hawkeye | 462ee3cd85dede72db4ba090bdbfdf16aade2778cfb23843d70c552bccd5fc57

General

Target

954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exe
Size

648KB
MD5

548a180766b53ea59fd0bdc2ac0793b0
SHA1

3ff13cb1ab16a65d25061d68a0f2cf801cfb2972
SHA256

462ee3cd85dede72db4ba090bdbfdf16aade2778cfb23843d70c552bccd5fc57
SHA512

667dba2f3911a2214db08114f0b0c58925c267d5ed4cc40c3361cf529d3563c1f4e29f0ea6ceee62ea319a0ac370a55a714c582fe22673ff36c28a69175812f2
SSDEEP

12288:PA2pA0GA0d0d2h3ZBiU5WrLrSwl816oSI:ZYdEGiU5KL+uoSI

Score

10^/10

hawkeye collection discovery keylogger persistence spyware stealer trojan

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
173.237.185.61
Port:
587
Username:
[email protected]
Password:
7213575aceACE@.

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Detected Nirsoft tools 7 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

Processes:

resource	yara_rule
behavioral2/memory/5008-22-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral2/memory/3584-36-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/3584-38-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/3584-41-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/4848-46-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/4848-47-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/4848-54-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
behavioral2/memory/5008-22-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral2/memory/3584-36-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/3584-38-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/3584-41-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
behavioral2/memory/5008-22-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral2/memory/4848-46-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/4848-47-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/4848-54-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exe

Executes dropped EXE 5 IoCs

Processes:

chromes.exechromes.exechromes.exechromes.exechromes.exe

pid process

2184 chromes.exe
5008 chromes.exe
2148 chromes.exe
2848 chromes.exe
2988 chromes.exe
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

pid	process
2184	chromes.exe
5008	chromes.exe
2148	chromes.exe
2848	chromes.exe
2988	chromes.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

chromes.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	chromes.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 whatismyipaddress.com
20 whatismyipaddress.com

flow	ioc
18	whatismyipaddress.com
20	whatismyipaddress.com

Suspicious use of SetThreadContext 4 IoCs

Processes:

chromes.exechromes.exechromes.exe

description	pid	process	target process
PID 2184 set thread context of 5008	2184	chromes.exe	chromes.exe
PID 5008 set thread context of 3584	5008	chromes.exe	vbc.exe
PID 5008 set thread context of 4848	5008	chromes.exe	vbc.exe
PID 2148 set thread context of 2848	2148	chromes.exe	chromes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

vbc.exeschtasks.exechromes.exechromes.exe954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exechromes.exechromes.exevbc.exechromes.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chromes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chromes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chromes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chromes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chromes.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

4928 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

vbc.exe

pid process

4848 vbc.exe
4848 vbc.exe

pid	process
4928	schtasks.exe

pid	process
4848	vbc.exe
4848	vbc.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exechromes.exechromes.exechromes.exechromes.exe

description	pid	process
Token: SeDebugPrivilege	1080	954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exe
Token: SeDebugPrivilege	2184	chromes.exe
Token: SeDebugPrivilege	5008	chromes.exe
Token: SeDebugPrivilege	2148	chromes.exe
Token: SeDebugPrivilege	2988	chromes.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

chromes.exe

pid process

5008 chromes.exe

pid	process
5008	chromes.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exechromes.exechromes.exechromes.exechromes.exe

description	pid	process	target process
PID 1080 wrote to memory of 2184	1080	954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exe	chromes.exe
PID 1080 wrote to memory of 2184	1080	954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exe	chromes.exe
PID 1080 wrote to memory of 2184	1080	954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exe	chromes.exe
PID 2184 wrote to memory of 5008	2184	chromes.exe	chromes.exe
PID 2184 wrote to memory of 5008	2184	chromes.exe	chromes.exe
PID 2184 wrote to memory of 5008	2184	chromes.exe	chromes.exe
PID 2184 wrote to memory of 5008	2184	chromes.exe	chromes.exe
PID 2184 wrote to memory of 5008	2184	chromes.exe	chromes.exe
PID 2184 wrote to memory of 5008	2184	chromes.exe	chromes.exe
PID 2184 wrote to memory of 5008	2184	chromes.exe	chromes.exe
PID 2184 wrote to memory of 5008	2184	chromes.exe	chromes.exe
PID 5008 wrote to memory of 3584	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 3584	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 3584	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 3584	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 3584	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 3584	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 3584	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 3584	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 3584	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 4848	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 4848	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 4848	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 4848	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 4848	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 4848	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 4848	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 4848	5008	chromes.exe	vbc.exe
PID 5008 wrote to memory of 4848	5008	chromes.exe	vbc.exe
PID 1080 wrote to memory of 4928	1080	954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exe	schtasks.exe
PID 1080 wrote to memory of 4928	1080	954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exe	schtasks.exe
PID 1080 wrote to memory of 4928	1080	954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exe	schtasks.exe
PID 2148 wrote to memory of 2848	2148	chromes.exe	chromes.exe
PID 2148 wrote to memory of 2848	2148	chromes.exe	chromes.exe
PID 2148 wrote to memory of 2848	2148	chromes.exe	chromes.exe
PID 2148 wrote to memory of 2848	2148	chromes.exe	chromes.exe
PID 2148 wrote to memory of 2848	2148	chromes.exe	chromes.exe
PID 2148 wrote to memory of 2848	2148	chromes.exe	chromes.exe
PID 2148 wrote to memory of 2848	2148	chromes.exe	chromes.exe
PID 2148 wrote to memory of 2848	2148	chromes.exe	chromes.exe
PID 2988 wrote to memory of 2608	2988	chromes.exe	chromes.exe
PID 2988 wrote to memory of 2608	2988	chromes.exe	chromes.exe
PID 2988 wrote to memory of 2608	2988	chromes.exe	chromes.exe

C:\Users\Admin\AppData\Local\Temp\954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exe
"C:\Users\Admin\AppData\Local\Temp\954979___773b92be-2504-4962-92bc-ebe1003ee0c8.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\Music\chromes.exe
  "C:\Users\Admin\Music\chromes.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Users\Admin\Music\chromes.exe
    "C:\Users\Admin\Music\chromes.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5008
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
      4⤵
      Accesses Microsoft Outlook accounts
      System Location Discovery: System Language Discovery
      PID:3584
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4848
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /SC MINUTE /TN Application /TR C:\Users\Admin\Music\chromes.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4928

C:\Users\Admin\Music\chromes.exe
C:\Users\Admin\Music\chromes.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\Music\chromes.exe
  "C:\Users\Admin\Music\chromes.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2848

C:\Users\Admin\Music\chromes.exe
C:\Users\Admin\Music\chromes.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\Music\chromes.exe
  "C:\Users\Admin\Music\chromes.exe"
  2⤵
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\chromes.exe.log

Filesize
610B

MD5
ee86f41d4725117e5c13e8ed1f7cffc7

SHA1
761b06d82c25ba36b4f3794bcda266d6f2d62a70

SHA256
09fcf2369d5cfbf4b7f5bb24326fe5fd9838c3465a4019af5c6de114579800d7

SHA512
c8d75e6de53c0fad92b558c999b679d631f6a199118d044831ea4b45f8665a593b904ab934ff649e319947aa5383ebf023186eabfd736643c8f46597c24e96b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Filesize
3KB

MD5
f94dc819ca773f1e3cb27abbc9e7fa27

SHA1
9a7700efadc5ea09ab288544ef1e3cd876255086

SHA256
a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

SHA512
72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

Download Submit
C:\Users\Admin\Music\chromes.exe

Filesize
648KB

MD5
548a180766b53ea59fd0bdc2ac0793b0

SHA1
3ff13cb1ab16a65d25061d68a0f2cf801cfb2972

SHA256
462ee3cd85dede72db4ba090bdbfdf16aade2778cfb23843d70c552bccd5fc57

SHA512
667dba2f3911a2214db08114f0b0c58925c267d5ed4cc40c3361cf529d3563c1f4e29f0ea6ceee62ea319a0ac370a55a714c582fe22673ff36c28a69175812f2

Download Submit
memory/1080-20-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/1080-1-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/1080-2-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/1080-3-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/1080-56-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/1080-0-0x0000000074692000-0x0000000074693000-memory.dmp

Filesize
4KB

Download
memory/1080-19-0x0000000074692000-0x0000000074693000-memory.dmp

Filesize
4KB

Download
memory/2184-30-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/2184-21-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/2184-15-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/2184-18-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/2184-16-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/2184-28-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/2184-17-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/3584-36-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3584-38-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3584-41-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4848-53-0x0000000000460000-0x0000000000529000-memory.dmp

Filesize
804KB

Download
memory/4848-54-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4848-46-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/4848-47-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5008-29-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/5008-44-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/5008-45-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/5008-43-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/5008-42-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/5008-31-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/5008-27-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/5008-26-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/5008-22-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/5008-60-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download
memory/5008-61-0x0000000074690000-0x0000000074C41000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads