Analysis

  • max time kernel
    150s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    10/03/2022, 00:29

General

  • Target

    7463b6830dfd90ea15acf26233b7c2aaf6c19f0e7f94795376954b88b507c472.exe

  • Size

    540KB

  • MD5

    4f98c2cd9c3633740a641104765d2033

  • SHA1

    67048a2ff708390840106e25eecdb5fdbc0e92e2

  • SHA256

    7463b6830dfd90ea15acf26233b7c2aaf6c19f0e7f94795376954b88b507c472

  • SHA512

    9f9785255b27881eb043425c16a8ffa44855a4ae625ff938dca6130e5b010ebbd7bdb635961e899ae08be5e84ffba182d8ddbf6bb405290cf8afcca1cd08a67f

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

  • NirSoft MailPassView 2 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 2 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7463b6830dfd90ea15acf26233b7c2aaf6c19f0e7f94795376954b88b507c472.exe
    "C:\Users\Admin\AppData\Local\Temp\7463b6830dfd90ea15acf26233b7c2aaf6c19f0e7f94795376954b88b507c472.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
      2⤵
      • Accesses Microsoft Outlook accounts
      PID:1536
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
      2⤵
        PID:944

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/944-63-0x0000000000400000-0x0000000000458000-memory.dmp

            Filesize

            352KB

          • memory/944-66-0x0000000000400000-0x0000000000458000-memory.dmp

            Filesize

            352KB

          • memory/1536-58-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/1536-61-0x0000000000400000-0x000000000041B000-memory.dmp

            Filesize

            108KB

          • memory/1624-54-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

            Filesize

            8KB

          • memory/1624-56-0x0000000001F80000-0x0000000001F81000-memory.dmp

            Filesize

            4KB

          • memory/1624-55-0x00000000740E0000-0x000000007468B000-memory.dmp

            Filesize

            5.7MB

          • memory/1624-57-0x00000000740E0000-0x000000007468B000-memory.dmp

            Filesize

            5.7MB

          • memory/1624-62-0x0000000001F85000-0x0000000001F96000-memory.dmp

            Filesize

            68KB