Overview

overview

10

Static

static

541708b2d0...19.exe

windows7-x64

10

541708b2d0...19.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    541708b2d05295e5bda002af6b944acbd5f817f9da1b4c21cc55a90630246719

  • Size

    960KB

  • Sample

    221128-trdhtaca2x

  • MD5

    4ba9ff99b0d92aeafb2965fa4c534bed

  • SHA1

    6aacab210def98ab002772997af5a19eeaa197d0

  • SHA256

    541708b2d05295e5bda002af6b944acbd5f817f9da1b4c21cc55a90630246719

  • SHA512

    8c6e00e5bcaa55a261d6684143ad57c397998fd56220c279ccb8d3491b3482412edaa49da431642dc9d3fbb342e9705132b01225bc7a44c3a646f1811865edb7

  • SSDEEP

    24576:BrgtIpmgeTJxQ9iANfstRiepw+6oONZqN:Brgtdt69H4Riepw+6Bj

Score
10/10
hawkeyecollectionkeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    delogga@gmail.com
  • Password:
    mocxcefaktgkceun

Targets

    • Target

      541708b2d05295e5bda002af6b944acbd5f817f9da1b4c21cc55a90630246719

    • Size

      960KB

    • MD5

      4ba9ff99b0d92aeafb2965fa4c534bed

    • SHA1

      6aacab210def98ab002772997af5a19eeaa197d0

    • SHA256

      541708b2d05295e5bda002af6b944acbd5f817f9da1b4c21cc55a90630246719

    • SHA512

      8c6e00e5bcaa55a261d6684143ad57c397998fd56220c279ccb8d3491b3482412edaa49da431642dc9d3fbb342e9705132b01225bc7a44c3a646f1811865edb7

    • SSDEEP

      24576:BrgtIpmgeTJxQ9iANfstRiepw+6oONZqN:Brgtdt69H4Riepw+6Bj

    Score
    10/10
    hawkeyecollectionkeyloggerspywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks