MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8afec5cbc0fba5b1373182c97292c0dd2ae0d7644aa20ffe5ea31999fda5688. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


HawkEye


Vendor detections: 8


Intelligence 8 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8afec5cbc0fba5b1373182c97292c0dd2ae0d7644aa20ffe5ea31999fda5688
SHA3-384 hash: 60bd5431507e80d2c94ffd78d9e15492203678de9ebee5f8f86787e82029ff532a2bb381d5c259bd0614e3ddffa26f13
SHA1 hash: 6a23f52c268aeeab2514e001c9d82a3fc0187394
MD5 hash: d7a2f3671fdbfa12f9b91667646ab92c
humanhash: william-snake-early-eighteen
File name:Shipping Documents_pdf.exe
Download: download sample
Signature HawkEye
Create hunting rule
File size:1'025'024 bytes
First seen:2020-10-29 06:04:15 UTC
Last seen:2020-10-29 13:37:08 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c301f8f7be1bb1fcc854a8241f1007d0 (11 x NanoCore, 2 x Loki, 1 x HawkEye)
ssdeep 12288:2xUZMROg9MX2SKezgunq8yw4n7mioXqDwwSQ/SoPrY9hdw07IaJxI7JafmHa:DZP6M5nq8sLlDwi3zE0MxI7Jafm6
TLSH 1F25AF22F2A148F7C16319F89C3B57AC682AFE1C2924F5462BF71C485F79753342929B
Reporter cocaman
Tags:exe HawkEye

Intelligence

File Origin
# of uploads :
5
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
HawkEye
Create hunting rule
Link:
https://www.capesandbox.com/analysis/80807/
Detection(s):
Win.Malware.Generic-9784689-0
Create hunting rule

