HawkEye Malware: Technical Analysis – Cybersecurity Insiders

   Kasım 29, 2024  Posted in CyberSecurity-Insiders


HawkEye, also known as PredatorPain (Predator Pain), is a malware categorized as a keylogger, but over the years, it has adopted new functionalities that align it with the capabilities of other tools like stealers.

History of HawkEye

HawkEye emerged before 2010, with records of its use and sale dating back to 2008, making it quite long-lived. After several spearphishing campaigns in which this well-known malware was attached, it gained significant popularity starting in 2013.

This keylogger has been available on various dark web sites, even having dedicated websites where the tool was sold. However, this keylogger has been cracked for years and used by different actors without going through the subscription method imposed by its creators, whose price ranged between $20 and $50. This has contributed to its continued notoriety, and it has been used not only by criminal actors but also by script kiddies due to its ease of use.

Although it is not one of the most widely used malwares, it remains in active use and saw a significant resurgence during the COVID period. During this time, certain actors took advantage of the general hysteria to obtain company data through phishing campaigns.

Additionally, HawkEye has been used in conjunction with other loaders and/or malware that invoked this keylogger. Over its long trajectory, various actors and malware have been involved in attacks on companies, some of which include Galleon Gold, Mikroceen, iSPY crypter related with Gold Skyline, Remcos used on campaigns with HawkEye, Pony used on campaigns with HawkEye, etc.

Analysis in the ANY.RUN Sandbox

To conduct a quick analysis of HawkEye to extract critical data fast, we can use ANY.RUN’s Interactive Sandbox. The service lets us easily upload and detonate a sample in a safe virtual environment and engage with it and the system just like on a standard computer.

Analysis of a HawkEye sample in the ANY.RUN sandbox

Consider this analysis session, After executing the malware, the sandbox instantly identifies it as HawkEye and starts tracking its system and network activities. It also lists all the malicious actions performed by the threat and automatically maps them to MITRE ATT&CK TTPs.

HawkEye config extracted by the ANY.RUN Sandbox

It also generates a comprehensive report, lists indicators of compromise (IOCs), and extracts the sample’s config information.

To start using ANY.RUN, request a 14-day free trial and access all features. You can also take advantage of a Black Friday offer to buy a license and receive another for free.

Technical Analysis

HawkEye’s delivery methods are quite diverse compared to other malware. However, its execution and behavior have remained relatively consistent over the years. A behavior graph of what has been observed in recent months would look as follows:

Overview GraphOverview Graph

HawkEye graph

During the analysis process, I typically spend weeks, even months, collecting samples to understand how they function as a whole based on the existing variants. Therefore, we may observe variations among those presented. In most executions, we encounter enormous trees of processes based on their activities. To simplify, as you’ve seen in the previous graph, it’s not as complex compared to other stealers or RATs. It generally consists of an executable that drops others in temporary paths, then injects code into one of them or into a .NET-related software. Later, in memory, it gathers all possible data and sends it to a C&C.

ProcDOT detonation chart

Going straight to the point, in an initial execution of one of the samples I analyzed, we see a rather extensive process—a succession of execution copies launched in temporary paths.

囗 e | 。 「 e 「 e 15 , 32g K IS 旧 32K 24s2 囗 e | 。 e 26 , 456K 2 072K 2724 lgfpeßaxa 12 , S K 15 , 168K 2536 NVIDIA user apenence Dri 囗 se 「 「 exe 13 , 744 K 15 , 480 K 1700 asqlse 「 捣「 axe 26 , 46g K 29.004 K 2336 囗 e | 。 「 e 「 e 15 , 32g K IS 旧 32K 24s2 囗 e | 。 e 26 , 456K 2 072K 2724 lgfpeßaxa 12 , S K 15 , 168K 2536 NVIDIA user apenence Dri 囗 se 「 「 exe 13 , 744 K 15 , 480 K 1700 asqlse 「 捣「 axe 26 , 46g K 29.004 K 2336

Process Tree execution (Image 1)

gfpeß axe sq I server exe qlsenjerexe Command Ljna: 14.976 K 28.472 K 16.920K 23.184K Vpp Data LocaI Temp Syst em sqlservar axe Data M_ocal Tamp Systam sqlservar exe gfpeß axe sq I server exe qlsenjerexe Command Ljna: 14.976 K 28.472 K 16.920K 23.184K Vpp Data LocaI Temp Syst em sqlservar axe Data M_ocal Tamp Systam sqlservar exe

Process Tree execution (Image 2)

In this instance, they used the RoamingTemplates path, but this is highly variable depending on who created it. Generally speaking, they tend to abuse paths like AppDataRoaming and AppDataTemp, which are classic choices.

2X2 」 2 」 04 鬲 2 dwel 裟 op 長 、 ン ′ 工 0 巴 」 O 透 言 L 当 E20 ′ 2 ロ 2X2 」 2 」 0 鬲 2 五 Lue ト 鬲 ′ ′ 工 0 巴 」 型 言 u - E20 ′ 2 ロ dd ′ 2X2 」 2 」 0 - 叫 ′ 五 Lue ト 鬲 裟 ヴ ェ 0 巴 」 型 言 u 一 E20 ′ 2 ロ は d ′ 2X2 」 2 」 0 ( 叫 ′ 五 Lue ト 鬲 裟 ヴ ェ 0 巴 」 型 言 u 一 E20 ′ 2 ロ は d ′ 巴 2 的 コ ′ い 2 2 鬻 80 」 d 09 巴 2 的 コ ′ い 巴 2 的 コ ′ い 巴 2 的 コ ′ い 2 曰 - pe 当 66 2 曰 - pe 当 09 2 曰 - pe 当 09 2X2 」 2 」 0 - 2 ロ 2X2 」 2 」 0 - 2 ロ 2X2 」 2 」 。 - 2 ロ ェ ロ ェ ロ ェ ロ 2X2 」 2 」 04 鬲 2 dwel 裟 op 長 、 ン ′ 工 0 巴 」 O 透 言 L 当 E20 ′ 2 ロ 2X2 」 2 」 0 鬲 2 五 Lue ト 鬲 ′ ′ 工 0 巴 」 型 言 u - E20 ′ 2 ロ dd ′ 2X2 」 2 」 0 - 叫 ′ 五 Lue ト 鬲 裟 ヴ ェ 0 巴 」 型 言 u 一 E20 ′ 2 ロ は d ′ 2X2 」 2 」 0 ( 叫 ′ 五 Lue ト 鬲 裟 ヴ ェ 0 巴 」 型 言 u 一 E20 ′ 2 ロ は d ′ 巴 2 的 コ ′ い 2 2 鬻 80 」 d 09 巴 2 的 コ ′ い 巴 2 的 コ ′ い 巴 2 的 コ ′ い 2 曰 - pe 当 66 2 曰 - pe 当 09 2 曰 - pe 当 09 2X2 」 2 」 0 - 2 ロ 2X2 」 2 」 0 - 2 ロ 2X2 」 2 」 。 - 2 ロ ェ ロ ェ ロ ェ ロ

Paths commonly abused (Image 1)

Зехр]огег ехе igfpewexe igfpewexe 2492 2536 2536 С [ JseB 03t в Тетр Syst ет vigfpeB ехе Ster1 Theed Зехр]огег ехе igfpewexe igfpewexe 2492 2536 2536 С [ JseB 03t в Тетр Syst ет vigfpeB ехе Ster1 Theed

 Paths commonly abused (Image 2)

C exe magen exe magart exe 1412 Z Process Creata 748 Process Start 748 Thread Create C exe magen exe magart exe 1412 Z Process Creata 748 Process Start 748 Thread Create

Paths commonly abused (Image 3)

Here’s the list of paths observed for dropping files:

  • C:UsersAppDataLocalTemp
  • C:UsersAppDataRoaming
  • C:UsersAppDataRoamingMicrosoftWindowsTemplates
  • C:UsersAppDataLocalTempSystem
  • C:UsersMusic

 

All of these files that are launched, and which we’ve observed executing in the previous step, are copies of themselves. The filenames are also highly variable, as you might expect, but they often try to have an icon that makes the victim think it’s a legitimate program, or the malware description might be altered to make it seem like legitimate software. 

Ultimately, after comparing the dropped files, we can see they are simple copies of the original, with the particularity that some versions launch them in hidden mode, so you can’t see them unless you’ve enabled the “View hidden files” function in Windows.

Hidden files duplication graph

During these file droppings, we can encounter both replicas of the original file in different paths, as well as support files whose functionality is typically to establish persistence (or check if it’s already done, and if not, do it) and to perform injector functions, which is a characteristic of this malware. In this case, the smaller binary is responsible for these actions. 

Computer Local Disk (C:) Users AppData Local Temp System Include in library Name Share with New folder Date modified igfpers.exe sqlserver.exe Type Application Application Size 36 KB 151 KB Computer Local Disk (C:) Users AppData Local Temp System Include in library Name Share with New folder Date modified igfpers.exe sqlserver.exe Type Application Application Size 36 KB 151 KB

Injector written in temporary folder

I check to see if there is any shared information between the two binaries and notice that certain parts of the code match the original. This will become relevant later, as right now we’re seeing them separately, but everything will make sense afterward.

Comparison of the injector and the Hawkeye bin

After this step, we can see how persistence is established. PredatorPain isn’t just a malware that establishes persistence once—it’s been observed to check and establish persistence up to three different times, depending on the phases (Loader > Injector > Payload). 

This makes it clear that the malware is determined to persist on the system, one way or another. At this stage, to avoid revealing persistence mechanisms through strings, it obfuscates a string and then decodes it to introduce, in this case, one of the binaries launched earlier. This practice isn’t as common and adds a level of sophistication not found in other samples.

public string e(string —int e. Length; e 255; num2 = Persistence hkey e) array chart) array = e.ToCharArray(); while (--num e) (char) ( array [num) return string. Intern (new string(array)); registryKey Identity Name SubKeyCcunt ValueCcunt checkMode keyName rerncteKey _identity Static members e . a Cnum2) e)); 11) [21 [3] [5] [71 [8] OxEA8F true); Type REG_SZ array [1] [2] [3] [4] [5] [7] [8] pubLIC static void ResistryKey registryKey if (resistryKey null) return; resistryKey . Close ( ) ; Resi stry. CurrentUser. char[Ox00000009] ox0073 's' ox006C 'l' 0*0073 Software CurrentVersion Run} Btringto—l] -NVIDIA User Experience Driver Component- {H KEV_C URREN T_tJSERlSoftwa tv ersion IRun ) rrentVersionRu npublic string e(string —int e. Length; e 255; num2 = Persistence hkey e) array chart) array = e.ToCharArray(); while (--num e) (char) ( array [num) return string. Intern (new string(array)); registryKey Identity Name SubKeyCcunt ValueCcunt checkMode keyName rerncteKey _identity Static members e . a Cnum2) e)); 11) [21 [3] [5] [71 [8] OxEA8F true); Type REG_SZ array [1] [2] [3] [4] [5] [7] [8] pubLIC static void ResistryKey registryKey if (resistryKey null) return; resistryKey . Close ( ) ; Resi stry. CurrentUser. char[Ox00000009] ox0073 's' ox006C 'l' 0*0073 Software CurrentVersion Run} Btringto—l] -NVIDIA User Experience Driver Component- {H KEV_C URREN T_tJSERlSoftwa tv ersion IRun ) rrentVersionRu n

Hawkeye persistence in registers

Not only does it create persistence in the registry, but we also find samples that establish persistence in tasks using commands like the following:

schtasks.exe /Create /TN “” /XML “”

After observing its behavior in the early stages, we delve deeper into the entire execution thread throughout the analysis phase with debugging. I’ve followed several samples, and they’re mostly similar—samples in .NET, sometimes obfuscated with tools like Confuser, Eaz, Reactor, or similar, which are relatively easy to deobfuscate.

public string u2FW, int num = u2Føø.Length; int num2 = u2Føø & 255; int u2Føø) chart) array = while (--num e) array C num) (char) —return // Token: axa4øøøøaA RID: la public static readonly Xu2Fß3. Xu2Føa Xu2Føø; // Token: axuøøøøaa RID: 11 private byte[] Xu2FßI; ((int)this. u2FøICnum2) u2Føø)); public string u2FW, int num = u2Føø.Length; int num2 = u2Føø & 255; int u2Føø) chart) array = while (--num e) array C num) (char) —return // Token: axa4øøøøaA RID: la public static readonly Xu2Fß3. Xu2Føa Xu2Føø; // Token: axuøøøøaa RID: 11 private byte[] Xu2FßI; ((int)this. u2FøICnum2) u2Føø));

Hawkeye code obfuscated

In most samples, I noticed heavy interaction with resources, which will become crucial shortly since I observed a significant amount of data in these resources across most of the samples I found.

FindResource SizeofResource LoadResource IfirtualAllocEx FindResource SizeofResource LoadResource IfirtualAllocEx

 Resources data content (Image 1)

ss 2€ ]соп ]соп Grou2 0000EFBz 0000EF>z<br /> 0000EFzz<br /> 0000EFEZ<br /> 0000Fooz<br /> 0000F02z<br /> 0000F04z<br /> 0000F0Ez<br /> 0000Fnz<br /> 0000Fozz<br /> 0000F0Ez<br /> 0000F10z<br /> 0000F12z<br /> 0000F14z<br /> од 24<br /> 21<br /> 42<br /> 91<br /> Ез<br /> 23<br /> 92<br /> 64<br /> 67<br /> 24<br /> 43<br /> 22<br /> 92<br /> 64<br /> 67<br /> 25<br /> 53<br /> Ез<br /> 22<br /> зв<br /> 70<br /> 67<br /> Ез<br /> вв<br /> 70<br /> 52<br /> Ез<br /> 32<br /> вв<br /> 70<br /> Ез<br /> sc<br /> 32<br /> вв<br /> 70<br /> 2€<br /> 67<br /> 72<br /> во<br /> вв<br /> 70<br /> 29<br /> ss<br /> 67<br /> 35<br /> 33<br /> вв<br /> 41<br /> во<br /> дз<br /> 67<br /> 36<br /> 34<br /> 42<br /> 51<br /> 47<br /> 67<br /> €2<br /> 34<br /> 42<br /> 52<br /> 70<br /> 24<br /> 29<br /> зс<br /> 25<br /> 2€<br /> yR@rZ<br /> ) з глллллллллллт<br /> 34<br /> 94<br /> 24<br /> вв<br /> 23<br /> 27<br /> вв<br /> 47<br /> 29<br /> вв<br /> 21<br /> 52<br /> 33<br /> вв<br /> 44<br /> 21<br /> вз<br /> вв<br /> 53<br /> 20<br /> вв<br /> 07<br /> 41<br /> 23<br /> 40<br /> вв<br /> 24<br /> дз<br /> вв<br /> 25<br /> 04<br /> вв<br /> св<br /> 43<br /> 72<br /> вв<br /> ЕЕ<br /> вв<br /> 42<br /> 29<br /> вв<br /> 28<br /> 76<br /> ЕВ<br /> сз<br /> Ез<br /> BVZSERIYUJGF+_)<br /> • ссссдддд±еее<br /> 3444тттт<br /> cddppppp<br /> ееееееееееее<br /> fggg<br /> XXXXL ” width=”624″ height=”119″ class=”lazyload”/><img loading=Resources data content (Image 2)

In the malware’s initial phases, it looks for the running process (which will be the previously prepared copy), where it will check the PID to access the resources. Within these resources, we see two distinct types of code: the initial part, which acts as a key, and the data chunk, which is what will be deobfuscated. To achieve this, it uses XOR + Poly, and at the end of the process, it extracts a Portable Executable.

