Overview

overview

10

Static

static

PO 2010029...le.exe

windows7_x64

9

PO 2010029...le.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO 2010029_pdf Quotation from Alibaba Ale.exe

  • Size

    1.0MB

  • Sample

    210119-tpm4kfkpjx

  • MD5

    eb59d99961c7636b4872e389da03cbc9

  • SHA1

    22d5fb0f076a0d945596b7938e72b6b5cae73674

  • SHA256

    4dd89aea31cfb64c8fa6b542c9ad002e4041ef5249f2072947df749e00e7fd9e

  • SHA512

    6d062b65284df0f4ce5845b8730ac6adf46759af5f35e3bde86a609bce9ff0d5846fbe2d30864e411b695d774b6f6903d558e42f067c44817e3421cd5d41b256

Score
10/10
hawkeyekeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    outback.websitewelcome.com
  • Port:
    587
  • Username:
    chuktv@ogenexblog24.com
  • Password:
    uDA9jC4eZmuj

Targets

    • Target

      PO 2010029_pdf Quotation from Alibaba Ale.exe

    • Size

      1.0MB

    • MD5

      eb59d99961c7636b4872e389da03cbc9

    • SHA1

      22d5fb0f076a0d945596b7938e72b6b5cae73674

    • SHA256

      4dd89aea31cfb64c8fa6b542c9ad002e4041ef5249f2072947df749e00e7fd9e

    • SHA512

      6d062b65284df0f4ce5845b8730ac6adf46759af5f35e3bde86a609bce9ff0d5846fbe2d30864e411b695d774b6f6903d558e42f067c44817e3421cd5d41b256

    Score
    10/10
    hawkeyekeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks