Overview

overview

10

Static

static

2a2b9a3b16...7c.exe

windows7-x64

10

2a2b9a3b16...7c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2a2b9a3b16a34ffad6f86d00345e0f15d7a2fe4b17f15c8fac890833ba965b7c

  • Size

    558KB

  • Sample

    221126-2v2c2seg4y

  • MD5

    f1133ee0e7ec614d3864a8e52b44bb3b

  • SHA1

    2f24924bca53bc0377717f2966d8d948ee71a256

  • SHA256

    2a2b9a3b16a34ffad6f86d00345e0f15d7a2fe4b17f15c8fac890833ba965b7c

  • SHA512

    0da38a197e820985607b43dae5b033e28529ff4db4a3013b511a34e2d16c418ef5bba3fe3e2a494c3c20598dfab1afd333d1aeea980e981d17be59127b3e8150

  • SSDEEP

    12288:zATMTKNEKa21c1KK//PihgMgwv6IPywbUo6o0sv3rqY+thql5/Ad344mVu:zeMwbJ1c3/nihgMgwkwgnYzh

Score
10/10
hawkeyecollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    qwerty@12345

Targets

    • Target

      2a2b9a3b16a34ffad6f86d00345e0f15d7a2fe4b17f15c8fac890833ba965b7c

    • Size

      558KB

    • MD5

      f1133ee0e7ec614d3864a8e52b44bb3b

    • SHA1

      2f24924bca53bc0377717f2966d8d948ee71a256

    • SHA256

      2a2b9a3b16a34ffad6f86d00345e0f15d7a2fe4b17f15c8fac890833ba965b7c

    • SHA512

      0da38a197e820985607b43dae5b033e28529ff4db4a3013b511a34e2d16c418ef5bba3fe3e2a494c3c20598dfab1afd333d1aeea980e981d17be59127b3e8150

    • SSDEEP

      12288:zATMTKNEKa21c1KK//PihgMgwv6IPywbUo6o0sv3rqY+thql5/Ad344mVu:zeMwbJ1c3/nihgMgwkwgnYzh

    Score
    10/10
    hawkeyecollectionkeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Modifies WinLogon for persistence

      persistence

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Winlogon Helper DLL

1
T1004

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks