Overview

overview

10

Static

static

c1871e387e...d2.exe

windows7-x64

10

c1871e387e...d2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c1871e387ef16df81eb3d2f075434d631388d0182e345392b5d541690622ead2

  • Size

    1.6MB

  • Sample

    221128-sk614scf22

  • MD5

    ce886e11470f2c412bec92068e218dcc

  • SHA1

    7eee13f6ffd8c090ebf5b473157471bbd4777285

  • SHA256

    c1871e387ef16df81eb3d2f075434d631388d0182e345392b5d541690622ead2

  • SHA512

    9110fc420aad3e3cef60f26c5a27595c4b2b8cf8014796d290353230919095d8758426357af2632117b4fd64ec47ea9e684218cc005cfb4a73a4096385e5ea65

  • SSDEEP

    24576:Vs8heLI/N3XYyFa2SUq7XxmhrWBOmdjuhfU8H9/ZGim0dQDNYVnQQDOTgWy+y1:osx7aprxAWsmVC8Q9/4im0af4Og6

Score
10/10
hawkeyecollectionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.messagingengine.com
  • Port:
    587
  • Username:
    azarbaijJ@fastmail.com
  • Password:
    qedrks8q9hlo8up1ao7hrljvc7

Targets

    • Target

      c1871e387ef16df81eb3d2f075434d631388d0182e345392b5d541690622ead2

    • Size

      1.6MB

    • MD5

      ce886e11470f2c412bec92068e218dcc

    • SHA1

      7eee13f6ffd8c090ebf5b473157471bbd4777285

    • SHA256

      c1871e387ef16df81eb3d2f075434d631388d0182e345392b5d541690622ead2

    • SHA512

      9110fc420aad3e3cef60f26c5a27595c4b2b8cf8014796d290353230919095d8758426357af2632117b4fd64ec47ea9e684218cc005cfb4a73a4096385e5ea65

    • SSDEEP

      24576:Vs8heLI/N3XYyFa2SUq7XxmhrWBOmdjuhfU8H9/ZGim0dQDNYVnQQDOTgWy+y1:osx7aprxAWsmVC8Q9/4im0af4Og6

    Score
    10/10
    hawkeyecollectionkeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Modifies WinLogon for persistence

      persistence

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Drops desktop.ini file(s)

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Scripting

1
T1064

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks