Overview

overview

10

Static

static

cdb39fc581...1a.exe

windows7-x64

10

cdb39fc581...1a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    154s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2022 21:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a.exe

  • Size

    205KB

  • MD5

    7b0685897c65b060494c91b0b701fa71

  • SHA1

    4f597320790d71cf000e4b03dcae8a11b6946410

  • SHA256

    cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a

  • SHA512

    17e1e8821eec0c8aeb70551d833c0afc9805543997f98cd4430a254e2d51ca9b710a252fabc2d35beb4c338972955d4393e011f56dcf661f4526cce2796df197

  • SSDEEP

    6144:WSIWTqzmgoJlS5Oz4BS9sqLFuV8hHaB+:Wi4mgoJlS5OsGQ8

Score
10/10
hawkeyekeyloggerspywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    bozoveleye@gmail.com
  • Password:
    iyikalpli_3303

Signatures

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a.exe
    "C:\Users\Admin\AppData\Local\Temp\cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:936
    • C:\Users\Admin\AppData\Roaming\Windows Update.exe
      "C:\Users\Admin\AppData\Roaming\Windows Update.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

3
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SysInfo.txt
    Filesize

    102B

    MD5

    e6767e3c7681fdcca1e5600415fecf77

    SHA1

    14d9453abb2c7626099489adae2dc01cd1008a20

    SHA256

    d391b2c64d86d0c4614bc0459a651bed7b1b3f1eebfeff6335a1e8a98958ed13

    SHA512

    096056807259133f451a83f4e7a6944e4f5d27fe1a0d783791a2b36c9dd13ade5d93b9d2be9bdef4d9fbffdf9bff17c438b0aa807daa3b8a35212f35ab61a3e3

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Windows Update.exe
    Filesize

    205KB

    MD5

    7b0685897c65b060494c91b0b701fa71

    SHA1

    4f597320790d71cf000e4b03dcae8a11b6946410

    SHA256

    cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a

    SHA512

    17e1e8821eec0c8aeb70551d833c0afc9805543997f98cd4430a254e2d51ca9b710a252fabc2d35beb4c338972955d4393e011f56dcf661f4526cce2796df197

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Windows Update.exe
    Filesize

    205KB

    MD5

    7b0685897c65b060494c91b0b701fa71

    SHA1

    4f597320790d71cf000e4b03dcae8a11b6946410

    SHA256

    cdb39fc581b72b36c079abec9e2bfefa9a03e5dc00589a5889406f0647b0901a

    SHA512

    17e1e8821eec0c8aeb70551d833c0afc9805543997f98cd4430a254e2d51ca9b710a252fabc2d35beb4c338972955d4393e011f56dcf661f4526cce2796df197

    Download Submit
  • memory/936-135-0x00007FFB3BBF0000-0x00007FFB3C626000-memory.dmp
    Filesize

    10.2MB

    Download
  • memory/2544-136-0x0000000000000000-mapping.dmp
    Download
  • memory/2544-139-0x00007FFB3BBF0000-0x00007FFB3C626000-memory.dmp
    Filesize

    10.2MB

    Download