Load from rsrc - OUL; 1 _ fal - Classl _fa2 - 1 _fa3 - Classl _fa: - 1 _fa5 - 1 _ fas - _ G7 if Limit - int nw; stuk&rk, -1 Ill fir: QRexorVcz Load from rsrc - OUL; 1 _ fal - Classl _fa2 - 1 _fa3 - Classl _fa: - 1 _fa5 - 1 _ fas - _ G7 if Limit - int nw; stuk&rk, -1 Ill fir: QRexorVcz

Graph of binary load from resources

It can do this in various ways depending on the sample, but we see the same extraction of a binary from a resource as we do from obfuscated code in memory, like the example shown below.

O O O O O O O O O O m O O O O O O O O O O O O O O O O O O m O O O O O O O O O O O O O O O O O O O O O O O m O O O O O O O O O O O O O O m 0 0 m m 수』 최• m O O O 최• O O 수』 O O O O O O O O 최• 수』 O O O O O O O O m O O O 0 O 최• O O O O O m O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O 최• O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O 최• O 0 O O O O O O O O m O 0 O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O 0 O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O m O O O O O O O O O O 1, O O O O 최• O O O O O O O O O O O 최• O O O O O O O O O O O O O O 수』 O O O O O O O O O O O O O O O O O O O O O O 최• O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O 0 O O O O O O O O O O O O O O O O O O O O O O 0 O O O 0 O O O O O O O O O O O O O O O O O O O O O O O O 최• O O O O 규호三巨巨표즈흐E巨巨g巨亶亘: 騎프 형 영 O O O O O O O O 최• O O O O O O O O O O 0 m = 0 그 O O O O O O O O O O m O O O O O O O O O O O O O O O O O O m O O O O O O O O O O O O O O O O O O O O O O O m O O O O O O O O O O O O O O m 0 0 m m 수』 최• m O O O 최• O O 수』 O O O O O O O O 최• 수』 O O O O O O O O m O O O 0 O 최• O O O O O m O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O 최• O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O 최• O 0 O O O O O O O O m O 0 O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O 0 O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O m O O O O O O O O O O 1, O O O O 최• O O O O O O O O O O O 최• O O O O O O O O O O O O O O 수』 O O O O O O O O O O O O O O O O O O O O O O 최• O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O 0 O O O O O O O O O O O O O O O O O O O O O O 0 O O O 0 O O O O O O O O O O O O O O O O O O O O O O O O 최• O O O O 규호三巨巨표즈흐E巨巨g巨亶亘: 騎프 형 영 O O O O O O O O 최• O O O O O O O O O O 0 m = 0 그

Graph of PE extraction from memory

The result of this phase is two extracted files—one will be the injector, and the other will be the Keylogger.

File extract Entry Point : File Offset : Linker Info : tile Siié: 0000F5EE 0000D9EE 8.00 0001220% 00 EP Section : First Bytes : Subsystem : FF 2500 20 40 Windovvs GUI 00004209 32 bit- Library RES/OVL : O / 22 % MS Visual ce / aasic.NET VB 2005 -DLL -EPToken : 00000000 , overli Lamer Info - Help Hint nu•pack info aig sec. 01 , [I*EXE PE found], Warning : NETRES 36.22KE,tr File extract Entry Point : File Offset : Linker Info : tile Siié: 0000F5EE 0000D9EE 8.00 0001220% 00 EP Section : First Bytes : Subsystem : FF 2500 20 40 Windovvs GUI 00004209 32 bit- Library RES/OVL : O / 22 % MS Visual ce / aasic.NET VB 2005 -DLL -EPToken : 00000000 , overli Lamer Info - Help Hint nu•pack info aig sec. 01 , [I*EXE PE found], Warning : NETRES 36.22KE,tr

Extracted Injector 

extract2 Properties Туре of Те 0esc6ption Sze оп disk [евк Fomms 800ter С [ JseB 04 КВ Desktop extract2 Properties Туре of Те 0esc6ption Sze оп disk [евк Fomms 800ter С [ JseB 04 КВ Desktop

Extracted Keylogger

 

I compared both files, and they’re entirely different, in size, in structure—the only common factor is that both are .NET binaries.

Binary comparison 

To highlight the difference between the injector dropped on disk (Right) and the one extracted from memory (Left), we can compare the extended content. We can observe how the memory-extracted injector includes imports related to injection that the disk version doesn’t (such as ZwUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, etc.).

Extracted and dropped injector comparison 

indicators (imports > flag)<br /> virustctal (error)<br /> dos header (64 bytes)<br /> dos stub (64 bytes)<br /> rich-header (n/a)<br /> file-header (Intel-386)<br /> optional-header (GUI)<br /> directories (6)<br /> sections (3)<br /> libraries (mscoree.dll)<br /> innpcru (flag)<br /> NE-callback (n/a)<br /> .NET (stream)<br /> resources (2)<br /> strings (596)<br /> debug (Feb.2012)<br /> manifest (n/a)<br /> version (nvxdsync.exe)<br /> certificate (n/a)<br /> Overlay (n/a)<br /> imports (163)<br /> Memo Stream<br /> AesMana ed<br /> CryptoConfig<br /> CryptoStream<br /> CryptoStreamMode<br /> DESCwptoServiceProvider<br /> HashAI arithm<br /> ICwptoTransform<br /> RSACwptoServiceProvider<br /> RSAParameters<br /> SHAI CryptoServiceProvider<br /> SHAI Mana ed<br /> SHA256Mana ed<br /> SymmetricAIgorithm<br /> ResourceMana er<br /> Re ist K<br /> Process<br /> Assembly8uiIder<br /> Assembly8uiIderAccess<br /> ILGenerator<br /> Label<br /> Loca18uiIder<br /> Method8uiIder<br /> Module8uiIder<br /> O Code<br /> O Codes<br /> namespace (21)<br /> System .10<br /> System. Security. Cryptograp…<br /> System. Security. Cryptograp…<br /> System. Security. Cryptograp…<br /> System.Security.Cryptcgrap…<br /> System. Security. Cryptograp…<br /> System. Security. Cryptograp…<br /> System. Security. Cryptograp…<br /> System.Security.Cryptcgrap…<br /> System. Security. Cryptograp…<br /> System. Security. Cryptograp…<br /> System. Security. Cryptograp…<br /> System.Security.Cryptcgrap…<br /> System. Security. Cryptograp…<br /> System. Security. Cryptograp…<br /> System. Resources<br /> Microsoft.Win32<br /> Microsoft.Win32<br /> System.Diagncstics<br /> System. Reflection. Emit<br /> System. Reflection. Emit<br /> System. Reflection. Emit<br /> System. Reflection. Emit<br /> System. Reflection. Emit<br /> System. Reflection. Emit<br /> System. Reflection. Emit<br /> System. Reflection. Emit<br /> System. Reflection. Emit<br /> flag (15)<br /> group (5)<br /> memory<br /> cryptography<br /> cryptography<br /> cryptography<br /> cryptography<br /> cryptography<br /> cryptography<br /> cryptography<br /> cryptography<br /> cryptography<br /> cryptography<br /> cryptography<br /> cryptography<br /> cryptography<br /> cryptography<br /> resource<br /> registry<br /> registry<br /> execution<br /> execution<br /> execution<br /> execution<br /> execution<br /> execution<br /> execution<br /> execution<br /> execution<br /> execution<br /> desktopextract<br /> indicators (file > embedded)<br /> virustctal (error)<br /> dos header (64 bytes)<br /> dos stub (64 bytes)<br /> rich-header (n/a)<br /> file-header (Intel-386)<br /> optional-header (GUI)<br /> directories (5)<br /> sections (file)<br /> libraries (p/invoke)<br /> innpcru (flag)<br /> expc.u a)<br /> „—O NE-callback (n/a)<br /> .NET 02050727)<br /> resources L)<br /> strings (1382)<br /> debug (Feb.2012)<br /> manifest (n/a)<br /> version (n/a)<br /> certificate (n/a)<br /> overlay (signature > unknown)<br /> imports (269)<br /> GetThreadContext<br /> WriteProcessMemo<br /> ReadProcessMemo<br /> VirtualProtectEx<br /> ZwUnma ViewOfSection<br /> SetFiIeAttributesA<br /> Createprocess<br /> SetThreadContext<br /> Processld<br /> FindResource<br /> SizeofResource<br /> LoadResource<br /> VirtualAIIocEx<br /> FileO en<br /> GetTem Path<br /> WriteAIIText<br /> WriteA118ytes<br /> CreateDirecto<br /> ResumeThread<br /> GetCurre” width=”624″ height=”187″ class=”lazyload”/><img loading=Extracted and dropped injector comparison

Here we can observe various functionalities while extracting the binaries, such as self-deletion. This is done to maintain evasion and avoid revealing its location, as it drops replicas of the original binary in various locations, as we saw earlier.

if (File. Exists(text)) Fi Ie . Copy (Proces s . . Mai nModuIe . Fi IeName , text) ; if (File. Exists(text)) Fi Ie . Copy (Proces s . . Mai nModuIe . Fi IeName , text) ;

 Self-deletion and self-copy of the original binary (Image 1)

Local Disk (C:) Users AppData Roaming library Name Share with New folder Date modified explorer.exe Microsoft Type Application Windows Templates Size 151 KB Local Disk (C:) Users AppData Roaming library Name Share with New folder Date modified explorer.exe Microsoft Type Application Windows Templates Size 151 KB

Self-deletion and self-copy of the original binary (Image 2)

if true . Tostring(), false) Classl.Ccpiaza() if true . Tostring(), false) Classl.Ccpiaza()

 Self-deletion and self-copy of the original binary (Image 3)

array expression (string[OxOOOOOOOA] array expression (string[OxOOOOOOOA]

Self-deletion and self-copy of the original binary (Image 4)

One of the dropped files, the smaller one, acts as the injector. When extracted from memory, it has more functionalities than the one seen on disk. This is because the injection tasks are carried out during runtime, but the written file is actually a portion of this, triggering the main binary located in the temporary path. 

It checks persistence and restarts the entire process, including injection. Therefore, it’s a part of the file without revealing all of its functionalities. I’ll show you how it performs injection using Process Hollowing.

Process Injection target, secur ity_F Iags, secur Lty _F lags2, inher it, f Iags , system, , ci text 2, , startup_lnformation, procesă Information) ret u rn; rpf.H.r•II Headers nt_Headers default(rpf.H.NI Headers)• intPtr = new IntPtr-(n• + dos_Header.Address); obiect obj2 = Marshal. PtrToStr-ucture(intPtr, nt_Headers .6etType()); rpf .H.NT Header-s nt_Headers2; nt_Headers ((0bj2 nul l) ? ((rpf.H.nr _ Headerc)obj2) : nt_Headers2); startup_lnfcrmation . CB = Strings. context. F Iags 65538u; if Signature 17744UL dos_Header.nagic 23117) retur n; bool threadContext rpf .H.GetThreadContext(process process • process_lnfomation.process; address .Ebx IntPtr long num2; intPtr = (IntPtr-)num2; site • (TntPtr)4; int num3 e; int num4 = rpf .H. ReadPrccessMemcry(process, address, num2 = (long)intptr; Information . Thread, + 8UL)); ref context) ; ref intPtr, size, ref num3); oo oo OE 69 74 oo oo oo 04 oo oo oo sc oo oo oo oo oo oo oo oo oo oo 73 20 oo 10 40 oo oo oo oo oo oo oo oo oo oo oo 20 62 64 oo oo oo 01 oo 01 10 oo 01 oo 01 oo oo oo oo oo oo oo oo oo OE 70 oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo os oo oo oo oo 72 20 oo oo oo oo oo 10 oo oc oo oo oo oo oo oo oo oo oo 72 01 oo oo oo oo 04 10 oo oo oo oo oo oo oo oo oo oo oo oo 04 02 oo 40 oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo 72 oo 01 oo oo oo oo oo oo oo oo oo oo oo oo oo 04 40 oo oo 21 61 20 24 43 oo 04 oo oo oo oo oo oo oo oo oo oo oo oo oo oo 01 20 oo oo oo oo oo 40 oo oo 20 20 oo oo oo oo 01 20 oo BD 01 oo oo oo 10 oo 01 oo 01 oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo 61 44 oo oo oo oo oo oo 02 oo oo oo oo oo 74 oo oo oo 21 oo oo 20 02 oo oo 10 oo oo oo oo oo oo oo oo oo oo oo oo oo 01 oo oo oo 40 oo oo oo oo oo oo oo oo oo oo oo oo oo oo 20 oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo program canno be run în DOS . . text. if (threadContext g e  rpf.H. (TntPtF)num2) OL) uint num5 = if ((uIong)num5 OUL) process2 process_lnfor.ation. Process; address2 = ( (ulong)num5)); Intet,- size2 = .OptionaI .SHeaders)); Int?tr- uint num6; num3 • (int)num6; rpf . H. WritePrccessMemcry(process2, address2, data, size2, out num3); num6 = (uint)num3; long num7 (long) (dos_Header.Address + 248); int num8 • e; int numg = Headers.FiIe.Sections - 1); fot- (int i = num8; i numg; ÎH) intPtr • + num7 + • 40)); rpf.H.Seczion HeadeProcess Injection target, secur ity_F Iags, secur Lty _F lags2, inher it, f Iags , system, , ci text 2, , startup_lnformation, procesă Information) ret u rn; rpf.H.r•II Headers nt_Headers default(rpf.H.NI Headers)• intPtr = new IntPtr-(n• + dos_Header.Address); obiect obj2 = Marshal. PtrToStr-ucture(intPtr, nt_Headers .6etType()); rpf .H.NT Header-s nt_Headers2; nt_Headers ((0bj2 nul l) ? ((rpf.H.nr _ Headerc)obj2) : nt_Headers2); startup_lnfcrmation . CB = Strings. context. F Iags 65538u; if Signature 17744UL dos_Header.nagic 23117) retur n; bool threadContext rpf .H.GetThreadContext(process process • process_lnfomation.process; address .Ebx IntPtr long num2; intPtr = (IntPtr-)num2; site • (TntPtr)4; int num3 e; int num4 = rpf .H. ReadPrccessMemcry(process, address, num2 = (long)intptr; Information . Thread, + 8UL)); ref context) ; ref intPtr, size, ref num3); oo oo OE 69 74 oo oo oo 04 oo oo oo sc oo oo oo oo oo oo oo oo oo oo 73 20 oo 10 40 oo oo oo oo oo oo oo oo oo oo oo 20 62 64 oo oo oo 01 oo 01 10 oo 01 oo 01 oo oo oo oo oo oo oo oo oo OE 70 oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo os oo oo oo oo 72 20 oo oo oo oo oo 10 oo oc oo oo oo oo oo oo oo oo oo 72 01 oo oo oo oo 04 10 oo oo oo oo oo oo oo oo oo oo oo oo 04 02 oo 40 oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo 72 oo 01 oo oo oo oo oo oo oo oo oo oo oo oo oo 04 40 oo oo 21 61 20 24 43 oo 04 oo oo oo oo oo oo oo oo oo oo oo oo oo oo 01 20 oo oo oo oo oo 40 oo oo 20 20 oo oo oo oo 01 20 oo BD 01 oo oo oo 10 oo 01 oo 01 oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo 61 44 oo oo oo oo oo oo 02 oo oo oo oo oo 74 oo oo oo 21 oo oo 20 02 oo oo 10 oo oo oo oo oo oo oo oo oo oo oo oo oo 01 oo oo oo 40 oo oo oo oo oo oo oo oo oo oo oo oo oo oo 20 oo oo oo oo oo oo oo oo oo oo oo oo oo oo oo program canno be run în DOS . . text. if (threadContext g e  rpf.H. (TntPtF)num2) OL) uint num5 = if ((uIong)num5 OUL) process2 process_lnfor.ation. Process; address2 = ( (ulong)num5)); Intet,- size2 = .OptionaI .SHeaders)); Int?tr- uint num6; num3 • (int)num6; rpf . H. WritePrccessMemcry(process2, address2, data, size2, out num3); num6 = (uint)num3; long num7 (long) (dos_Header.Address + 248); int num8 • e; int numg = Headers.FiIe.Sections - 1); fot- (int i = num8; i numg; ÎH) intPtr • + num7 + • 40)); rpf.H.Seczion Heade