Win.Trojan.Netwire-9784905-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Launching a process
Unauthorized injection to a recently created process
Creating a file in the %AppData% directory
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Setting a keyboard event handler
Enabling the 'hidden' option for recently created files
Reading critical registry keys
Creating a file in the %temp% directory
Deleting a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun by creating a file
Enabling a "Do not show hidden files" option
Enabling threat expansion on mass storage devices by creating the autorun.inf autorun file
Result
Threat name:
HawkEye MailPassView
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/515763
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Changes the view of files in windows explorer (hidden files and folders)
Contains functionality to detect sleep reduction / modifications
Contains functionality to log keystrokes (.Net Source)
Delayed program exit found
Detected HawkEye Rat
Detected unpacking (changes PE section rights)
Detected unpacking (creates a PE file in dynamic memory)
Detected unpacking (overwrites its own PE header)
Drops VBS files to the startup folder
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: Drops script at startup location
Writes to foreign memory regions
Yara detected HawkEye Keylogger
Yara detected MailPassView
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 306989 Sample: Shipping Documents_pdf.exe Startdate: 29/10/2020 Architecture: WINDOWS Score: 100 100 Found malware configuration 2->100 102 Malicious sample detected (through community Yara rule) 2->102 104 Multi AV Scanner detection for submitted file 2->104 106 14 other signatures 2->106 10 Shipping Documents_pdf.exe 3 2->10         started        13 WindowsUpdate.exe 2->13         started        15 wscript.exe 1 2->15         started        17 WindowsUpdate.exe 2->17         started        process3 signatures4 138 Writes to foreign memory regions 10->138 140 Allocates memory in foreign processes 10->140 142 Maps a DLL or memory area into another process 10->142 144 Queues an APC in another process (thread injection) 10->144 19 Shipping Documents_pdf.exe 3 10->19         started        21 Shipping Documents_pdf.exe 16 8 10->21         started        26 notepad.exe 1 10->26         started        146 Multi AV Scanner detection for dropped file 13->146 148 Detected unpacking (changes PE section rights) 13->148 150 Detected unpacking (creates a PE file in dynamic memory) 13->150 152 Detected unpacking (overwrites its own PE header) 13->152 28 WindowsUpdate.exe 13->28         started        30 notepad.exe 13->30         started        32 WindowsUpdate.exe 13->32         started        34 Shipping Documents_pdf.exe 3 15->34         started        154 Sample uses process hollowing technique 17->154 36 notepad.exe 17->36         started        process5 dnsIp6 38 Shipping Documents_pdf.exe 19->38         started        90 whatismyipaddress.com 104.16.154.36, 443, 49732, 49733 CLOUDFLARENETUS United States 21->90 92 192.168.2.1 unknown unknown 21->92 94 236.76.10.0.in-addr.arpa 21->94 84 C:\Users\user\AppData\...\WindowsUpdate.exe, PE32 21->84 dropped 120 Changes the view of files in windows explorer (hidden files and folders) 21->120 41 dw20.exe 22 6 21->41         started        122 Drops VBS files to the startup folder 26->122 124 Delayed program exit found 26->124 96 104.16.155.36, 49754, 80 CLOUDFLARENETUS United States 28->96 98 236.76.10.0.in-addr.arpa 28->98 126 Sample uses process hollowing technique 28->126 128 Installs a global keyboard hook 28->128 130 Injects a PE file into a foreign processes 28->130 43 dw20.exe 28->43         started        45 vbc.exe 28->45         started        47 vbc.exe 28->47         started        132 Writes to foreign memory regions 34->132 134 Allocates memory in foreign processes 34->134 136 Maps a DLL or memory area into another process 34->136 49 Shipping Documents_pdf.exe 34->49         started        51 Shipping Documents_pdf.exe 34->51         started        54 notepad.exe 34->54         started        86 C:\Users\user\AppData\Roaming\...\chrome.vbs, ASCII 36->86 dropped file7 signatures8 process9 dnsIp10 114 Writes to foreign memory regions 38->114 116 Allocates memory in foreign processes 38->116 118 Maps a DLL or memory area into another process 38->118 56 Shipping Documents_pdf.exe 38->56         started        58 Shipping Documents_pdf.exe 38->58         started        60 notepad.exe 38->60         started        62 Shipping Documents_pdf.exe 49->62         started        88 127.0.0.1 unknown unknown 51->88 65 dw20.exe 51->65         started        signatures11 process12 signatures13 67 Shipping Documents_pdf.exe 56->67         started        70 dw20.exe 58->70         started        156 Writes to foreign memory regions 62->156 158 Allocates memory in foreign processes 62->158 160 Maps a DLL or memory area into another process 62->160 72 notepad.exe 62->72         started        74 Shipping Documents_pdf.exe 62->74         started        76 Shipping Documents_pdf.exe 62->76         started        process14 signatures15 108 Writes to foreign memory regions 67->108 110 Allocates memory in foreign processes 67->110 112 Maps a DLL or memory area into another process 67->112 78 notepad.exe 67->78         started        80 Shipping Documents_pdf.exe 67->80         started        82 Shipping Documents_pdf.exe 67->82         started        process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8afec5cbc0fba5b1373182c97292c0dd2ae0d7644aa20ffe5ea31999fda5688/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-29 01:29:43 UTC
File Type:
PE (Exe)
Extracted files:
39
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xcx6yxf4b65fwe3tdawjokjmbxjk4dlwisvcb77f5iyzth62k2ea._file
Result
Malware family:
hawkeye
Create hunting rule
Score:
  10/10
Tags:
family:hawkeye keylogger persistence spyware stealer trojan upx
Link:
https://tria.ge/reports/201029-ebpc576z92/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Drops startup file
Reads user/profile data of web browsers
Uses the VBS compiler for execution
UPX packed file
HawkEye
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b8afec5cbc0fba5b1373182c97292c0dd2ae0d7644aa20ffe5ea31999fda5688

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Email_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Email in files like avemaria
Rule name:Hawkeye
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect HawkEye in memory
Reference:internal research
Rule name:Keylog_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Contains Keylog
Rule name:RAT_HawkEye
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>
Description:Detects HawkEye RAT
Reference:http://malwareconfig.com/stats/HawkEye
Rule name:Stealer_word_in_memory
Create hunting rule
Author:James_inthe_box
Description:The actual word stealer in memory
Rule name:win_hawkeye_keylogger_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_hawkeye_keylogger_g0
Create hunting rule
Author:Various authors / Slavo Greminger, SWITCH-CERT
Rule name:win_hawkeye_keylogger_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>
Rule name:with_sqlite
Create hunting rule
Author:Julian J. Gonzalez <info@seguridadparatodos.es>
Description:Rule to detect the presence of SQLite data in raw image
Reference:http://www.st2labs.com

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

HawkEye

rar af96923c962b57407f8c8f5fcdf2e6acad4d8752ab4761978eef1ed653a42e80

HawkEye

Executable exe b8afec5cbc0fba5b1373182c97292c0dd2ae0d7644aa20ffe5ea31999fda5688

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 af96923c962b57407f8c8f5fcdf2e6acad4d8752ab4761978eef1ed653a42e80
Cape
Cape
https://www.capesandbox.com/analysis/80807/
  
Dropped by
SHA256 fc71ed4b3eb248aeb03987130062ea359ac09c79b8991353c36d9a12f303919d
  
Dropped by
SHA256 2c475c9ba03edba1b0c414398299c4d8f4ca8105d40c389f23869dbe068dd258

Comments