Overview

overview

10

Static

static

48a4c9c13b...69.exe

windows7_x64

10

48a4c9c13b...69.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    48a4c9c13b2611401fc3b4041f6383591ced4990afd44ef11b3491b52b5ccc69

  • Size

    1.2MB

  • Sample

    220714-cs1lasheak

  • MD5

    62fd68d0b6c7b628fc1688a74f5a812e

  • SHA1

    0b20f1242605bd33de07c10cb950daa35502c2ef

  • SHA256

    48a4c9c13b2611401fc3b4041f6383591ced4990afd44ef11b3491b52b5ccc69

  • SHA512

    6debd7cd91fd9666e4ed6129f011586d1b9f0500afc95f683cff472e31a334cd9080d4b5c2a8058cbd3b32ceb40fb5c42510e3c13524fc9d586ca9ca1b805291

Score
10/10
hawkeyecollectionevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      48a4c9c13b2611401fc3b4041f6383591ced4990afd44ef11b3491b52b5ccc69

    • Size

      1.2MB

    • MD5

      62fd68d0b6c7b628fc1688a74f5a812e

    • SHA1

      0b20f1242605bd33de07c10cb950daa35502c2ef

    • SHA256

      48a4c9c13b2611401fc3b4041f6383591ced4990afd44ef11b3491b52b5ccc69

    • SHA512

      6debd7cd91fd9666e4ed6129f011586d1b9f0500afc95f683cff472e31a334cd9080d4b5c2a8058cbd3b32ceb40fb5c42510e3c13524fc9d586ca9ca1b805291

    Score
    10/10
    hawkeyecollectionevasionkeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1
T1158

Modify Registry

2
T1112

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks