hawkeye | 393dd5ffc714dfbdbf893efac1551d74abdab2833cc0844e4206846ce07db2e0 | Triage

Submit
Reports

Overview

overview

Static

static

393dd5ffc7...e0.exe

windows7-x64

393dd5ffc7...e0.exe

windows10-2004-x64

Sharing

General

Target

393dd5ffc714dfbdbf893efac1551d74abdab2833cc0844e4206846ce07db2e0
Size

859KB
Sample

221122-xpqbdadg28
MD5

8cce16d51672abd5bfdf9696f9c887da
SHA1

0d06202b2e1d7b178b0e89bc9da8d9cd16985787
SHA256

393dd5ffc714dfbdbf893efac1551d74abdab2833cc0844e4206846ce07db2e0
SHA512

7b83bfad7be0ceef276c7e5585eed81fbf1ff41168704dfdf9b0200bfbb865df724a7234464eba48b7ba053212258faefe7dd00e304cc678925c80b6b70c4c8f
SSDEEP

12288:rYlRQtqB5urTIoYWBQk1E+VF9mOx9Eimo:uRQtqBorTlYWBhE+V3mO

Score

10^/10

hawkeye collection keylogger spyware stealer trojan

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

393dd5ffc714dfbdbf893efac1551d74abdab2833cc0844e4206846ce07db2e0.exe

Resource

win7-20220901-en

hawkeye collection keylogger spyware stealer trojan

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

393dd5ffc714dfbdbf893efac1551d74abdab2833cc0844e4206846ce07db2e0.exe

Resource

win10v2004-20221111-en

hawkeye collection keylogger spyware stealer trojan

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  393dd5ffc714dfbdbf893efac1551d74abdab2833cc0844e4206846ce07db2e0
- Size
  
  859KB
- MD5
  
  8cce16d51672abd5bfdf9696f9c887da
- SHA1
  
  0d06202b2e1d7b178b0e89bc9da8d9cd16985787
- SHA256
  
  393dd5ffc714dfbdbf893efac1551d74abdab2833cc0844e4206846ce07db2e0
- SHA512
  
  7b83bfad7be0ceef276c7e5585eed81fbf1ff41168704dfdf9b0200bfbb865df724a7234464eba48b7ba053212258faefe7dd00e304cc678925c80b6b70c4c8f
- SSDEEP
  
  12288:rYlRQtqB5urTIoYWBQk1E+VF9mOx9Eimo:uRQtqBorTlYWBhE+V3mO
Score

10^/10

hawkeye collection keylogger spyware stealer trojan
- HawkEye
  HawkEye is a malware kit that has seen continuous development since at least 2013.
  keylogger trojan stealer spyware hawkeye
- NirSoft MailPassView
  Password recovery tool for various email clients
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- Uses the VBS compiler for execution
- Accesses Microsoft Outlook accounts
  collection
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

Persistence

Privilege Escalation

Defense Evasion

Scripting

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hawkeyecollectionkeyloggerspywarestealertrojan

behavioral2

hawkeyecollectionkeyloggerspywarestealertrojan

© 2018-2024

Terms | Privacy