hawkeye | 5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194

General

Target

5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exe
Size

1.1MB
MD5

36d0c2908620bdfe773f4fc6e419aae8
SHA1

1a41c284bfc185f3bc49c57370d6712276de7559
SHA256

5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194
SHA512

ae75ec1f231780007f4596aadaf0e54193bdc4ed222d4dabaed0c8b595aebe4d4273cf93ae30d7af95cd2fa3f9e17ec155bc2e8a38844ab07ff428a75c0533d2
SSDEEP

24576:XkLTkXBwWja4SlukeeKL0xJaqT//aqT8E94Tf3C:Ux6

Score

10^/10

hawkeye collection keylogger persistence spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Executes dropped EXE 1 IoCs

Processes:

Windows Update.exe

pid process

900 Windows Update.exe
Deletes itself 1 IoCs

Processes:

Windows Update.exe

pid process

900 Windows Update.exe
Loads dropped DLL 1 IoCs

Processes:

5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exe

pid process

2028 5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
2028	5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Windows Update.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	Windows Update.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 whatismyipaddress.com
6 whatismyipaddress.com
7 whatismyipaddress.com

flow	ioc
4	whatismyipaddress.com
6	whatismyipaddress.com
7	whatismyipaddress.com

Suspicious use of SetThreadContext 2 IoCs

Processes:

Windows Update.exe

description	pid	process	target process
PID 900 set thread context of 1800	900	Windows Update.exe	vbc.exe
PID 900 set thread context of 1544	900	Windows Update.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Windows Update.exe

pid	process
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe
900	Windows Update.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

Windows Update.exevbc.exevbc.exe

description pid process

Token: SeDebugPrivilege 900 Windows Update.exe
Token: SeDebugPrivilege 1800 vbc.exe
Token: SeDebugPrivilege 1544 vbc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Windows Update.exe

pid process

900 Windows Update.exe

description	pid	process
Token: SeDebugPrivilege	900	Windows Update.exe
Token: SeDebugPrivilege	1800	vbc.exe
Token: SeDebugPrivilege	1544	vbc.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exeWindows Update.exe

description	pid	process	target process
PID 2028 wrote to memory of 900	2028	5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exe	Windows Update.exe
PID 2028 wrote to memory of 900	2028	5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exe	Windows Update.exe
PID 2028 wrote to memory of 900	2028	5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exe	Windows Update.exe
PID 2028 wrote to memory of 900	2028	5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exe	Windows Update.exe
PID 2028 wrote to memory of 900	2028	5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exe	Windows Update.exe
PID 2028 wrote to memory of 900	2028	5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exe	Windows Update.exe
PID 2028 wrote to memory of 900	2028	5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exe	Windows Update.exe
PID 900 wrote to memory of 1800	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1800	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1800	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1800	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1800	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1800	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1800	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1800	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1800	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1800	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1544	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1544	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1544	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1544	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1544	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1544	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1544	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1544	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1544	900	Windows Update.exe	vbc.exe
PID 900 wrote to memory of 1544	900	Windows Update.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exe
"C:\Users\Admin\AppData\Local\Temp\5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028

C:\Users\Admin\AppData\Roaming\Windows Update.exe
"C:\Users\Admin\AppData\Roaming\Windows Update.exe"
2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:900

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
3⤵
- Accesses Microsoft Outlook accounts
- Suspicious use of AdjustPrivilegeToken
PID:1800

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt
Filesize
102B

MD5
34bf7449a5b88fb4e0b4c2180c628d03

SHA1
0ae9e2c2f5ee1cfed9f4958892744dcc8f135b35

SHA256
3b2a87ad6b4ac35181764f8282329eb4c672d7701ee5b1a8e16af43d50802f53

SHA512
855c2790d3f766977846bc040aa9bc7be4fcff1b32fda189889a59056019793d3be7fa96d3dd1d7383abe684477e6a6acc0440ef1409a3318990724b7593b303

Download Submit
C:\Users\Admin\AppData\Local\Temp\holdermail.txt
Filesize
327B

MD5
1265c5140a2f68b05b92aa1a25a2abb6

SHA1
627a660e9d2a41c8c4a662ca44fdb68a1356bc82

SHA256
694bae0c1ebf6f8eeb8d902b1bfad57ed9a42dea6d3e327a0137a1c9f4f0c6b9

SHA512
ad6a1dd57ec84459f28926d07e25f2c4f49dc67ff95b8400e85c3bcb8eccc471dbac5e2b1a2758fb563866ecacc2fae4657dfb85197fb4cd2547eef334b8a216

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe
Filesize
1.1MB

MD5
36d0c2908620bdfe773f4fc6e419aae8

SHA1
1a41c284bfc185f3bc49c57370d6712276de7559

SHA256
5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194

SHA512
ae75ec1f231780007f4596aadaf0e54193bdc4ed222d4dabaed0c8b595aebe4d4273cf93ae30d7af95cd2fa3f9e17ec155bc2e8a38844ab07ff428a75c0533d2

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe
Filesize
1.1MB

MD5
36d0c2908620bdfe773f4fc6e419aae8

SHA1
1a41c284bfc185f3bc49c57370d6712276de7559

SHA256
5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194

SHA512
ae75ec1f231780007f4596aadaf0e54193bdc4ed222d4dabaed0c8b595aebe4d4273cf93ae30d7af95cd2fa3f9e17ec155bc2e8a38844ab07ff428a75c0533d2

Download Submit
\Users\Admin\AppData\Roaming\Windows Update.exe
Filesize
1.1MB

MD5
36d0c2908620bdfe773f4fc6e419aae8

SHA1
1a41c284bfc185f3bc49c57370d6712276de7559

SHA256
5c0982788147e5baaf956a522facb8c0b88c4608d5e199526f4125c43924d194

SHA512
ae75ec1f231780007f4596aadaf0e54193bdc4ed222d4dabaed0c8b595aebe4d4273cf93ae30d7af95cd2fa3f9e17ec155bc2e8a38844ab07ff428a75c0533d2

Download Submit
memory/900-77-0x0000000000E45000-0x0000000000E56000-memory.dmp

Filesize
68KB

Download
memory/900-96-0x0000000000E45000-0x0000000000E56000-memory.dmp

Filesize
68KB

Download
memory/900-57-0x0000000000000000-mapping.dmp

Download
memory/900-62-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/900-64-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/1544-87-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1544-89-0x0000000000460E2D-mapping.dmp

Download
memory/1544-93-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1544-92-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1544-88-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1544-85-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1544-83-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1544-81-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1544-80-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/1800-72-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1800-78-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1800-65-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1800-73-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1800-74-0x0000000000462B6D-mapping.dmp

Download
memory/1800-79-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1800-66-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1800-70-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1800-68-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/1800-95-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2028-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download
memory/2028-61-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download
memory/2028-55-0x0000000074130000-0x00000000746DB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads