General

  • Target

    Order07JUL2020-5-40HQ.exe

  • Size

    909KB

  • Sample

    200707-xclbwe6pe6

  • MD5

    e003ceeef6a45f3fe2d6b652d77816c8

  • SHA1

    96fbeecc72ace768f544b7e574b996171b8d02a0

  • SHA256

    8d8236eed9973c50c80b31c7aed1bab0a46dfdcc9b1f1ce749aa7d88963abe1b

  • SHA512

    e61fe04a71d50903e78f0b7dcbb8a01ea25b6424c32464e068d5bc38b60d008ce340b26137b15b25e652d108440a78d335367f83f273c8cdd9c6c5d5a55a3a50

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    webmail.tos-thailand.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    P@ssw0rd

Targets

    • Target

      Order07JUL2020-5-40HQ.exe

    • Size

      909KB

    • MD5

      e003ceeef6a45f3fe2d6b652d77816c8

    • SHA1

      96fbeecc72ace768f544b7e574b996171b8d02a0

    • SHA256

      8d8236eed9973c50c80b31c7aed1bab0a46dfdcc9b1f1ce749aa7d88963abe1b

    • SHA512

      e61fe04a71d50903e78f0b7dcbb8a01ea25b6424c32464e068d5bc38b60d008ce340b26137b15b25e652d108440a78d335367f83f273c8cdd9c6c5d5a55a3a50

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Uses the VBS compiler for execution

    • Adds Run entry to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks