hawkeye | 32aea6eca5e5f8c20757b894a1c53d0c08b194a1c75824ef3e12c8621476d4ff

Analysis

max time kernel
40s
max time network
22s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 19:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XDLSQA.bat
Size 1KB
Sample261011-xrmy2av1fs
SHA256 32aea6eca5e5f8c20757b894a1c53d0c08b194a1c75824ef3e12c8621476d4ff
MD5 33387a549dcee155226cc752651407d9
SHA1 8f4a2d15b71bb5720453c5699c45d9b42a86a967
SHA512 dfad37d3449b981c07aac98d570522aa25d15344f67807c3f420e288fb1de4dace55af40ca5fc34b95299145f1397ab6bb2e68620b958c952363e7cc5b32c41f
TLSH
T1DF31752B7611502E2C4BC8FBCDDCA2009E5A41CBC666DF9611BC81A87E0646647F90C7
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution hawkeye keylogger spyware stealer trojan

Malware Config

Signatures

Family: HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
436	cmd.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1556	systeminfo.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 1556	436	cmd.exe	90
PID 436 wrote to memory of 5424	436	cmd.exe	93
PID 436 wrote to memory of 4884	436	cmd.exe	94
PID 436 wrote to memory of 4808	436	cmd.exe	95
PID 436 wrote to memory of 3108	436	cmd.exe	96
PID 436 wrote to memory of 4784	436	cmd.exe	97
PID 436 wrote to memory of 2764	436	cmd.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\XDLSQA.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:1556
- C:\Windows\system32\findstr.exe
  findstr /i "VMware" "C:\Users\Admin\AppData\Local\Temp\sysinfo.txt"
  2⤵
  PID:5424
- C:\Windows\system32\findstr.exe
  findstr /i "VirtualBox" "C:\Users\Admin\AppData\Local\Temp\sysinfo.txt"
  2⤵
  PID:4884
- C:\Windows\system32\findstr.exe
  findstr /i "KVM" "C:\Users\Admin\AppData\Local\Temp\sysinfo.txt"
  2⤵
  PID:4808
- C:\Windows\system32\findstr.exe
  findstr /i "QEMU" "C:\Users\Admin\AppData\Local\Temp\sysinfo.txt"
  2⤵
  PID:3108
- C:\Windows\system32\findstr.exe
  findstr /i "Hyper-V" "C:\Users\Admin\AppData\Local\Temp\sysinfo.txt"
  2⤵
  PID:4784
- C:\Windows\system32\findstr.exe
  findstr /i "Xen" "C:\Users\Admin\AppData\Local\Temp\sysinfo.txt"
  2⤵
  PID:2764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sysinfo.txt

Path C:\Users\Admin\AppData\Local\Temp\sysinfo.txt
Size 2KB
SHA256 014990bd73639f46f6aab3bad68e058580a57002da17095d552c579681633ab2
MD5 70ca06d7a0b8b6087414217c1e0d8cbe
SHA1 172616a9dd0b360e8e0eb5567ec525982bb42e92
SHA512 8fc947fa93540dcccad0c53aca609d2e8503cdcf8fe55eeef1ee7140b1ad171ce6fed5421f54fdd02ce4018dfb68e8b8c0527277dbe6b8a4c7da43abc52f9653
TLSH
T11F51A6F88254B0603E9EC6652353DB02F4B595C7A6B5823930DC82845FFA398E3E5A2D
MD5 SHA1 SHA512 TLSH

Submit Download