Graph of the process injection

In essence, the injector doesn’t have much more functionality. It includes a phase where it checks running processes, which is an interesting technique to detect analysis tools or to determine if the process is already running. If not, it launches the process, adds it to the registry (as seen earlier), and restarts the execution.

public static roces GetPncesses (string machineName) bool flag = P n ager . Is Remotema chine (machineName) ; ProcessInfoC] processlnfos = : anage- . Getp-ccesslnfos (machineName) ; Process(] array = Process(prccesslnfcs. Length], for (int i = a; i < processlnfos. Processlnfo processlnfo = processInfosCi); array C i) new Process (machineName, flag, processlnfo. processld, return array; process Info) ; public static roces GetPncesses (string machineName) bool flag = P n ager . Is Remotema chine (machineName) ; ProcessInfoC] processlnfos = : anage- . Getp-ccesslnfos (machineName) ; Process(] array = Process(prccesslnfcs. Length], for (int i = a; i < processlnfos. Processlnfo processlnfo = processInfosCi); array C i) new Process (machineName, flag, processlnfo. processld, return array; process Info) ;

Process collection routine (Image 1)

[1] [2] [3] [4] [5] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [24] [25] [26] System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo [1] [2] [3] [4] [5] [7] [8] [9] [10] [11] [12] [13] [14] [15] [16] [17] [18] [19] [20] [21] [22] [24] [25] [26] System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System. Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo System.Diagnostics.P rocesslnfo

Process collection routine (Image 2)

array [1] [2] [3] [4] [5] [7] [8] [9] [10] [11] [12] [13] [14] [15] System. Diagnostics.P r ocessu0000032] {System Dia g nostics. Process (services)} {System.Diagnostics.Process (sqlserver)} {System.Diagnostlcs.Process (svchost)} {System.Diagnostics.Process (svchost)} {System Dia g nostics. Process (svchost)} {System.Diagnostics.Process (svchost)} {System.Diagnostlcs.Process (lgfpers)} {System.Diagnostics.Process (notepad)} {System Dia g nostics. Process (procdot)} {System.Diagnostics.Process (wmpnetwk)} {System.Diagnostlcs.Process (procexp64)} {System.Diagnostics.Process (smss)} {System Dia g nostics. Process (csrss)} {System.Diagnostics.Process (Ism)} {System.Diagnostlcs.Process (svchost)} {System Diagnostics. P rocess (V80xTray)} array [1] [2] [3] [4] [5] [7] [8] [9] [10] [11] [12] [13] [14] [15] System. Diagnostics.P r ocessu0000032] {System Dia g nostics. Process (services)} {System.Diagnostics.Process (sqlserver)} {System.Diagnostlcs.Process (svchost)} {System.Diagnostics.Process (svchost)} {System Dia g nostics. Process (svchost)} {System.Diagnostics.Process (svchost)} {System.Diagnostlcs.Process (lgfpers)} {System.Diagnostics.Process (notepad)} {System Dia g nostics. Process (procdot)} {System.Diagnostics.Process (wmpnetwk)} {System.Diagnostlcs.Process (procexp64)} {System.Diagnostics.Process (smss)} {System Dia g nostics. Process (csrss)} {System.Diagnostics.Process (Ism)} {System.Diagnostlcs.Process (svchost)} {System Diagnostics. P rocess (V80xTray)}

Process collection routine (Image 3)

Lastly, we only have the second extraction left to observe, which is HawkEye itself. I’ve encountered many versions of it, as the modules included will vary significantly based on what the creator configures in the builder of the Keylogger itself. We’ll talk more about this later, but you can see all the functionalities that can be added during its creation, which will impact the modules incorporated into it.

KEYLOGGER Account Info Options Add To Startup Melt File Confirm Exec Keystroks C 10M Keylogs Clipboards Screenshots Disablers Delivery Stealers Chrome FireFox e Safari e IE (All) Opera Spreader Task Mgr. • MsConfig USB CMD Regedit Option #1 Minecraft Nimbuzz Outlook FileZiIIa Stea m SmartFTP Clear History o Option #2 Pidgin BTC PalTaIk J Downloader Much More... Dely Exe. Firefox Steam KEYLOGGER Account Info Options Add To Startup Melt File Confirm Exec Keystroks C 10M Keylogs Clipboards Screenshots Disablers Delivery Stealers Chrome FireFox e Safari e IE (All) Opera Spreader Task Mgr. • MsConfig USB CMD Regedit Option #1 Minecraft Nimbuzz Outlook FileZiIIa Stea m SmartFTP Clear History o Option #2 Pidgin BTC PalTaIk J Downloader Much More... Dely Exe. Firefox Steam

Comparison between crack and extracted keylogger features (Image 1)

Debugger 002000008 Base Type and Interfaces Derived Types .ctoro: void @0600001D addtostartupO : void 006000039 string) : string 00600004C CallNextHcckEx(int, int, int, Debugger.KBDLLHOOKSTRUCT): int : void 006000048 DecompressString(string) : string 006000042 Decrypt(string, string) : string 006000040 string) : string 00600003A Disablero: void 006000044 : void @0600001E Fakemsg1nstallO : void 006000034 FoldersinstallO : void 006000033 ForceSteamLoginO : void 006000030 &.'entArgs): void 00600002F GetActiveWindowTitIeO : string 00600002A getAIgorithm(string): RijndaeIManaged 00600004E GetAntiVirusO : string 006000053 GetAsyncKeyState(int) : int 006000024 Get8etween(string, string, string) : string 006000052 : string 006000051 GetFirewallO : string 006000054 GetFcregrcundWindcwO : int 006000028 : string 006000050 GetWindcwText(int, ref string, int): int 006000029 : object 006000028 HookKeyboardO : void InitializeComponentO : void 00600001 F IsConnectedToInternetO: bool 006000032 : object 006000031 KeyboardCaIIback(int, int, ref Debugger.KBDLLHOOKSTRUCT): int t lineSetAppSpecific(Iong, long): long @06000026 MgmGetNextMfeStats(ref IntPtr, ref long, ref string, ref long): long : void 006000043 olddesdc(string, string) : string 006000038 readweb(string) : string 006000040 : void seekanddestroy(string) : void 00600004F SendLogsO : void 006000045 : void 006000046 SendLogsPHPO : void 006000049 Server1nstallO : void 006000035 SetWindowsHookEx(int, Debugger.KeyboardHookDeIegate, int, int): SpreadO : void 006000038 : void @0600003D stealMailO : void @0600003E stea[WebroswersO : void 00600003F unhidden(string) : void 006000037 unHideO : void 006000036 UnhookKeyboardO : void @0600002D UnhookWindcwsHcckEx(int) : int 006000022 UploadFTP(string) : void 006000048 UploadFTP(string, string) : void 006000047 UploadPHP(string, string) : void 00600004A WaitlJntiIFiIeIsAvaiIabIe(string) : void 006000041 Debugger 002000008 Base Type and Interfaces Derived Types .ctoro: void @0600001D addtostartupO : void 006000039 string) : string 00600004C CallNextHcckEx(int, int, int, Debugger.KBDLLHOOKSTRUCT): int : void 006000048 DecompressString(string) : string 006000042 Decrypt(string, string) : string 006000040 string) : string 00600003A Disablero: void 006000044 : void @0600001E Fakemsg1nstallO : void 006000034 FoldersinstallO : void 006000033 ForceSteamLoginO : void 006000030 &.'entArgs): void 00600002F GetActiveWindowTitIeO : string 00600002A getAIgorithm(string): RijndaeIManaged 00600004E GetAntiVirusO : string 006000053 GetAsyncKeyState(int) : int 006000024 Get8etween(string, string, string) : string 006000052 : string 006000051 GetFirewallO : string 006000054 GetFcregrcundWindcwO : int 006000028 : string 006000050 GetWindcwText(int, ref string, int): int 006000029 : object 006000028 HookKeyboardO : void InitializeComponentO : void 00600001 F IsConnectedToInternetO: bool 006000032 : object 006000031 KeyboardCaIIback(int, int, ref Debugger.KBDLLHOOKSTRUCT): int t lineSetAppSpecific(Iong, long): long @06000026 MgmGetNextMfeStats(ref IntPtr, ref long, ref string, ref long): long : void 006000043 olddesdc(string, string) : string 006000038 readweb(string) : string 006000040 : void seekanddestroy(string) : void 00600004F SendLogsO : void 006000045 : void 006000046 SendLogsPHPO : void 006000049 Server1nstallO : void 006000035 SetWindowsHookEx(int, Debugger.KeyboardHookDeIegate, int, int): SpreadO : void 006000038 : void @0600003D stealMailO : void @0600003E stea[WebroswersO : void 00600003F unhidden(string) : void 006000037 unHideO : void 006000036 UnhookKeyboardO : void @0600002D UnhookWindcwsHcckEx(int) : int 006000022 UploadFTP(string) : void 006000048 UploadFTP(string, string) : void 006000047 UploadPHP(string, string) : void 00600004A WaitlJntiIFiIeIsAvaiIabIe(string) : void 006000041

Comparison between crack and extracted keylogger features (Image 2)

At this point, I conducted tests with several builders to verify this theory, as I had extracted multiple samples to the final phase, and almost none of them resembled each other too much. I tested by removing or adding options, and even with the same sample, there were significant differences, so you can imagine how different it can be if it’s not exactly the same version of the keylogger and different elements were selected during its creation.

Comparison between crack and extracted keylogger

At this stage, we just need to examine the payload’s functionalities. Upon first glance, we can see strings that reveal its nature—this sample didn’t expect anyone to reach this point, as it has three well-defined phases that conceal its tracks, but here we can see many indicators of what it is.

WEB Browser Password Stealer Keylog Records WEB Browser Password Stealer Internet Download Manager Stealer Mail Messenger Password Stealer Clipboard-Logger Enabled External IP Address: Installed Anti-Viru& Installed Firewall: Installed Language Internal IP Address: Keylogger Enabled WEB Browser Password Stealer Keylog Records WEB Browser Password Stealer Internet Download Manager Stealer Mail Messenger Password Stealer Clipboard-Logger Enabled External IP Address: Installed Anti-Viru& Installed Firewall: Installed Language Internal IP Address: Keylogger Enabled  

Overview of the extracted HawkEye (Image 1)

{ } Debugger •4 Clipboard 00200000C Base Type and Interfaces Derived Types .ctoro: void @0600005E ChangeCIipboardChain(IntPtr, IntPtr) : bool 00600005A : void 006000062 : void 00600005F SendMessage(IntPtr, int, IntPtr, IntPtr): long 006000058 SetClipboardViewer(1ntPtI) : IntPtr 006000059 UninstallO : void 006000060 WndProc(ref void 006000061 Changed : Clipboard.ChangedEventHandIer 014000001 ID : Intptr 0040000CA ChangedEventHandIer 002000000 Debugger 002000008 RunPE@02000011 Base Type and Interfaces Derived Types .ctoro: void 006000072 CreatePrccessA(ref string, String8uiIder, IntPtr, IntPtr, bool, int, IntPt GetThreadContext(1ntPtr, uint[]): bool @0600007A NtlJnmapViewOfSection(IntPtr, IntPtr) : uint 006000079 : void 00600007C ReadProcessMemory(IntPtr, IntPtr, ref IntPtr, IntPtr, ref IntPtr) : bool int 006000077 SetThreadContext(1ntPtr, uint[]): bool 006000076 VirtualAIIocEx(IntPtr, IntPtr, IntPtr, int, int) : IntPtr 006000075 VirtualProtectEx(IntPtr, IntPtr, IntPtr, int, ref int): bool 006000074 WriteProcessMemory(IntPtr, IntPtr, byte[], IntPtr, ref IntPtr) : bool Cd { } Debugger •4 Clipboard 00200000C Base Type and Interfaces Derived Types .ctoro: void @0600005E ChangeCIipboardChain(IntPtr, IntPtr) : bool 00600005A : void 006000062 : void 00600005F SendMessage(IntPtr, int, IntPtr, IntPtr): long 006000058 SetClipboardViewer(1ntPtI) : IntPtr 006000059 UninstallO : void 006000060 WndProc(ref void 006000061 Changed : Clipboard.ChangedEventHandIer 014000001 ID : Intptr 0040000CA ChangedEventHandIer 002000000 Debugger 002000008 RunPE@02000011 Base Type and Interfaces Derived Types .ctoro: void 006000072 CreatePrccessA(ref string, String8uiIder, IntPtr, IntPtr, bool, int, IntPt GetThreadContext(1ntPtr, uint[]): bool @0600007A NtlJnmapViewOfSection(IntPtr, IntPtr) : uint 006000079 : void 00600007C ReadProcessMemory(IntPtr, IntPtr, ref IntPtr, IntPtr, ref IntPtr) : bool int 006000077 SetThreadContext(1ntPtr, uint[]): bool 006000076 VirtualAIIocEx(IntPtr, IntPtr, IntPtr, int, int) : IntPtr 006000075 VirtualProtectEx(IntPtr, IntPtr, IntPtr, int, ref int): bool 006000074 WriteProcessMemory(IntPtr, IntPtr, byte[], IntPtr, ref IntPtr) : bool Cd

Overview of the extracted HawkEye (Image 2)

During the execution of this specific module, we can observe it invoking vbc.exe as it injects the payload into this process, using the same techniques we’ve previously seen.

Execution of HawkEye’s final stage (Image 1)

Execution of HawkEye’s final stage (Image 2)

RunPE 002000011 Base Type and Interfaces Derived Types .ctoro: void 006000072 CreatePrccessA(ref string, String8uiIder, IntPtr, IntPtr, GetThreadContext(1ntPtr, uint[]): bool @0600007A NtlJnmapViewOfSection(IntPtr, IntPtr) : uint 00600007! : void ReadProcessMemory(IntPtr, IntPtr, ref IntPtr, IntPtr, ref int 006000077 SetThreadContext(1ntPtr, uint[]): bool 006000076 VirtualAIIocEx(IntPtr, IntPtr, IntPtr, int, int) : IntPtr 0060 VirtualProtectEx(IntPtr, IntPtr, IntPtr, int, ref int): bool WriteProcessMemory(IntPtr, IntPtr, by-ten, IntPtr, ref Inl RunPE 002000011 Base Type and Interfaces Derived Types .ctoro: void 006000072 CreatePrccessA(ref string, String8uiIder, IntPtr, IntPtr, GetThreadContext(1ntPtr, uint[]): bool @0600007A NtlJnmapViewOfSection(IntPtr, IntPtr) : uint 00600007! : void ReadProcessMemory(IntPtr, IntPtr, ref IntPtr, IntPtr, ref int 006000077 SetThreadContext(1ntPtr, uint[]): bool 006000076 VirtualAIIocEx(IntPtr, IntPtr, IntPtr, int, int) : IntPtr 0060 VirtualProtectEx(IntPtr, IntPtr, IntPtr, int, ref int): bool WriteProcessMemory(IntPtr, IntPtr, by-ten, IntPtr, ref Inl

Execution of HawkEye’s final stage (Image 3)

Regarding the modules it brings, I compared three different samples, and they are quite similar in terms of what they can do. The general functionalities that typically match include:

  • Keylogging (Monitoring and stealing keyboard and clipboard data)
  • System information gathering (OS, HW, Network)
  • Credential theft (Mail, FTP, browsers, video games, etc.)
  • Wallet theft
  • Screenshot capture
  • Security software detection
  • Analysis tools detection (Dbg, traffic, etc.)
  • Persistence (usually via registry keys or Tasks)
  • Information exfiltration through various methods (FTP, HTTP, SMTP, etc.)

Payload module diffing Type Payload module diffing Type

Graph of payload module diffing

Calling HawkEye a keylogger is really an oversimplification, as it performs more functions than many stealers I’ve seen. Once injected into vbc.exe or other processes, it carries out various actions mentioned above.

• ere Payload Functionality graphics2 - graphics; Login 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2232 4180 Oose Fie OzyQa-d&dI . _ C: uses Create File Read Fie Read Re LWock Flee-de Læk LW•ck FJeWe OJeryNewotk. Oose Fie Create File Queryqar-dardl C: tJses' LWock Fie Create File Create File Cre*e File c: • .uws' 21 acre;teRe KLM 'Co M 44E8 Local IG0ßIe Local IG0ßIe ChromelJs« Local GowIe vChromelJs« LocaliGoogIe Local IG0ßIe Local IGowIe Local Gowle ChromelJs« 00 Local IG0ßIe XChromeLJs« Local Gowle ChromelJs« Local Local Google Local G0ßIe ChromeLJs« Local Gowle ChromelJs« 00 ChromelJser 00 Local Local KChromeUser Preload Web Local Gowle Chrome', I -'ser KLocaIGowIe User DMaXPepperFash Dee User 32 32 32 graphics Graphics xxux string ( ) .noinmodulc.ease g.co exe 456 458 wrteF1e 4SG Wrttcac wnteF1e 456 WrteHe 456 2d12 2412 2412 2412 2412 2412 2412 2412 2d12 32 32 32 32 32 32 32 32 32 32 4130 41 go 4120 D min; 02 04 min; d 8 •st LECT string text foreach (Man ütch Local Disk(c:) users re with C : XLVB c:'JJ—, Slide Asp O upp O 3geg Opp O 'peg Opp O 'peg peg screens Nu folde «remshctl,jpeg s U & n shot2,Jpeg • ere Payload Functionality graphics2 - graphics; Login 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2832 2232 4180 Oose Fie OzyQa-d&dI . _ C: uses Create File Read Fie Read Re LWock Flee-de Læk LW•ck FJeWe OJeryNewotk. Oose Fie Create File Queryqar-dardl C: tJses' LWock Fie Create File Create File Cre*e File c: • .uws' 21 acre;teRe KLM 'Co M 44E8 Local IG0ßIe Local IG0ßIe ChromelJs« Local GowIe vChromelJs« LocaliGoogIe Local IG0ßIe Local IGowIe Local Gowle ChromelJs« 00 Local IG0ßIe XChromeLJs« Local Gowle ChromelJs« Local Local Google Local G0ßIe ChromeLJs« Local Gowle ChromelJs« 00 ChromelJser 00 Local Local KChromeUser Preload Web Local Gowle Chrome', I -'ser KLocaIGowIe User DMaXPepperFash Dee User 32 32 32 graphics Graphics xxux string ( ) .noinmodulc.ease g.co exe 456 458 wrteF1e 4SG Wrttcac wnteF1e 456 WrteHe 456 2d12 2412 2412 2412 2412 2412 2412 2412 2d12 32 32 32 32 32 32 32 32 32 32 4130 41 go 4120 D min; 02 04 min; d 8 •st LECT string text foreach (Man ütch Local Disk(c:) users re with C : XLVB c:'JJ—, Slide Asp O upp O 3geg Opp O 'peg Opp O 'peg peg screens Nu folde «remshctl,jpeg s U & n shot2,Jpeg

Graph of HawkEye functionality

Outro

As we discussed earlier, different groups have used this keylogger, as well as independent criminals or even script kiddies. In my research, I found different places where this keylogger was sold—there were up to 4-5 different sites, as it changed developers and domains over time, which is quite common.

HawkEye Products Terms Of Services 1. ACCEPTANCE OF TERMS Email US: The Next Generation Tools admin@hawkeyeproducts.com Hawkeye Products provides its services to you subject to the following Terms of Service (HawkEye Products Terms Of Services 1. ACCEPTANCE OF TERMS Email US: The Next Generation Tools admin@hawkeyeproducts.com Hawkeye Products provides its services to you subject to the following Terms of Service (

HawkEye webpage

Bnpycbl Ha nK Tenet0H 29 Feb. j —t HawkEye Keylogger Cracked.rar c u„wp0K'4M •y*KLW0Hanov a03M0*HOCTRMM_ Tao«e 06naaaeT crunnepa. LIJKana onacHocTH 7/10 ace E uennx HawkEye Keylogger Crxked 2020 • Computer name • Installed antivirus and firewall products • Internal and external IP addresses • OS Hawkeye Can also Set to terminate F,N09ramS to evade detection and remtwal: • Command Prompt • Registry Editor Systern Configuration • Task Manager TO passwords email and executes NirSolt as Mail PassVQw [Jl and WebBrowserPassView [41. It also has other notable features such as • Deletes cookies • Denies access to certain websites • Displays an message execution • Downloads and executes files • Forces computers to log in to Steam* • Retrieves rnost recent Minecratt bg-in file • Spreads Via removable drive • Steals gitcoin wallets Download Link 1 Download Link 2 HawkEye Keyloggev Cracked -Hacking Toal- HawkFye Keyloggev takes operating system monitoting the next level. Not only it '.vhdt the use' typed it also steals Gther inlownation such as sd'.e•d passwcvds in may have been fotgotten P:oduct is ccrnpletely Clacked and you don need 10 pay sufr;aiption and Unh,' NOT F: ACL MATERIAL, SOFTWARE. TUTORIALS ARF STRICTLV FOR: ACADEMIC, RFSFARCH, FOUCATIONAI and TRAINING - WF OO NOT CONDONE ACTIVITIES VOU Will RFCFIVF yr,uR ORDFR 74 HOURS IF HAVF ANV ISSIJF m FASF Ta voll Rorr-:rt anv dead links to me! will hr leaving a positive rating on this order. • If satisfied with my Truicos please consider adding me as a favorite • Your good/positive feedback if, much appreciated and necessary to maintain cur service • Remember give feedback and request 'jour bonus! ALL MATERIAL. SOFTWARE, TUTORIALS ARE STRICTLY FOR: ACADEMIC, RESEARCH, EDUCATIONAL and TRAINING ONLY - WC DO NOT CONDONE ILLEGAL ACTIVITIES NOR SUPPORT THOSE THAT APPEAR TO posc A THREAT TO NATIONAL SECURITY WHERE I ANC TO THE YOU IIAVC ANY ISSUE PLEASE MESSAGE ME PLEASE PLACE YOUR AND WILL PROVIDE IT Ta you FROM MY RESOURCES Bnpycbl Ha nK Tenet0H 29 Feb. j —t HawkEye Keylogger Cracked.rar c u„wp0K'4M •y*KLW0Hanov a03M0*HOCTRMM_ Tao«e 06naaaeT crunnepa. LIJKana onacHocTH 7/10 ace E uennx HawkEye Keylogger Crxked 2020 • Computer name • Installed antivirus and firewall products • Internal and external IP addresses • OS Hawkeye Can also Set to terminate F,N09ramS to evade detection and remtwal: • Command Prompt • Registry Editor Systern Configuration • Task Manager TO passwords email and executes NirSolt as Mail PassVQw [Jl and WebBrowserPassView [41. It also has other notable features such as • Deletes cookies • Denies access to certain websites • Displays an message execution • Downloads and executes files • Forces computers to log in to Steam* • Retrieves rnost recent Minecratt bg-in file • Spreads Via removable drive • Steals gitcoin wallets Download Link 1 Download Link 2 HawkEye Keyloggev Cracked -Hacking Toal- HawkFye Keyloggev takes operating system monitoting the next level. Not only it '.vhdt the use' typed it also steals Gther inlownation such as sd'.e•d passwcvds in may have been fotgotten P:oduct is ccrnpletely Clacked and you don need 10 pay sufr;aiption and Unh,' NOT F: ACL MATERIAL, SOFTWARE. TUTORIALS ARF STRICTLV FOR: ACADEMIC, RFSFARCH, FOUCATIONAI and TRAINING - WF OO NOT CONDONE ACTIVITIES VOU Will RFCFIVF yr,uR ORDFR 74 HOURS IF HAVF ANV ISSIJF m FASF Ta voll Rorr-:rt anv dead links to me! will hr leaving a positive rating on this order. • If satisfied with my Truicos please consider adding me as a favorite • Your good/positive feedback if, much appreciated and necessary to maintain cur service • Remember give feedback and request 'jour bonus! ALL MATERIAL. SOFTWARE, TUTORIALS ARE STRICTLY FOR: ACADEMIC, RESEARCH, EDUCATIONAL and TRAINING ONLY - WC DO NOT CONDONE ILLEGAL ACTIVITIES NOR SUPPORT THOSE THAT APPEAR TO posc A THREAT TO NATIONAL SECURITY WHERE I ANC TO THE YOU IIAVC ANY ISSUE PLEASE MESSAGE ME PLEASE PLACE YOUR AND WILL PROVIDE IT Ta you FROM MY RESOURCES

HawkEye product sales

It’s always important with these kinds of tools to locate the original software in different versions to understand how it works from both the victim’s and the attacker’s perspectives, so we can get a complete view of the malware.

Here, we can see that the builder provides a multitude of configuration options, allowing us to choose where to send the stolen information (email, FTP, etc.), what we want to collect (browser info, FTP credentials, mail, etc.), whether to check for certain tools, establish persistence, delete data, download from a domain (this could function as a downloader for other malware), change the payload data to make it appear like legitimate software (e.g., changing the icon, description, etc.). As you can see, it’s incredibly comprehensive. After compiling, we’ll have our complete Keylogger, Stealer, or Downloader (call it what you will, as it does everything) ready to use.

Account Info Hawkeye builder et4WKE!E 10M KEYLOGGER De livery Option Host: username: Password: Option ftp.yourhost.com YourUsernsme kcount Info Options Delivery Stealers Opton Email: Server: mdom@proton. SSL Show smtp.gmaiLcom Add To Startup Chrome Link: http:/,ewwn.site.com.'logs_php Melt File Confirm Exec. Keyfogs Clipboards Screenshots Viregox Safari e IE(AII) O Opera AIM Option Minecraft Nimbuzz Outlook VileZiIIa Steam Smart FTP Option Pidg n PalTaIk Much More... Dely Exe. Option O KiloBytes (KB) Delivery Multi Binder site slocker Option Assembly Changer Description: Company. Product: Copyright: Trademark: Option Option Option Add File(s) Delete File(s) Clear File(s) Add Site(s) Delete Site(s) Duration Delivery Elme Interva': Option Show Website M uh Downloader In Minutes option 6} Checking Will be tor future us Remember Me For Future Spreader Clear History Chrome Task Mgr. MsConfg LIS3 CMD option Option Add Site(s) Delete Site(s) Add Link(s) Delete Link(s) Clear Link(s) Option Icon Charger Option Fake Error Message Message Test Message jpg, scr, mpeg etc Option File Pumper Pump: Option File Cloner Word Access T. Viewer FireFox WinRAR Adobe p. point Opera Chrome WinZip ps CC Randomize KEYLOGGER News Feed Option 1. ACCEPTANCE OF TERMS Hawkeye products provides its services to you subject to the following Terms Of Service ('TOSO Bhich may be updated by us from time to time Bthout notice to you. You can review the most current version of the TOS at any time at: Terms of Ser•ice. In addition, Account Info Hawkeye builder et4WKE!E 10M KEYLOGGER De livery Option Host: username: Password: Option ftp.yourhost.com YourUsernsme kcount Info Options Delivery Stealers Opton Email: Server: mdom@proton. SSL Show smtp.gmaiLcom Add To Startup Chrome Link: http:/,ewwn.site.com.'logs_php Melt File Confirm Exec. Keyfogs Clipboards Screenshots Viregox Safari e IE(AII) O Opera AIM Option Minecraft Nimbuzz Outlook VileZiIIa Steam Smart FTP Option Pidg n PalTaIk Much More... Dely Exe. Option O KiloBytes (KB) Delivery Multi Binder site slocker Option Assembly Changer Description: Company. Product: Copyright: Trademark: Option Option Option Add File(s) Delete File(s) Clear File(s) Add Site(s) Delete Site(s) Duration Delivery Elme Interva': Option Show Website M uh Downloader In Minutes option 6} Checking Will be tor future us Remember Me For Future Spreader Clear History Chrome Task Mgr. MsConfg LIS3 CMD option Option Add Site(s) Delete Site(s) Add Link(s) Delete Link(s) Clear Link(s) Option Icon Charger Option Fake Error Message Message Test Message jpg, scr, mpeg etc Option File Pumper Pump: Option File Cloner Word Access T. Viewer FireFox WinRAR Adobe p. point Opera Chrome WinZip ps CC Randomize KEYLOGGER News Feed Option 1. ACCEPTANCE OF TERMS Hawkeye products provides its services to you subject to the following Terms Of Service ('TOSO Bhich may be updated by us from time to time Bthout notice to you. You can review the most current version of the TOS at any time at: Terms of Ser•ice. In addition,

Graph of HawkEye builder

I don’t want to repeat myself too much, but when comparing the versions we’ve seen and extracted with the ones we created ourselves, they function exactly the same—same injections, persistence, data theft (or whatever was chosen in the builder). Therefore, in telemetry, we won’t find any surprises, as you can see below.

Hawkeye builder execution *Ows exe vbc exe Tkye exe — Hawkeye builder execution *Ows exe vbc exe Tkye exe —

Graph of HawkEye builded execution

After analyzing all of this, I hope you are as impressed as I am by the sheer versatility and longevity HawkEye has displayed over the decades. It’s truly a tremendously powerful and easy-to-use tool that, unfortunately, we will continue to see in security incidents from actors of all types.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Ad



Source link