Overview

overview

10

Static

static

Dettagli d...ne.exe

windows7_x64

10

Dettagli d...ne.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    169s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 11:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Dettagli di spedizione.exe

  • Size

    743KB

  • MD5

    4e6c88000d39ba9b2970a38c06ad8954

  • SHA1

    a445842a0c65c55517f0573f1b3acd0e5bfa6632

  • SHA256

    5b56965b3b01283c8ac5277021645a8c85c366e39c200d8bcb6869750dfc3100

  • SHA512

    1a6ddc38932fa2dd2f0d5bd64db2808331153f83b080b75f0c7b63311f10e5da009859034bc1ec5f2c737326bae6c66e3f510c4fa1d7e476a7e9c76acf39546f

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye
  • NirSoft MailPassView 5 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 9 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Dettagli di spedizione.exe
    "C:\Users\Admin\AppData\Local\Temp\Dettagli di spedizione.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:1120
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
          3⤵
          • Accesses Microsoft Outlook accounts
          PID:324
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
          3⤵
            PID:1884

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scripting

      1
      T1064

      Persistence

      Privilege Escalation

      Defense Evasion

      Scripting

      1
      T1064

      Credential Access

      Discovery

      Lateral Movement

      Collection

      Email Collection

      1
      T1114

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\holderwb.txt
        Filesize

        2B

        MD5

        f3b25701fe362ec84616a93a45ce9998

        SHA1

        d62636d8caec13f04e28442a0a6fa1afeb024bbb

        SHA256

        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

        SHA512

        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

        Download Submit
      • memory/324-63-0x0000000000400000-0x000000000041B000-memory.dmp
        Filesize

        108KB

        Download
      • memory/324-68-0x0000000000400000-0x000000000041B000-memory.dmp
        Filesize

        108KB

        Download
      • memory/324-67-0x0000000000400000-0x000000000041B000-memory.dmp
        Filesize

        108KB

        Download
      • memory/324-64-0x0000000000411654-mapping.dmp
        Download
      • memory/1772-58-0x0000000000480C5E-mapping.dmp
        Download
      • memory/1772-61-0x00000000045D5000-0x00000000045E6000-memory.dmp
        Filesize

        68KB

        Download
      • memory/1772-62-0x00000000005E0000-0x00000000005E8000-memory.dmp
        Filesize

        32KB

        Download
      • memory/1772-60-0x0000000000400000-0x0000000000488000-memory.dmp
        Filesize

        544KB

        Download
      • memory/1884-69-0x0000000000400000-0x0000000000458000-memory.dmp
        Filesize

        352KB

        Download
      • memory/1884-70-0x0000000000442628-mapping.dmp
        Download
      • memory/1884-73-0x0000000000400000-0x0000000000458000-memory.dmp
        Filesize

        352KB

        Download
      • memory/1884-75-0x0000000000400000-0x0000000000458000-memory.dmp
        Filesize

        352KB

        Download
      • memory/2020-54-0x0000000001130000-0x00000000011F0000-memory.dmp
        Filesize

        768KB

        Download
      • memory/2020-57-0x0000000000270000-0x0000000000273000-memory.dmp
        Filesize

        12KB

        Download
      • memory/2020-56-0x00000000755C1000-0x00000000755C3000-memory.dmp
        Filesize

        8KB

        Download
      • memory/2020-55-0x00000000045F0000-0x0000000004680000-memory.dmp
        Filesize

        576KB

        Download