hawkeye | 3a93198066469651b43a90914453005741f0cc54d5f59e826442567a000e37e8 | Triage

Sharing

General

Target

3a93198066469651b43a90914453005741f0cc54d5f59e826442567a000e37e8
Size

487KB
Sample

250329-zwx1xawkx7
MD5

d51fcee93f06d8ecc4c4b253ab1471cc
SHA1

23d7ea092f012a99e439effd3b144f22d4c4db48
SHA256

3a93198066469651b43a90914453005741f0cc54d5f59e826442567a000e37e8
SHA512

86fb8307d3be762c7ebaf18013c9823051b72b27e84c11161234ce27f59ea44c22d07b15b0ffe7627a72aa569a3f16b12d29ab561c2c8c72e4d57c8d0794153a
SSDEEP

6144:PIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6m1:P200OFp+G0imvHn3Cp6qyBP+YdsvZGG

Score

10^/10

hawkeye remcos remotehost defense_evasion discovery keylogger spyware stealer trojan

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

213.142.159.30:2404

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
remcos.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
false
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-DQG4O5
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Targets

- Target
  
  3a93198066469651b43a90914453005741f0cc54d5f59e826442567a000e37e8
- Size
  
  487KB
- MD5
  
  d51fcee93f06d8ecc4c4b253ab1471cc
- SHA1
  
  23d7ea092f012a99e439effd3b144f22d4c4db48
- SHA256
  
  3a93198066469651b43a90914453005741f0cc54d5f59e826442567a000e37e8
- SHA512
  
  86fb8307d3be762c7ebaf18013c9823051b72b27e84c11161234ce27f59ea44c22d07b15b0ffe7627a72aa569a3f16b12d29ab561c2c8c72e4d57c8d0794153a
- SSDEEP
  
  6144:PIlSCa0RPvRz+n8Qr1D0ZGESuHabmvHOE4mCp6qtydBnP+Y4+3sAORZGFX3Xc6m1:P200OFp+G0imvHn3Cp6qyBP+YdsvZGG
Score

10^/10

defense_evasion discovery trojan hawkeye keylogger spyware stealer
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- Hawkeye family
  hawkeye
- UAC bypass
  defense_evasion trojan
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

remotehostremcos

behavioral1

defense_evasiondiscoverytrojan

behavioral2

hawkeyedefense_evasiondiscoverykeyloggerspywarestealertrojan