General

  • Target

    934034130a3e5900b95896b58f0d75cf98216ada0b150a7e885fad944bd1fc22

  • Size

    1.0MB

  • Sample

    221127-q67hnafh5t

  • MD5

    f5d39ed2c191f84c4372f79dde6a7b72

  • SHA1

    b50c2df32fb0d5e182f60394f88f46c82cf78385

  • SHA256

    934034130a3e5900b95896b58f0d75cf98216ada0b150a7e885fad944bd1fc22

  • SHA512

    27e14414e5f14276901d1752d4d37bd44a469a1ef3ca1e0d46eda9dbd123cc740921ac964c8ff19a8a1743d48c472533008b4d3e216d23614998be0f7e842421

  • SSDEEP

    24576:XpxAowehmvjCv/WerTUET2pHwBn/kznW7iGA9fmpiQQKrP2NAkiVtfO:XpLXmbCvuerTNT2pHwB/kzOA9epixKrU

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    ziltomark0godwll@gmail.com
  • Password:
    chrisdon00

Targets

    • Target

      934034130a3e5900b95896b58f0d75cf98216ada0b150a7e885fad944bd1fc22

    • Size

      1.0MB

    • MD5

      f5d39ed2c191f84c4372f79dde6a7b72

    • SHA1

      b50c2df32fb0d5e182f60394f88f46c82cf78385

    • SHA256

      934034130a3e5900b95896b58f0d75cf98216ada0b150a7e885fad944bd1fc22

    • SHA512

      27e14414e5f14276901d1752d4d37bd44a469a1ef3ca1e0d46eda9dbd123cc740921ac964c8ff19a8a1743d48c472533008b4d3e216d23614998be0f7e842421

    • SSDEEP

      24576:XpxAowehmvjCv/WerTUET2pHwBn/kznW7iGA9fmpiQQKrP2NAkiVtfO:XpLXmbCvuerTNT2pHwB/kzOA9epixKrU

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks