Overview

overview

10

Static

static

c79b004698...f5.exe

windows7-x64

10

c79b004698...f5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c79b0046980dd30895a73e4ffd522d782eea0c6175df8a355f43ba131a5962f5

  • Size

    452KB

  • Sample

    221127-qeecssac34

  • MD5

    ae552c0bbf208d615c3cb4f2719e398b

  • SHA1

    bd537ad662084243c3df1d93b16d30b2a42532ab

  • SHA256

    c79b0046980dd30895a73e4ffd522d782eea0c6175df8a355f43ba131a5962f5

  • SHA512

    97b4a0408b18cbd8596eb47cd0c12a6ebc7e7d178b792b0fe4989847b12128eddbdac4e61020b83821abcac540dae186e5140e51658bf333386e9b94c5446780

  • SSDEEP

    12288:fsPMMzKMfKHjcprHaMfQE9PRUURqU7rAPawZCtD:IMMzKMOcfLdCURj/UO

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      c79b0046980dd30895a73e4ffd522d782eea0c6175df8a355f43ba131a5962f5

    • Size

      452KB

    • MD5

      ae552c0bbf208d615c3cb4f2719e398b

    • SHA1

      bd537ad662084243c3df1d93b16d30b2a42532ab

    • SHA256

      c79b0046980dd30895a73e4ffd522d782eea0c6175df8a355f43ba131a5962f5

    • SHA512

      97b4a0408b18cbd8596eb47cd0c12a6ebc7e7d178b792b0fe4989847b12128eddbdac4e61020b83821abcac540dae186e5140e51658bf333386e9b94c5446780

    • SSDEEP

      12288:fsPMMzKMfKHjcprHaMfQE9PRUURqU7rAPawZCtD:IMMzKMOcfLdCURj/UO

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks