Overview

overview

10

Static

static

023ed4c6a3...5c.exe

windows7-x64

10

023ed4c6a3...5c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    023ed4c6a3c1e447ab1e9dcb77e3f92fcf1d301807dc50d8b99c9c0d1f5fe75c

  • Size

    578KB

  • Sample

    221123-sgegpaec61

  • MD5

    b2bc5759658ec717ac220e2c5bc46304

  • SHA1

    c1b00f497f43119b05eee945dc103f07771c239f

  • SHA256

    023ed4c6a3c1e447ab1e9dcb77e3f92fcf1d301807dc50d8b99c9c0d1f5fe75c

  • SHA512

    00fc98a05ff560e39284c5698e390417a143abebfe798347b926f9c265e210ead3d54c7bbf5296c39bbd23bf066c367fadb53380783d12c395f00d25c4d78210

  • SSDEEP

    12288:rojqg62FocmT9OVifV6klMS55Fs9cx6WOldvwrAADA8a:8e8mSiU+F5W9cROlWAADA

Score
10/10
hawkeyecollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      023ed4c6a3c1e447ab1e9dcb77e3f92fcf1d301807dc50d8b99c9c0d1f5fe75c

    • Size

      578KB

    • MD5

      b2bc5759658ec717ac220e2c5bc46304

    • SHA1

      c1b00f497f43119b05eee945dc103f07771c239f

    • SHA256

      023ed4c6a3c1e447ab1e9dcb77e3f92fcf1d301807dc50d8b99c9c0d1f5fe75c

    • SHA512

      00fc98a05ff560e39284c5698e390417a143abebfe798347b926f9c265e210ead3d54c7bbf5296c39bbd23bf066c367fadb53380783d12c395f00d25c4d78210

    • SSDEEP

      12288:rojqg62FocmT9OVifV6klMS55Fs9cx6WOldvwrAADA8a:8e8mSiU+F5W9cROlWAADA

    Score
    10/10
    hawkeyecollectionkeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks