HawkEye —
The Accountant,
The Invoice, and The Keylogger

The Case: An Invoice Nobody Ordered

An accountant at an organization received an email containing an invoice with a download link. It looked routine. It wasn't. Suspicious network traffic was detected shortly after the email was opened — possible exfiltration attempts flagged by the security team. A network capture file was handed to us for analysis: stealer.pcap.

This is a pure network forensics investigation. No disk image, no memory dump — just packets. Every answer is buried somewhere in 4003 of them. The challenge is knowing which protocols to filter, which streams to follow, and which bytes to decode.

Who Is On This Network?

Before chasing traffic, the first step is mapping the environment. Wireshark's Statistics → Endpoints revealed the private IP space in use, and DHCP filtering identified the machines by name.

The Invoice That Started Everything

The Suspicious DNS Query

Filtering DNS traffic revealed a query that stood out immediately. At packet 204, Beijing-5cd1-PC queried a domain that had no business being contacted from a corporate workstation:

The Malicious Download

Filtering HTTP traffic and using Wireshark's Export Objects feature to list all files transferred over HTTP revealed the smoking gun. Buried in the HTTP object list was an executable masquerading as an invoice document:

The Malware Checks In

Immediately after the download completed, Beijing-5cd1-PC made an unusual request that reveals the malware's first action after execution:

SMTP — Credentials Flying Out Every 10 Minutes

Filtering for SMTP traffic revealed the exfiltration mechanism. The malware was not using a custom C2 protocol or encrypted channel — it was using plain email to send stolen data to an attacker-controlled address. Simple, effective, and easy to miss in environments that don't monitor outbound SMTP.

Following the TCP Stream — HawkEye Unmasked

Following the TCP stream of the SMTP packets revealed the email body — base64 encoded, as expected for MIME email content. Decoding it is where everything became clear.

What roman.mcguire Lost

The decoded email body contained a complete credential report — every saved password HawkEye could find on the machine. The scope of what was stolen makes clear why financial institution workstations are high-value targets.

How HawkEye Got the Browser Passwords

The Chrome credentials weren't harvested via keylogging — they were extracted directly from Chrome's saved password database. Chrome stores credentials in an SQLite database at a predictable, well-known location:

Reconstructing What Happened

Techniques Observed

Indicators of Compromise

What This Investigation Teaches Us

Accountants Are High-Value Targets

This wasn't a random phishing campaign. The lure was an invoice — exactly what an accountant opens dozens of every week. The attacker understood their target's workflow. Spearphishing works because it matches the context of the victim's daily activity. A generic phishing email triggers suspicion. An invoice link does not.

Network Forensics Reveals What Endpoint Tools Miss

The SMTP exfiltration was plaintext, unencrypted, and sent on a 10-minute timer. Any network monitoring solution logging outbound SMTP connections from a workstation — something that should never originate email — would have caught this immediately. Endpoint detection is essential, but network visibility catches the things that slip past it.

Browser-Saved Passwords Are a Single Point of Failure

HawkEye didn't need to keylog a single character of roman.mcguire's Bank of America password. It read the Chrome Login Data file and walked away with everything. The browser's convenience feature — save this password — became the attacker's convenience feature. A dedicated password manager with a master password, combined with MFA on financial accounts, would have made this credential harvest useless even after the infection.

Password Reuse Turns One Breach Into Many

P@ssw0rd$. Bank of America. AOL. Outlook. Same password, every account. This is the force multiplier that makes infostealers so devastating — a single successful harvest doesn't compromise one account. It compromises everything the victim has ever saved a password for. One stolen credential becomes a skeleton key.

Follow the Stream, Find the Truth

The base64 encoded email body looked like noise. Following the TCP stream and decoding it revealed the malware's identity, the victim's machine name, and a complete credential dump. In network forensics, the most valuable data is often hidden inside encoded payloads inside mundane-looking protocols. Always follow the stream.