Overview

overview

10

Static

static

Dettagli d...ne.exe

windows7_x64

10

Dettagli d...ne.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    152s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 11:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Dettagli di spedizione.exe

  • Size

    743KB

  • MD5

    4e6c88000d39ba9b2970a38c06ad8954

  • SHA1

    a445842a0c65c55517f0573f1b3acd0e5bfa6632

  • SHA256

    5b56965b3b01283c8ac5277021645a8c85c366e39c200d8bcb6869750dfc3100

  • SHA512

    1a6ddc38932fa2dd2f0d5bd64db2808331153f83b080b75f0c7b63311f10e5da009859034bc1ec5f2c737326bae6c66e3f510c4fa1d7e476a7e9c76acf39546f

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye
  • NirSoft MailPassView 5 IoCs

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView 5 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 9 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Dettagli di spedizione.exe
    "C:\Users\Admin\AppData\Local\Temp\Dettagli di spedizione.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2260
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4068
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
          3⤵
          • Accesses Microsoft Outlook accounts
          PID:2580
        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
          C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
          3⤵
            PID:3364

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scripting

      1
      T1064

      Persistence

      Privilege Escalation

      Defense Evasion

      Scripting

      1
      T1064

      Credential Access

      Discovery

      Lateral Movement

      Collection

      Email Collection

      1
      T1114

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\holderwb.txt
        Filesize

        3KB

        MD5

        f94dc819ca773f1e3cb27abbc9e7fa27

        SHA1

        9a7700efadc5ea09ab288544ef1e3cd876255086

        SHA256

        a3377ade83786c2bdff5db19ff4dbfd796da4312402b5e77c4c63e38cc6eff92

        SHA512

        72a2c10d7a53a7f9a319dab66d77ed65639e9aa885b551e0055fc7eaf6ef33bbf109205b42ae11555a0f292563914bc6edb63b310c6f9bda9564095f77ab9196

        Download Submit
      • memory/1528-132-0x00000000026A0000-0x00000000026A3000-memory.dmp
        Filesize

        12KB

        Download
      • memory/1528-130-0x00000000001E0000-0x00000000002A0000-memory.dmp
        Filesize

        768KB

        Download
      • memory/2580-141-0x0000000000400000-0x000000000041B000-memory.dmp
        Filesize

        108KB

        Download
      • memory/2580-144-0x0000000000400000-0x000000000041B000-memory.dmp
        Filesize

        108KB

        Download
      • memory/2580-143-0x0000000000400000-0x000000000041B000-memory.dmp
        Filesize

        108KB

        Download
      • memory/2580-140-0x0000000000000000-mapping.dmp
        Download
      • memory/3364-149-0x0000000000400000-0x0000000000458000-memory.dmp
        Filesize

        352KB

        Download
      • memory/3364-148-0x0000000000400000-0x0000000000458000-memory.dmp
        Filesize

        352KB

        Download
      • memory/3364-146-0x0000000000400000-0x0000000000458000-memory.dmp
        Filesize

        352KB

        Download
      • memory/3364-145-0x0000000000000000-mapping.dmp
        Download
      • memory/4068-134-0x0000000005840000-0x00000000058DC000-memory.dmp
        Filesize

        624KB

        Download
      • memory/4068-139-0x0000000008AB0000-0x0000000008B16000-memory.dmp
        Filesize

        408KB

        Download
      • memory/4068-138-0x0000000005B90000-0x0000000005BE6000-memory.dmp
        Filesize

        344KB

        Download
      • memory/4068-137-0x00000000058F0000-0x00000000058FA000-memory.dmp
        Filesize

        40KB

        Download
      • memory/4068-136-0x00000000059A0000-0x0000000005A32000-memory.dmp
        Filesize

        584KB

        Download
      • memory/4068-135-0x0000000005F50000-0x00000000064F4000-memory.dmp
        Filesize

        5.6MB

        Download
      • memory/4068-133-0x0000000000400000-0x0000000000488000-memory.dmp
        Filesize

        544KB

        Download
      • memory/4068-131-0x0000000000000000-mapping.dmp
        Download