Overview

overview

10

Static

static

c7a031bef2...a1.exe

windows7-x64

9

c7a031bef2...a1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c7a031bef2ac15aa01c894dfcb84c5047accd3104888f5330caf6e804c7214a1

  • Size

    996KB

  • Sample

    221126-nq6v3sbe45

  • MD5

    d2c1719e80486b2fe9ff7c4165782bb6

  • SHA1

    ca9e49a14b42db46a3c0c0e6f8f56ee9eeb2fd3b

  • SHA256

    c7a031bef2ac15aa01c894dfcb84c5047accd3104888f5330caf6e804c7214a1

  • SHA512

    a3b8502d24bb563f2f5c2a8e37d47547446e8e03a84a6db142f9d139db1a3683eca7576c768326b2224d96cfcf766322148a82e043c860e4743d2d01e7d2071f

  • SSDEEP

    24576:1o4mISIfX5OqZ5YtIHaYX1BWQdfvLPFJ45:wISoZ4IHBfWqHw

Score
10/10
hawkeyecollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      c7a031bef2ac15aa01c894dfcb84c5047accd3104888f5330caf6e804c7214a1

    • Size

      996KB

    • MD5

      d2c1719e80486b2fe9ff7c4165782bb6

    • SHA1

      ca9e49a14b42db46a3c0c0e6f8f56ee9eeb2fd3b

    • SHA256

      c7a031bef2ac15aa01c894dfcb84c5047accd3104888f5330caf6e804c7214a1

    • SHA512

      a3b8502d24bb563f2f5c2a8e37d47547446e8e03a84a6db142f9d139db1a3683eca7576c768326b2224d96cfcf766322148a82e043c860e4743d2d01e7d2071f

    • SSDEEP

      24576:1o4mISIfX5OqZ5YtIHaYX1BWQdfvLPFJ45:wISoZ4IHBfWqHw

    Score
    10/10
    persistencehawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks