hawkeye | 71dbb1177cb271ab30531fda54cad0f1ea8be87182f96bf21f37dcf65758f6ce

General

Target

POSAIFOODPVTLTD.exe
Size

1.0MB
MD5

dea59d578e0e64728780fb67dde7d96d
SHA1

b23c86a74f5514ebcfb8e3f102a4b16f60ff4076
SHA256

71dbb1177cb271ab30531fda54cad0f1ea8be87182f96bf21f37dcf65758f6ce
SHA512

64663c97bcea47b6c265df2598e12b1dfeb437efc6e78a6a23cf0a02cfeaf28b054cc5af85b2d1aff3822c5d5b82905952db2722e095e138a0bf0203977d4bce
SSDEEP

24576:xsep9+wg44M5eh0GGxlA2F4O41ub2z6X46qU8A/yHD5A1:eo9+wg44M5eoA2FGO2m4XU8A/yj5A1

Score

10^/10

hawkeye collection credential_access discovery execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.comedyskits.com.ng
Port:
21
Username:
[email protected]
Password:
TGXs]#J&_ReU

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 11 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral1/memory/2940-30-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2940-28-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2940-27-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2940-24-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2940-23-0x0000000000400000-0x0000000000488000-memory.dmp	Nirsoft
behavioral1/memory/2792-38-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2792-37-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2792-40-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral1/memory/2192-41-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/2192-42-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral1/memory/2192-49-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

NirSoft MailPassView 8 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral1/memory/2940-30-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2940-28-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2940-27-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2940-24-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2940-23-0x0000000000400000-0x0000000000488000-memory.dmp	MailPassView
behavioral1/memory/2792-38-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/2792-37-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral1/memory/2792-40-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 8 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral1/memory/2940-30-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2940-28-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2940-27-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2940-24-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2940-23-0x0000000000400000-0x0000000000488000-memory.dmp	WebBrowserPassView
behavioral1/memory/2192-41-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/2192-42-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral1/memory/2192-49-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2276 powershell.exe
2724 powershell.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
2276	powershell.exe
2724	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

POSAIFOODPVTLTD.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	POSAIFOODPVTLTD.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 whatismyipaddress.com
6 whatismyipaddress.com

flow	ioc
4	whatismyipaddress.com
6	whatismyipaddress.com

Suspicious use of SetThreadContext 3 IoCs

Processes:

POSAIFOODPVTLTD.exePOSAIFOODPVTLTD.exe

description	pid	process	target process
PID 2064 set thread context of 2940	2064	POSAIFOODPVTLTD.exe	POSAIFOODPVTLTD.exe
PID 2940 set thread context of 2792	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 set thread context of 2192	2940	POSAIFOODPVTLTD.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

schtasks.exePOSAIFOODPVTLTD.exevbc.exevbc.exePOSAIFOODPVTLTD.exepowershell.exepowershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POSAIFOODPVTLTD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POSAIFOODPVTLTD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

2824 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exevbc.exePOSAIFOODPVTLTD.exe

pid process

2276 powershell.exe
2724 powershell.exe
2192 vbc.exe
2940 POSAIFOODPVTLTD.exe

pid	process
2824	schtasks.exe

pid	process
2276	powershell.exe
2724	powershell.exe
2192	vbc.exe
2940	POSAIFOODPVTLTD.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exePOSAIFOODPVTLTD.exe

description	pid	process
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	2724	powershell.exe
Token: SeDebugPrivilege	2940	POSAIFOODPVTLTD.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

POSAIFOODPVTLTD.exe

pid process

2940 POSAIFOODPVTLTD.exe

pid	process
2940	POSAIFOODPVTLTD.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

POSAIFOODPVTLTD.exePOSAIFOODPVTLTD.exe

description	pid	process	target process
PID 2064 wrote to memory of 2276	2064	POSAIFOODPVTLTD.exe	powershell.exe
PID 2064 wrote to memory of 2276	2064	POSAIFOODPVTLTD.exe	powershell.exe
PID 2064 wrote to memory of 2276	2064	POSAIFOODPVTLTD.exe	powershell.exe
PID 2064 wrote to memory of 2276	2064	POSAIFOODPVTLTD.exe	powershell.exe
PID 2064 wrote to memory of 2724	2064	POSAIFOODPVTLTD.exe	powershell.exe
PID 2064 wrote to memory of 2724	2064	POSAIFOODPVTLTD.exe	powershell.exe
PID 2064 wrote to memory of 2724	2064	POSAIFOODPVTLTD.exe	powershell.exe
PID 2064 wrote to memory of 2724	2064	POSAIFOODPVTLTD.exe	powershell.exe
PID 2064 wrote to memory of 2824	2064	POSAIFOODPVTLTD.exe	schtasks.exe
PID 2064 wrote to memory of 2824	2064	POSAIFOODPVTLTD.exe	schtasks.exe
PID 2064 wrote to memory of 2824	2064	POSAIFOODPVTLTD.exe	schtasks.exe
PID 2064 wrote to memory of 2824	2064	POSAIFOODPVTLTD.exe	schtasks.exe
PID 2064 wrote to memory of 2940	2064	POSAIFOODPVTLTD.exe	POSAIFOODPVTLTD.exe
PID 2064 wrote to memory of 2940	2064	POSAIFOODPVTLTD.exe	POSAIFOODPVTLTD.exe
PID 2064 wrote to memory of 2940	2064	POSAIFOODPVTLTD.exe	POSAIFOODPVTLTD.exe
PID 2064 wrote to memory of 2940	2064	POSAIFOODPVTLTD.exe	POSAIFOODPVTLTD.exe
PID 2064 wrote to memory of 2940	2064	POSAIFOODPVTLTD.exe	POSAIFOODPVTLTD.exe
PID 2064 wrote to memory of 2940	2064	POSAIFOODPVTLTD.exe	POSAIFOODPVTLTD.exe
PID 2064 wrote to memory of 2940	2064	POSAIFOODPVTLTD.exe	POSAIFOODPVTLTD.exe
PID 2064 wrote to memory of 2940	2064	POSAIFOODPVTLTD.exe	POSAIFOODPVTLTD.exe
PID 2064 wrote to memory of 2940	2064	POSAIFOODPVTLTD.exe	POSAIFOODPVTLTD.exe
PID 2940 wrote to memory of 2792	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2792	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2792	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2792	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2792	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2792	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2792	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2792	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2792	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2792	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2192	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2192	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2192	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2192	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2192	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2192	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2192	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2192	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2192	2940	POSAIFOODPVTLTD.exe	vbc.exe
PID 2940 wrote to memory of 2192	2940	POSAIFOODPVTLTD.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\POSAIFOODPVTLTD.exe
"C:\Users\Admin\AppData\Local\Temp\POSAIFOODPVTLTD.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\POSAIFOODPVTLTD.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cIQcmsFxE.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2724
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cIQcmsFxE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4B81.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2824
- C:\Users\Admin\AppData\Local\Temp\POSAIFOODPVTLTD.exe
  "C:\Users\Admin\AppData\Local\Temp\POSAIFOODPVTLTD.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
    3⤵
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:2792
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

Scripting

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

Scripting

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4B81.tmp

Filesize
1KB

MD5
e081b6707e5d740b2e7726d5d3d53bab

SHA1
44bfd8d4bbd7415716964d9106fb4636251c3ac5

SHA256
61107aa18a9ec9df4008b49bfb8ca615affb21ddd52c00afb7b8d7e6d47bc6b2

SHA512
e9b799ae61f4c68a0125c5c7697aecf40af2db55e9b5535eb6085be9950bee3faf35d7fa47294e6a8cae294db476224a63e4e91074ecbdb52db6d09fdd6da148

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3YK8U70WH1HCHPMA1LYK.temp

Filesize
7KB

MD5
cc5700ac0ecce33f81422ca29380dba8

SHA1
421e6ed57dde23814dbfe94d9eecad67a85a197c

SHA256
62d52ca73baa507e7b64f25872abb2ebc3f8d0385d43a94e8f59f157d44dc94c

SHA512
02941ff3c198f702d9369c23dc3a9cf8f0766de895f450ca84740b561c315fd75cb9b8ca20b75134df100dcdbafd2cce1baf840c6d367fd0970e4b04c7ba5f29

Download Submit
C:\Users\Admin\AppData\Roaming\WindowsUpdate.exe

Filesize
1.0MB

MD5
dea59d578e0e64728780fb67dde7d96d

SHA1
b23c86a74f5514ebcfb8e3f102a4b16f60ff4076

SHA256
71dbb1177cb271ab30531fda54cad0f1ea8be87182f96bf21f37dcf65758f6ce

SHA512
64663c97bcea47b6c265df2598e12b1dfeb437efc6e78a6a23cf0a02cfeaf28b054cc5af85b2d1aff3822c5d5b82905952db2722e095e138a0bf0203977d4bce

Download Submit
memory/2064-3-0x00000000003E0000-0x00000000003FE000-memory.dmp

Filesize
120KB

Download
memory/2064-5-0x0000000005C60000-0x0000000005D2A000-memory.dmp

Filesize
808KB

Download
memory/2064-4-0x0000000000450000-0x0000000000466000-memory.dmp

Filesize
88KB

Download
memory/2064-2-0x0000000073B30000-0x000000007421E000-memory.dmp

Filesize
6.9MB

Download
memory/2064-1-0x0000000001070000-0x000000000117C000-memory.dmp

Filesize
1.0MB

Download
memory/2064-31-0x0000000073B30000-0x000000007421E000-memory.dmp

Filesize
6.9MB

Download
memory/2064-0-0x0000000073B3E000-0x0000000073B3F000-memory.dmp

Filesize
4KB

Download
memory/2192-48-0x0000000000460000-0x00000000004C7000-memory.dmp

Filesize
412KB

Download
memory/2192-49-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2192-42-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2192-41-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2792-38-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2792-37-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2792-40-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2940-20-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2940-23-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2940-24-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2940-36-0x0000000000600000-0x0000000000608000-memory.dmp

Filesize
32KB

Download
memory/2940-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2940-18-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2940-27-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2940-28-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/2940-30-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads