Overview

overview

10

Static

static

c688c25051...aa.exe

windows7-x64

10

c688c25051...aa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c688c2505169d359e57b9ec1b029611cea1562cbf1d049a57af88aa84401a0aa

  • Size

    1.5MB

  • Sample

    221127-mpb4msee31

  • MD5

    9c06c80423ac3262799758876f2f6d29

  • SHA1

    ee9ab92f62d1f7b514e93682084a36d4a3ae89d1

  • SHA256

    c688c2505169d359e57b9ec1b029611cea1562cbf1d049a57af88aa84401a0aa

  • SHA512

    bebf01928b866dc70d67de2fa5cf7f7ae288df0743098247454bd26cd8da156295417b9453bdad98f4909c3d94a9886e53cc04d36a65a84dbc2c20b93472bf89

  • SSDEEP

    24576:umYD1se/oFeAgAI/y8YsAm85tKgB68IU86OpjY3g2+rKQfzFsFfknVPpeEtjYF+H:A/oFxI/cw8P1sjfHrHzFLjl

Score
10/10
hawkeyecollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    fredman1800

Targets

    • Target

      c688c2505169d359e57b9ec1b029611cea1562cbf1d049a57af88aa84401a0aa

    • Size

      1.5MB

    • MD5

      9c06c80423ac3262799758876f2f6d29

    • SHA1

      ee9ab92f62d1f7b514e93682084a36d4a3ae89d1

    • SHA256

      c688c2505169d359e57b9ec1b029611cea1562cbf1d049a57af88aa84401a0aa

    • SHA512

      bebf01928b866dc70d67de2fa5cf7f7ae288df0743098247454bd26cd8da156295417b9453bdad98f4909c3d94a9886e53cc04d36a65a84dbc2c20b93472bf89

    • SSDEEP

      24576:umYD1se/oFeAgAI/y8YsAm85tKgB68IU86OpjY3g2+rKQfzFsFfknVPpeEtjYF+H:A/oFxI/cw8P1sjfHrHzFLjl

    Score
    10/10
    hawkeyecollectionkeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks