

SHA1
d141faa5ec358cdf27d46abb00ab42b09d8b7561

SHA256
a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978

SHA512
99fac90d8c38faea3cb58e78814d24c60e42788b6159c94bd7f87ce026f0beccf4994a2accec4b04b2825067d37fd02c88e930ae49d5afc45e90771a9b64dff7

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
988KB

MD5
43bce7d2d4566464370caaed1ddc3e8d

SHA1
d141faa5ec358cdf27d46abb00ab42b09d8b7561

SHA256
a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978

SHA512
99fac90d8c38faea3cb58e78814d24c60e42788b6159c94bd7f87ce026f0beccf4994a2accec4b04b2825067d37fd02c88e930ae49d5afc45e90771a9b64dff7

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe

Filesize
988KB

MD5
43bce7d2d4566464370caaed1ddc3e8d

SHA1
d141faa5ec358cdf27d46abb00ab42b09d8b7561

SHA256
a6b8782fa479cb68fd3643ea41941de8d7fc5b1d01c30d5e52aa264110b89978

SHA512
99fac90d8c38faea3cb58e78814d24c60e42788b6159c94bd7f87ce026f0beccf4994a2accec4b04b2825067d37fd02c88e930ae49d5afc45e90771a9b64dff7

Download Submit
memory/1260-133-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/1260-137-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/1260-132-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/2024-143-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/2024-144-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/2024-148-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/2768-135-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2768-138-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/2768-142-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/2968-156-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2968-153-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2968-155-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3672-151-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/3672-149-0x0000000075210000-0x00000000757C1000-memory.dmp

Filesize
5.7MB

Download
memory/4236-158-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4236-160-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4236-161-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4236-163-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download