Overview

overview

10

Static

static

b32111e5b6...67.exe

windows7-x64

10

b32111e5b6...67.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26-11-2022 22:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b32111e5b612a5624bcab89bd286053c2b0a13cabac1f4d3ab377fe6f6341e67.exe

  • Size

    876KB

  • MD5

    3a73367a66682aaddb521b26bdd88b61

  • SHA1

    ba19af066ce4862279801d75fa217edf3b033624

  • SHA256

    b32111e5b612a5624bcab89bd286053c2b0a13cabac1f4d3ab377fe6f6341e67

  • SHA512

    e2eae210b00f380b8d1a8f7f867bfc06119aed466eee13ac83790475676d3c0fb4ff24d2d11cb273f227428a9d024b36f210b52567be8c3c2223257bb8455399

  • SSDEEP

    24576:t2g/ksNECnkOT5qNSEkwNQd+SSqXNBWjIMvgk1Zlq:Ds6qNlkYQdTSks8MPA

Score
10/10
hawkeyekeyloggerpersistencespywarestealertrojan

Malware Config

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b32111e5b612a5624bcab89bd286053c2b0a13cabac1f4d3ab377fe6f6341e67.exe
    "C:\Users\Admin\AppData\Local\Temp\b32111e5b612a5624bcab89bd286053c2b0a13cabac1f4d3ab377fe6f6341e67.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
      2⤵
        PID:1456
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
        2⤵
          PID:1072

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scripting

      1
      T1064

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Privilege Escalation

      Defense Evasion

      Scripting

      1
      T1064

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1944-54-0x000007FEF33D0000-0x000007FEF3DF3000-memory.dmp
        Filesize

        10.1MB

        Download
      • memory/1944-55-0x000007FEF2330000-0x000007FEF33C6000-memory.dmp
        Filesize

        16.6MB

        Download
      • memory/1944-56-0x00000000020F6000-0x0000000002115000-memory.dmp
        Filesize

        124KB

        Download
      • memory/1944-57-0x00000000020F6000-0x0000000002115000-memory.dmp
        Filesize

        124KB

        Download