Overview

overview

10

Static

static

8e89fff7e9...14.exe

windows7-x64

10

8e89fff7e9...14.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e89fff7e939ec32597c28b501636986b5ee5c55e6536a138bcc71784c79fd14

  • Size

    462KB

  • Sample

    221201-bw6q2scd25

  • MD5

    5289e448e29eebbe040bc7002856a3ec

  • SHA1

    a212881b0d22a03062a7f9551ef4f44e0daea7f7

  • SHA256

    8e89fff7e939ec32597c28b501636986b5ee5c55e6536a138bcc71784c79fd14

  • SHA512

    02328e9ffaf1cf0e447120bcbb5b6308de364af4449ea0b89002fe248b456b861e32e56a7475b0ced12202d9065a7d2dffdeb7aa6ed0497191e898219ed96cd2

  • SSDEEP

    12288:fV5ChMDM9UyiyYwCeWJELqxlHDGRmgc5UVLM3WygVIIhGKF:GhLUv9BJDlHwmc2gVrGKF

Score
10/10
hawkeyekeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      8e89fff7e939ec32597c28b501636986b5ee5c55e6536a138bcc71784c79fd14

    • Size

      462KB

    • MD5

      5289e448e29eebbe040bc7002856a3ec

    • SHA1

      a212881b0d22a03062a7f9551ef4f44e0daea7f7

    • SHA256

      8e89fff7e939ec32597c28b501636986b5ee5c55e6536a138bcc71784c79fd14

    • SHA512

      02328e9ffaf1cf0e447120bcbb5b6308de364af4449ea0b89002fe248b456b861e32e56a7475b0ced12202d9065a7d2dffdeb7aa6ed0497191e898219ed96cd2

    • SSDEEP

      12288:fV5ChMDM9UyiyYwCeWJELqxlHDGRmgc5UVLM3WygVIIhGKF:GhLUv9BJDlHwmc2gVrGKF

    Score
    10/10
    hawkeyekeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks