Overview

overview

10

Static

static

5

dde6428391...08.exe

windows7_x64

10

dde6428391...08.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dde64283919a0f55d651fd0d2382728c0c26afd8efa81be3c6ca85f863ba3d08

  • Size

    1.9MB

  • Sample

    220701-epdy8sbdbk

  • MD5

    589b3749e7279e109b1ae87eb409454e

  • SHA1

    672d90b2288578769c8930f807a7b741d47cb0ac

  • SHA256

    dde64283919a0f55d651fd0d2382728c0c26afd8efa81be3c6ca85f863ba3d08

  • SHA512

    428d82e88207a06584aa9c7cc6457c5358116a680cd0f786477c54ab3256f3334c529e907036a8c2071418a2544e38cf0fa4e0ed80b5bb27d948d8ed848f0d57

Score
10/10
hawkeyecollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    204@goldsmiths-uk.com
  • Password:
    QWERTY123@@##

Targets

    • Target

      dde64283919a0f55d651fd0d2382728c0c26afd8efa81be3c6ca85f863ba3d08

    • Size

      1.9MB

    • MD5

      589b3749e7279e109b1ae87eb409454e

    • SHA1

      672d90b2288578769c8930f807a7b741d47cb0ac

    • SHA256

      dde64283919a0f55d651fd0d2382728c0c26afd8efa81be3c6ca85f863ba3d08

    • SHA512

      428d82e88207a06584aa9c7cc6457c5358116a680cd0f786477c54ab3256f3334c529e907036a8c2071418a2544e38cf0fa4e0ed80b5bb27d948d8ed848f0d57

    Score
    10/10
    hawkeyecollectionkeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks