Overview

overview

10

Static

static

957da2adfa...60.exe

windows7-x64

8

957da2adfa...60.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960

  • Size

    1.9MB

  • Sample

    221128-wwyewsah7x

  • MD5

    ec6e22899512d507a32cadda8e8af406

  • SHA1

    2957180a107a7ab59491bad0d840cfc9ba9d7aaf

  • SHA256

    957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960

  • SHA512

    a398bdad1a4a4d0b46d62b34d24a78f6520a5967b9d3f8324b1c2329d234e9ad383f402051e42e813247e4ea7bdc3477dfb49c09c491448a280cc88877878c9a

  • SSDEEP

    49152:AkSXhixEgCOWoNGglFS5h2HKFoqv9kq23p+zY15kFm53Sy9:vSRii5HoGSSaHMoOY15kFm5Z

Score
10/10
hawkeyeevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960

    • Size

      1.9MB

    • MD5

      ec6e22899512d507a32cadda8e8af406

    • SHA1

      2957180a107a7ab59491bad0d840cfc9ba9d7aaf

    • SHA256

      957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960

    • SHA512

      a398bdad1a4a4d0b46d62b34d24a78f6520a5967b9d3f8324b1c2329d234e9ad383f402051e42e813247e4ea7bdc3477dfb49c09c491448a280cc88877878c9a

    • SSDEEP

      49152:AkSXhixEgCOWoNGglFS5h2HKFoqv9kq23p+zY15kFm53Sy9:vSRii5HoGSSaHMoOY15kFm5Z

    Score
    10/10
    evasionpersistencetrojanhawkeyekeyloggerspywarestealer

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks