General

  • Target

    e8743f06f20025a2c408dd712d19633b928dcbb13695f408560cc2ad5cf27662

  • Size

    1MB

  • Sample

    221002-2pb6zafchq

  • MD5

    6f2a786616e936353f9c3e1f35e01730

  • SHA1

    9b9830459bef6aa5ec292cbf17be4cd72e409ecd

  • SHA256

    e8743f06f20025a2c408dd712d19633b928dcbb13695f408560cc2ad5cf27662

  • SHA512

    65db97646eb8522ce5509d24121eadba5e449d140828038de2034d65a5f7e5dd97813368f04e8500485de9bf6dedc5bc8abf9e6bda327085a5e625d4aa36666f

  • SSDEEP

    24576:72O/GlARmF/w0dR4gptEUf0mfnV6ct7Yn7AMkycLTpppShFJ:g/w0LJIS0fn9/qTpqLJ

Malware Config

Targets

    • Target

      e8743f06f20025a2c408dd712d19633b928dcbb13695f408560cc2ad5cf27662

    • Size

      1MB

    • MD5

      6f2a786616e936353f9c3e1f35e01730

    • SHA1

      9b9830459bef6aa5ec292cbf17be4cd72e409ecd

    • SHA256

      e8743f06f20025a2c408dd712d19633b928dcbb13695f408560cc2ad5cf27662

    • SHA512

      65db97646eb8522ce5509d24121eadba5e449d140828038de2034d65a5f7e5dd97813368f04e8500485de9bf6dedc5bc8abf9e6bda327085a5e625d4aa36666f

    • SSDEEP

      24576:72O/GlARmF/w0dR4gptEUf0mfnV6ct7Yn7AMkycLTpppShFJ:g/w0LJIS0fn9/qTpqLJ

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Email Collection

1
T1114

Tasks