Overview

overview

10

Static

static

10

4f9f1934dd...69.exe

windows7-x64

10

4f9f1934dd...69.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4f9f1934dda720b8af44a52ad1b0b3db6c5ed324e051b65718ce75da79f57569

  • Size

    569KB

  • Sample

    221128-nsejlsah58

  • MD5

    0eab2d9bc5d399eea1b7226ef901b7f9

  • SHA1

    ef85ad30b9a0cb932594d55dc167df302735e980

  • SHA256

    4f9f1934dda720b8af44a52ad1b0b3db6c5ed324e051b65718ce75da79f57569

  • SHA512

    54b60964740f291ffae09053f77227873c707227274625e1b773f85ab727694f51bf47bfc67ecaf420bd4c0b3286ff75555d4ea31aeab4e7e3c61e23c21e13d3

  • SSDEEP

    6144:N8bS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9zHk0:mQtqB5urTIoYWBQk1E+VF9mOx9Q0

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Targets

    • Target

      4f9f1934dda720b8af44a52ad1b0b3db6c5ed324e051b65718ce75da79f57569

    • Size

      569KB

    • MD5

      0eab2d9bc5d399eea1b7226ef901b7f9

    • SHA1

      ef85ad30b9a0cb932594d55dc167df302735e980

    • SHA256

      4f9f1934dda720b8af44a52ad1b0b3db6c5ed324e051b65718ce75da79f57569

    • SHA512

      54b60964740f291ffae09053f77227873c707227274625e1b773f85ab727694f51bf47bfc67ecaf420bd4c0b3286ff75555d4ea31aeab4e7e3c61e23c21e13d3

    • SSDEEP

      6144:N8bS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9zHk0:mQtqB5urTIoYWBQk1E+VF9mOx9Q0

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks