Overview

overview

10

Static

static

order.exe

windows7_x64

10

order.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8c1494324b16d21b292092e16dbfd1b0eede82d011042fdacff08fac625d16d6

  • Size

    426KB

  • Sample

    220521-bzgakafggp

  • MD5

    7473a120aafcbcc8349ae910fb88a5a2

  • SHA1

    f32557decd9e2b9c812feb96e6792ed14cea9206

  • SHA256

    8c1494324b16d21b292092e16dbfd1b0eede82d011042fdacff08fac625d16d6

  • SHA512

    0340fb4e242290b7ac9e615ba3272c68347917b038722fc2b2a461409db64737cfe62492a60ef2cb1e9e7a23d4654ed85fee38e1666d5a33ebd941aa89458c27

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      order.exe

    • Size

      567KB

    • MD5

      b0ce010716323d34b03daa2f592cb81d

    • SHA1

      e78001665ca3104eb1f454253a848695c6416d87

    • SHA256

      ff84f400d92cb8c48598d1be818b9611a5342cb3b41535cbad619393be384898

    • SHA512

      4b872cb4c396d77b69cea96e0e06bff1b284d69b560fbe9da936bae336961df42869aa495c99318e022117df5e996d1867b9c4dfed402239e0dd4a24e74964de

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks