hawkeye | cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a

General

Target

cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a.exe
Size

205KB
MD5

7b0685897c65b060494c91b0b701fa71
SHA1

4f597320790d71cf000e4b03dcae8a11b6946410
SHA256

cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a
SHA512

17e1e8821eec0c8aeb70551d833c0afc9805543997f98cd4430a254e2d51ca9b710a252fabc2d35beb4c338972955d4393e011f56dcf661f4526cce2796df197
SSDEEP

6144:WSIWTqzmgoJlS5Oz4BS9sqLFuV8hHaB+:Wi4mgoJlS5OsGQ8

Score

10^/10

hawkeye keylogger spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
smtp.gmail.com
Port:
587
Username:
bozoveleye@gmail.com
Password:
iyikalpli_3303

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Executes dropped EXE 1 IoCs

Processes:

Windows Update.exe

pid process

848 Windows Update.exe
Deletes itself 1 IoCs

Processes:

Windows Update.exe

pid process

848 Windows Update.exe

pid	process
848	Windows Update.exe

pid	process
848	Windows Update.exe

Drops startup file 2 IoCs

Processes:

Windows Update.exe

description	ioc	process
File created	C:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	Windows Update.exe
File opened for modification	C:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe	Windows Update.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Windows Update.exe

pid process

848 Windows Update.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Windows Update.exe

description pid process

Token: SeDebugPrivilege 848 Windows Update.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Windows Update.exe

pid process

848 Windows Update.exe

pid	process
848	Windows Update.exe

description	pid	process
Token: SeDebugPrivilege	848	Windows Update.exe

pid	process
848	Windows Update.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a.exe

description	pid	process	target process
PID 1096 wrote to memory of 848	1096	cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a.exe	Windows Update.exe
PID 1096 wrote to memory of 848	1096	cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a.exe	Windows Update.exe
PID 1096 wrote to memory of 848	1096	cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a.exe	Windows Update.exe

C:\Users\Admin\AppData\Local\Temp\cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a.exe
"C:\Users\Admin\AppData\Local\Temp\cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\AppData\Roaming\Windows Update.exe
"C:\Users\Admin\AppData\Roaming\Windows Update.exe"
2⤵
- Executes dropped EXE
- Deletes itself
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:848

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

3

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt
Filesize
102B

MD5
e6767e3c7681fdcca1e5600415fecf77

SHA1
14d9453abb2c7626099489adae2dc01cd1008a20

SHA256
d391b2c64d86d0c4614bc0459a651bed7b1b3f1eebfeff6335a1e8a98958ed13

SHA512
096056807259133f451a83f4e7a6944e4f5d27fe1a0d783791a2b36c9dd13ade5d93b9d2be9bdef4d9fbffdf9bff17c438b0aa807daa3b8a35212f35ab61a3e3

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe
Filesize
205KB

MD5
7b0685897c65b060494c91b0b701fa71

SHA1
4f597320790d71cf000e4b03dcae8a11b6946410

SHA256
cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a

SHA512
17e1e8821eec0c8aeb70551d833c0afc9805543997f98cd4430a254e2d51ca9b710a252fabc2d35beb4c338972955d4393e011f56dcf661f4526cce2796df197

Download Submit
C:\Users\Admin\AppData\Roaming\Windows Update.exe
Filesize
205KB

MD5
7b0685897c65b060494c91b0b701fa71

SHA1
4f597320790d71cf000e4b03dcae8a11b6946410

SHA256
cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a

SHA512
17e1e8821eec0c8aeb70551d833c0afc9805543997f98cd4430a254e2d51ca9b710a252fabc2d35beb4c338972955d4393e011f56dcf661f4526cce2796df197

Download Submit
memory/848-57-0x0000000000000000-mapping.dmp

Download
memory/848-60-0x000007FEF41E0000-0x000007FEF4C03000-memory.dmp

Filesize
10.1MB

Download
memory/848-61-0x000007FEF2F00000-0x000007FEF3F96000-memory.dmp

Filesize
16.6MB

Download
memory/848-63-0x0000000001E66000-0x0000000001E85000-memory.dmp

Filesize
124KB

Download
memory/848-64-0x000000001FE00000-0x00000000200FF000-memory.dmp

Filesize
3.0MB

Download
memory/848-65-0x0000000001E66000-0x0000000001E85000-memory.dmp

Filesize
124KB

Download
memory/1096-54-0x000007FEF41E0000-0x000007FEF4C03000-memory.dmp

Filesize
10.1MB

Download
memory/1096-55-0x000007FEF2F00000-0x000007FEF3F96000-memory.dmp

Filesize
16.6MB

Download
memory/1096-56-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing