hawkeye | 569dc2277adbe54eec16c9b9c6ee38ae4eba2e7c3498d84a37a9348452671f39 | Triage

Sharing

General

Target

4824d3523a79856521a0869e314fd1a1_JaffaCakes118
Size

143KB
Sample

241015-q1kfya1gqp
MD5

4824d3523a79856521a0869e314fd1a1
SHA1

21beef5a16a2eb5927b1d660ee4b68ec2b6da723
SHA256

569dc2277adbe54eec16c9b9c6ee38ae4eba2e7c3498d84a37a9348452671f39
SHA512

3823fa60cd2e28f9e2b243f86cb4c82299d433114afbc34d43e42b69df0e01d3d47958e09a3ddda9d13a5852ce7e3e121cd483078d5030a7621c7690813b5bc1
SSDEEP

3072:8r1NSHFJXY04RUiVXJyKdpG7kgnIZJwuq/8LLHTo4WIGoqWd:85NSHFJIHyKdpGognI4uSu7ToEHqu

Score

10^/10

hawkeye discovery keylogger persistence spyware stealer trojan

Malware Config

Targets

- Target
  
  postalesmp4.exe
- Size
  
  182KB
- MD5
  
  0091d020743c4cbea4251fda7a9e1c2a
- SHA1
  
  46b23cede43d4de1a4ea8b544821ca84d64266c8
- SHA256
  
  d6a07c7c72f838bf598f6f80ed24bd9a84035abc58dc92dea2844786dcaea3c1
- SHA512
  
  4a827fdca6e855aca9b380146284d4f74f073c0882fcf0dd36f9b23fd900490bf5da5c5d8d1c8c8c7f0ceac972d125ca1c419d9b075f37de296faf2f5773ac2c
- SSDEEP
  
  3072:LcPGMaCGKc2iX7RlK7p0UG5nt526s9xB4Ln9fSKDcSCQ51Y4Uo7j9zc8ql+A1:wP1aXbX7Rip0ZCrB4Ln9GQDYxot4l
Score

10^/10

hawkeye discovery keylogger persistence spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyediscoverykeyloggerpersistencespywarestealertrojan

behavioral2

hawkeyediscoverykeyloggerpersistencespywarestealertrojan