Post cover image

October 24, 2026

HawkEye Lab — CyberDefenders Labs

Hello,

By Adel asaad

5 min read

we will walk through the solution of HawkEye Lab from CyberDefenders.org.

Scenario:

An accountant at your organization received an email regarding an invoice with a download link. Suspicious network traffic was observed shortly after opening the email. As a SOC analyst, investigate the network trace and analyze exfiltration attempts.

Tools:

Questions :

Q1: How many packets does the capture have?

So easy! After downloading and extracting the file, open it with Wireshark. Just take a look at the bottom right corner to see how many packets the capture contains

None 
Answer: 4003

Q2: At what time was the first packet captured?

There are several ways to find the first packet that was sent. One of them is by viewing the capture statistics — you can do that by clicking the icon at the bottom left corner.

None

the time for the first packet:

None 
Answer: 2019-04-10 20:37

Q3: What is the duration of the capture?

We can also find the answer using the same steps mentioned earlier.

None 
Answer: 01:03:41

Q4: What is the most active computer at the link level?

You can go to Statistics → Conversations, and you'll see that the MAC address 00:08:02:1C:47:AE is the most active one.

None 
Answer: 00:08:02:1C:47:AE

Q5: Manufacturer of the NIC of the most active system at the link level?

We can identify the manufacturer of the MAC address by looking it up on a MAC Address Lookup website.

None 
Answer: Hewlett-Packard

Q6: Where is the headquarter of the company that manufactured the NIC of the most active computer at the link level?

Just search on Google for the company's location

None 
Answer:  Palo Alto

Q7: The organization works with private addressing and netmask /24. How many computers in the organization are involved in the capture?

You can open the Statistics tab, then go to Conversations, and check the IPv4 section — there you'll find the addressing details and the netmask (/24).

None

The image above shows 4 Private IP addresses, but the .255 was assigned to the Broadcast address (First address = network address & last address = broadcast address).

None 
Answer: 3

Q8: What is the name of the most active computer at the network level?

We will Filter for DHCP packet queries related to the most active device's IP address it was 10.4.10.132 and search on DNS for the host name BEIJING-5CD1-PC

None 
Answer: BEIJING-5CD1-PC

Q9: What is the IP of the organization's DNS server?

We will Filter for DNS and will search about source ip it will be 10.4.10.4 as the below snap

None 
Answer:10.4.10.4

Q10: What domain is the victim asking about in packet 204?

Filter by DNS in packet 204 and in section of DNS will find the domain proforma-invoices.com

None 
Answer: proforma-invoices.com

Q11:What is the IP of the domain in the previous question?

To find the IP address of the domain, we need to go packet (206).and then go to DNS and tap of answers 217.182.138.150

None 
Answer:217.182.138.150

Q12: Indicate the country to which the IP in the previous section belongs.

I visited www.iplocation.net to find out which country the IP address belongs to :

None 
Answer: FRANCE

Q13:What operating system does the victim's computer run?

By applying an HTTP filter, and then follow with HTTP stream find that Windows NT 6.1

None 
Answer:Windows NT 6.1

Q14: What is the name of the malicious file downloaded by the accountant?

By applying an HTTP filter, we can see the malicious file in the first packet :

None 
Answer: tkraw_Protected99.exe

Q15: What is the md5 hash of the downloaded file?

Open the TAP file, choose Export Objects → HTTP, save the retrieved file, and then calculate its MD5 hash :

None

Then we calculate its MD5 hash :

None 
Answer:71826ba081e303866ce2a2534491a2f7

Q16: What software runs the webserver that hosts the malware?

Find the packets related to the downloaded file, right-click → Follow → HTTP Stream to view the webserver that hosts the malware :

None 
Answer:LiteSpeed

Q17: What is the public IP of the victim's computer?

Look at the HTTP traffic — the source IP is 10.4.10.132. Find the GET requests to the public IP and follow the HTTP stream:

None 
Answer:173.66.146.112

Q18: In which country is the email server to which the stolen information is sent?

Look at the SMTP traffic — and then go to https://www.abuseipdb.com/ for more information 23.229.162.69

None 
Answer: United States

Q19: Analyzing the first extraction of information. What software runs the email server to which the stolen data is sent?

_Y_ou can find more information about the programs running on the email server by applying an SMTP filter and then using Follow → TCP Stream:

None 
Answer: Exim 4.91

Q20: To which email account is the stolen information sent?

in the same TCP stream will find it

None 
Answer: sales.del@macwinlogistics.in

Q21: What is the password used by the malware to send the email?

If you notice AUTH login, and there is some encrypted information :

None

Then I will use cyberchef.org :

None 
Answer:Sales@23

Q22: Which malware variant exfiltrated the data?

The message content is Base64-encoded, so let's decode it to see what it contains :

None

Then I will use cyberchef.org again :

None 
Answer:Reborn v9

Q23: What are the bankofamerica access credentials? (username:password)

Don't go away, we are in the right place :

None 
Answer: roman.mcguire:P@ssw0rd$

Q24: Every how many minutes does the collected data get exfiltrated?

If you select the last two traffic, for example, and then open Follow>>TCP Stream :

None

Take a look at the timestamp here:

None

And Here:

None

If you subtract one from the other, you'll get the result you need

Answer: 10
None

Conclusion

That's the end of this write-up. Don't forget to follow me for more and more….