hawkeye | 4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634

General

Target

4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe
Size

2.0MB
MD5

6f8572e5cca28c7103d72cea751d10bf
SHA1

eeaab748db9bdca67ae4d279012c3f003cc8a3bb
SHA256

4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634
SHA512

bfa5d01aaacba0f20b19c54705cef543fdbceb588fc86a4a1ad5ba7be71dc1a043ab6e6cb4b7faea25c3aa3e6499717e5f306d2ac0a7240d65a8e149cdb77abe
SSDEEP

49152:sMMMMMMMMMMMMMMMMMMMMMMMM9MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMs:sMMMMMMMMMMMMMMMMMMMMMMMM9MMMMMs

Score

10^/10

hawkeye evasion keylogger persistence spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Executes dropped EXE 1 IoCs

Processes:

bnfgsvjruhna.exe

pid process

904 bnfgsvjruhna.exe

pid	process
904	bnfgsvjruhna.exe

Loads dropped DLL 4 IoCs

Processes:

4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe

pid	process
1256	4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe
1256	4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe
1256	4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe
1256	4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

bnfgsvjruhna.exeRegSvcs.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	bnfgsvjruhna.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\C:\Users\Admin\53392G~1 = "C:\\Users\\Admin\\53392G~1\\fhutj.vbs"	bnfgsvjruhna.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	RegSvcs.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

bnfgsvjruhna.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bnfgsvjruhna.exe
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 whatismyipaddress.com
6 whatismyipaddress.com
7 whatismyipaddress.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

bnfgsvjruhna.exe

description pid process target process

PID 904 set thread context of 864 904 bnfgsvjruhna.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

bnfgsvjruhna.exe

pid process

904 bnfgsvjruhna.exe
904 bnfgsvjruhna.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bnfgsvjruhna.exe

description pid process

Token: SeDebugPrivilege 904 bnfgsvjruhna.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bnfgsvjruhna.exe

flow	ioc
4	whatismyipaddress.com
6	whatismyipaddress.com
7	whatismyipaddress.com

description	pid	process	target process
PID 904 set thread context of 864	904	bnfgsvjruhna.exe	RegSvcs.exe

pid	process
904	bnfgsvjruhna.exe
904	bnfgsvjruhna.exe

description	pid	process
Token: SeDebugPrivilege	904	bnfgsvjruhna.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exebnfgsvjruhna.exe

description	pid	process	target process
PID 1256 wrote to memory of 904	1256	4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe	bnfgsvjruhna.exe
PID 1256 wrote to memory of 904	1256	4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe	bnfgsvjruhna.exe
PID 1256 wrote to memory of 904	1256	4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe	bnfgsvjruhna.exe
PID 1256 wrote to memory of 904	1256	4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe	bnfgsvjruhna.exe
PID 1256 wrote to memory of 904	1256	4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe	bnfgsvjruhna.exe
PID 1256 wrote to memory of 904	1256	4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe	bnfgsvjruhna.exe
PID 1256 wrote to memory of 904	1256	4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe	bnfgsvjruhna.exe
PID 904 wrote to memory of 864	904	bnfgsvjruhna.exe	RegSvcs.exe
PID 904 wrote to memory of 864	904	bnfgsvjruhna.exe	RegSvcs.exe
PID 904 wrote to memory of 864	904	bnfgsvjruhna.exe	RegSvcs.exe
PID 904 wrote to memory of 864	904	bnfgsvjruhna.exe	RegSvcs.exe
PID 904 wrote to memory of 864	904	bnfgsvjruhna.exe	RegSvcs.exe
PID 904 wrote to memory of 864	904	bnfgsvjruhna.exe	RegSvcs.exe
PID 904 wrote to memory of 864	904	bnfgsvjruhna.exe	RegSvcs.exe
PID 904 wrote to memory of 864	904	bnfgsvjruhna.exe	RegSvcs.exe
PID 904 wrote to memory of 864	904	bnfgsvjruhna.exe	RegSvcs.exe
PID 904 wrote to memory of 864	904	bnfgsvjruhna.exe	RegSvcs.exe
PID 904 wrote to memory of 864	904	bnfgsvjruhna.exe	RegSvcs.exe
PID 904 wrote to memory of 864	904	bnfgsvjruhna.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe
"C:\Users\Admin\AppData\Local\Temp\4a7dc47d4721fc508ff02f7301dc91f0f9847297785702253059d20c92a47634.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1256

C:\Users\Admin\53392gx2394\bnfgsvjruhna.exe
"C:\Users\Admin\53392gx2394\bnfgsvjruhna.exe" aojtuujbjkr
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
3⤵
- Adds Run key to start application
PID:864

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\53392G~1\TSBICC~1.HVO
Filesize
1.1MB

MD5
6f6dad92921dd28a40db79aad669f5ae

SHA1
8b77aa41642166e736a17d70621211b13596804d

SHA256
527b739c95b7640171e8585cf64372febbc60e9477977582dc63661f939dba80

SHA512
9dd8e9dd0d076094b7b4897c6fa1ebf0bef378187d07e0bd03a955d92e4bfde9bc7d5f73a236c006e2aa4a5674f779530bd0627f161aad63fbdd15d5866fd139

Download Submit
C:\Users\Admin\53392G~1\iwth.VFA
Filesize
60B

MD5
5eaf31efa4f8055a1f92f3105e83243e

SHA1
766d696f41d041a552909f79c1f6b357d9c84e15

SHA256
a4f07855007136f9c981e86afd5413b4a3cb267c84939dd074cf43289bc79eda

SHA512
0fa9517172e88a0df97765165ff298d885a2d26af977ca9cc48a53327f71ea40d7548b689b81d9c18e845fe5b9507b7ec060d2eaf3688fa422bcaa0fd72e11be

Download Submit
C:\Users\Admin\53392gx2394\aojtuujbjkr
Filesize
219.0MB

MD5
82882c281b903e065e155c9b179d214c

SHA1
d8a452c48c995907ab0c1742cf166a06de31c6a6

SHA256
e33067c503f6f1d6c683774cd5957854c418156cb6014167111a62cd8f703480

SHA512
03d12b48b0a15f195df94d294c2b1fcb9d0001b764c1025b6e7433528ca31b447ccbd51a82fe12461c1213e33cfaf3e9ddfd6e140a0b56e3dc1dab1210b505e9

Download Submit
C:\Users\Admin\53392gx2394\bnfgsvjruhna.exe
Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
\Users\Admin\53392gx2394\bnfgsvjruhna.exe
Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
\Users\Admin\53392gx2394\bnfgsvjruhna.exe
Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
\Users\Admin\53392gx2394\bnfgsvjruhna.exe
Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
\Users\Admin\53392gx2394\bnfgsvjruhna.exe
Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
memory/864-72-0x000000000051BAFE-mapping.dmp

Download
memory/864-65-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/864-66-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/864-68-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/864-70-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/864-71-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/864-74-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/864-76-0x0000000000400000-0x0000000000522000-memory.dmp

Filesize
1.1MB

Download
memory/864-78-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/864-79-0x0000000074290000-0x000000007483B000-memory.dmp

Filesize
5.7MB

Download
memory/864-80-0x0000000000725000-0x0000000000736000-memory.dmp

Filesize
68KB

Download
memory/904-59-0x0000000000000000-mapping.dmp

Download
memory/1256-54-0x0000000075D11000-0x0000000075D13000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads