HawEye Lab Blue Team - Network Forensics Walkthrough

CyberDefenders HawkEye Lab – Official Blue Team Write-up

Author: Mounica S Goodala

Date: 2026-07-31

Lab: Network Forensics - KeyLogger Exfiltration

Objective: Investigate a suspicious network trace to identify the malware variant, exfiltrated data, and attacker infrastructure.

---

1. Scenario Overview

An accountant at the organization received a phishing email containing a link to a malicious invoice. Shortly after, SOC analysts detected suspicious outbound network traffic. This investigation focuses on analyzing the provided stealer.pcap capture to identify the attack chain, the malware used, and the data exfiltrated.

---

2. Tools & Environment

• Wireshark v4.x – Packet analysis
• CyberChef – Base64 decoding
• Mac Vendor Lookup – OUI identification
• AbuseIPDB – IP geolocation
• Terminal (macOS) – MD5 hashing

---

3. Investigation Methodology

Phase 1: Initial Packet Reconnaissance

1. Open PCAP: Loaded stealer.pcap in Wireshark.
2. Timezone Configuration: Adjusted View → Time Display Format to UTC to align with SIEM standards (crucial due to UAE UTC+4 offset).
3. File Statistics (Statistics → Capture File Properties):
   • Total Packets: 4003
   • Duration: 01:03:41
   • First Packet UTC: 2019-04-10 20:37 (Corrected from local time).

Phase 2: Host & Network Mapping

1. Most Active Device (Link Layer) (Statistics → Conversations → Ethernet):
   • MAC Address: 00:08:02:1c:47:ae (Sorted by highest packet count).
   • NIC Manufacturer: Looked up OUI 00:08:02 via MAC lookup → Hewlett Packard.
   • Manufacturer HQ: Palo Alto, California, USA.

1. Private IPs & Host Count (Statistics → Endpoints → IPv4):
   • Identified subnet 10.4.10.0/24.
   • Counted actual hosts: 10.4.10.2, 10.4.10.4, and 10.4.10.132 (broadcast .255 excluded).
   • Total Computers: 3.
2. Victim Hostname (Filter: dhcp → Expand Option: Hostname):
   • The most active host (10.4.10.132) is BEIJING-5CD1-PC.
3. Network Services:
   • DNS Server: Filtered dns traffic → Destination IP of queries is 10.4.10.4.

Phase 3: Malware Download & Webserver Analysis

1. Malicious Domain & Infrastructure:
   • Packet 204 (DNS): Queried proforma-invoices.com → Resolved to 217.182.138.150 (Geolocation: France).
2. Malicious File Download:
   • Filtered http traffic and used File → Export Objects → HTTP.
   • Located tkraw_Protected99.exe.
   • MD5 Hash (via Terminal): 71826ba081e303866ce2a2534491a2f7.
   • Webserver Software: Analyzed the HTTP response header (Server field) → LiteSpeed.

1. Victim OS Fingerprinting:
   • Inspected the User-Agent in the HTTP GET request → Windows NT 6.1 → Windows 7.
2. Victim Public IP:
   • Followed TCP Stream on Packet 3166 → External NAT IP: 173.66.146.112.

Phase 4: Exfiltration Analysis (SMTP / Email)

1. SMTP Server Identification:
   • Filtered smtp and followed the first TCP stream.
   • Server Banner: ESMTP Exim 4.91.
   • Email Server IP: 23.229.162.69 (Geolocation: United States).

1. Recipient & Credentials:
   • The malware sent stolen logs to: [e-mail].
   • SMTP AUTH LOGIN credentials decoded via CyberChef:
     • Username (Base64): [e-mail]
     • Password (Base64 U2FsZXNAMjM=): Sales@23.
2. Stolen Data & Malware Variant:
   • Decoded the Base64 email body.
   • Malware Variant: HawkEye Keylogger - Reborn v9.
   • Bank of America Credentials (extracted from the log): roman.mcguire:P@ssw0rd$.

---

4. Summary of Answers

Here is the complete list of answers derived from the investigation:

#	Question	Answer
1	How many packets does the capture have?	4003
2	At what time was the first packet captured (UTC)?	2019-04-10 20:37
3	What is the duration of the capture?	01:03:41
4	Most active computer at the link level (MAC)?	00:08:02:1c:47:ae
5	Manufacturer of the NIC?	Hewlett Packard
6	HQ of the manufacturer?	Palo Alto
7	How many computers are on the private /24 network?	3
8	Name of the most active computer (Network level)?	BEIJING-5CD1-PC
9	IP of the organization's DNS server?	10.4.10.4
10	Domain asked about in packet 204?	proforma-invoices.com
11	IP of the domain in Q10?	217.182.138.150
12	Country of the IP in Q11?	France
13	OS of the victim's computer?	Windows 7
14	Malicious file downloaded?	tkraw_Protected99.exe
15	MD5 hash of the malicious file?	71826ba081e303866ce2a2534491a2f7
16	Webserver software hosting the malware?	LiteSpeed
17	Public IP of the victim computer?	173.66.146.112
18	Country of the email server?	United States
19	Email server software used?	Exim 4.91
20	To which email account is data sent?	[e-mail]
21	Password used by malware to send email?	Sales@23
22	Malware variant that exfiltrated the data?	HawkEye Keylogger - Reborn v9
23	Bank of America access credentials?	roman.mcguire:P@ssw0rd$

---

5. Conclusion & Recommendations

The investigation confirms a successful HawkEye Keylogger (Reborn v9) infection. The attack chain is as follows:

1. Initial Access: Phishing email directed the accountant to download tkraw_Protected99.exe from proforma-invoices.com.
2. Execution: The malware executed on a Windows 7 host (BEIJING-5CD1-PC with internal IP 10.4.10.132).
3. Data Theft: The malware harvested credentials (including Bank of America login) and logged keystrokes.
4. Exfiltration: Stolen data was Base64-encoded and exfiltrated via SMTP to [e-mail] using an Exim 4.91 mail server located in the US.

Recommended Actions:

• Immediately reset credentials for roman.mcguire across all platforms.
• Isolate and reimage the compromised Windows 7 host (BEIJING-5CD1-PC).
• Block indicators of compromise (IOCs): proforma-invoices.com, 217.182.138.150, and 23.229.162.69 at the network perimeter.
• Educate employees on phishing awareness.