General

  • Target

    1e8e6f88ce12c19d32afdf11cfa7206a2305151f0d2ee38b6a9d4d0719c624fc

  • Size

    996KB

  • Sample

    221128-xd5xpagd77

  • MD5

    899fdaf04ef5664cc5721b30b97f6c64

  • SHA1

    82598112977508e1129cfea324a1c629daaaf247

  • SHA256

    1e8e6f88ce12c19d32afdf11cfa7206a2305151f0d2ee38b6a9d4d0719c624fc

  • SHA512

    b0e864889e48275c5813da268da1d3f474c58ded0be6df8877092dc00f11b4d4e92d3f9a59831100b4ed1649b94802cfb07777fa266c17242cc21d77ca9a6c7b

  • SSDEEP

    24576:N7oFlUloumgTWXpAeh2tIgLxrtO4M41HBjyLqj75lC:FiUGumhpAehOIAr44dhjyLqBQ

Malware Config

Targets

    • Target

      1e8e6f88ce12c19d32afdf11cfa7206a2305151f0d2ee38b6a9d4d0719c624fc

    • Size

      996KB

    • MD5

      899fdaf04ef5664cc5721b30b97f6c64

    • SHA1

      82598112977508e1129cfea324a1c629daaaf247

    • SHA256

      1e8e6f88ce12c19d32afdf11cfa7206a2305151f0d2ee38b6a9d4d0719c624fc

    • SHA512

      b0e864889e48275c5813da268da1d3f474c58ded0be6df8877092dc00f11b4d4e92d3f9a59831100b4ed1649b94802cfb07777fa266c17242cc21d77ca9a6c7b

    • SSDEEP

      24576:N7oFlUloumgTWXpAeh2tIgLxrtO4M41HBjyLqj75lC:FiUGumhpAehOIAr44dhjyLqBQ

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads local data of messenger clients

      Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Defense Evasion

Scripting

1
T1064

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Email Collection

1
T1114

Tasks