Overview

overview

10

Static

static

10

3cfcf600bc...83.exe

windows7-x64

10

3cfcf600bc...83.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3cfcf600bc33a221ffda8e4cf15920276e8ed61898b0af63c3aa10e365d5fd83

  • Size

    896KB

  • Sample

    221120-mv2aqaaa46

  • MD5

    f76142dfc872fbc7b82b38f6180bda9d

  • SHA1

    a76d132faa4b5ff28ad23a1b3557cf59b9b5ba45

  • SHA256

    3cfcf600bc33a221ffda8e4cf15920276e8ed61898b0af63c3aa10e365d5fd83

  • SHA512

    7ae7973fb7bdf8a9d3f2e14a7b46e5dee97590251cd3a3250d1c84e861a5717ee222ba59410f88d8b383594ce86288a7fe005f4865673caa63888833bc052d07

  • SSDEEP

    24576:tQtqBorTlYWBhE+V3mOikWtlFrrClWmAUJnfvy8:+tqFWM4mdvS5Xt

Score
10/10
hawkeyecollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      3cfcf600bc33a221ffda8e4cf15920276e8ed61898b0af63c3aa10e365d5fd83

    • Size

      896KB

    • MD5

      f76142dfc872fbc7b82b38f6180bda9d

    • SHA1

      a76d132faa4b5ff28ad23a1b3557cf59b9b5ba45

    • SHA256

      3cfcf600bc33a221ffda8e4cf15920276e8ed61898b0af63c3aa10e365d5fd83

    • SHA512

      7ae7973fb7bdf8a9d3f2e14a7b46e5dee97590251cd3a3250d1c84e861a5717ee222ba59410f88d8b383594ce86288a7fe005f4865673caa63888833bc052d07

    • SSDEEP

      24576:tQtqBorTlYWBhE+V3mOikWtlFrrClWmAUJnfvy8:+tqFWM4mdvS5Xt

    Score
    10/10
    hawkeyecollectionkeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks