Overview

overview

10

Static

static

1f678d0c4b...a4.exe

windows7-x64

10

1f678d0c4b...a4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2022 01:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    1f678d0c4b5990486f085f468820c427461a7f3a60f9909b19775d6950b967a4.exe

  • Size

    601KB

  • MD5

    505ad36196d531d69ddd25d7a6fa89f0

  • SHA1

    8fe9dddb87b01531212c2b893d55b7fd67eaf6d8

  • SHA256

    1f678d0c4b5990486f085f468820c427461a7f3a60f9909b19775d6950b967a4

  • SHA512

    06f30ecb334e28960de41b8f4071932f17e5a88cd80fe2b25d374b0f9bd76a0f8e68bea12dffea3550d86795ed62aa3bbed4514c40a86e3f5031a6c971ae318e

  • SSDEEP

    12288:0eQRGw4W1xZ++u9YixSRsGFV4ljdw8h2qCEkT:0bRG/W1xZ+J9pSCM4lJ

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    crissunslogs@gmail.com
  • Password:
    samsung05@@@

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f678d0c4b5990486f085f468820c427461a7f3a60f9909b19775d6950b967a4.exe
    "C:\Users\Admin\AppData\Local\Temp\1f678d0c4b5990486f085f468820c427461a7f3a60f9909b19775d6950b967a4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
      2⤵
      • Accesses Microsoft Outlook accounts
      • Suspicious use of AdjustPrivilegeToken
      PID:1440
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

2
T1081

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\holdermail.txt
    Filesize

    271B

    MD5

    a18df529a77ed1fbd887400151b9728f

    SHA1

    74912cb5e97566749ccae5f70e52ee87cb4dfa07

    SHA256

    599ceb2fab753551e7b27340cd3a9d2eb44a887dfb178d1c05015159bb352eb3

    SHA512

    a446e30992bc63b53952982e06069555e9b65eb25274495470d4410a04bcc9aeaa96b95300fc89512181e0614abf279f439b52f32ffc6ffb3034230c97aa08b0

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\holdermail.txt
    Filesize

    327B

    MD5

    e4f3273432f9167e5f8bd2048206773d

    SHA1

    139b6566c6f8c6a359dd7e6063f88be24f701c8d

    SHA256

    b620b529c43ed1dab8db9c63b402958e1a0b65c9110029b92ac8ae2c21c0acb2

    SHA512

    e1bf722b627cd5f1e1678549d51f9556a1d31c8e5f47dfbe343c81aef7bac279ca2b062751666d650b2c196785a84b0d2edca09d1a04b829f4ae869e513e6941

    Download Submit
  • memory/1440-135-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

    Download
  • memory/1440-136-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

    Download
  • memory/1440-137-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

    Download
  • memory/1440-134-0x0000000000000000-mapping.dmp
    Download
  • memory/1440-139-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

    Download
  • memory/3520-140-0x0000000000000000-mapping.dmp
    Download
  • memory/3520-141-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB

    Download
  • memory/3520-142-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB

    Download
  • memory/3520-143-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB

    Download
  • memory/3520-144-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB

    Download
  • memory/3520-146-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB

    Download
  • memory/4976-132-0x0000000075510000-0x0000000075AC1000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/4976-133-0x0000000075510000-0x0000000075AC1000-memory.dmp
    Filesize

    5.7MB

    Download