Overview

overview

10

Static

static

dda389463f...17.exe

windows7-x64

10

dda389463f...17.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dda389463f20a2133611fcb4a5070567bd66c7fed4f4fbb6fca9519c04c08617

  • Size

    125KB

  • Sample

    221205-d85qmagd3x

  • MD5

    e21a97e24764f966e63ef8aaa40c3187

  • SHA1

    9248e675dfcc45beae7eff04db8fb1c55ad4b456

  • SHA256

    dda389463f20a2133611fcb4a5070567bd66c7fed4f4fbb6fca9519c04c08617

  • SHA512

    f9b3e6e1629a3e744e68d1693a5118fd6372d7a42485b9addafdb3b5737ecd145049ab8f07edb36c837ca48450e58122a20e3a1d37b63f416f0868081281a786

  • SSDEEP

    3072:PGffby9J6xjifDpYYgr3B82Z7UD5gbQjicQRVO7:OHbypryF82Z7kgbQQo

Score
10/10
hawkeyextremeratkeyloggerpersistenceratspywarestealertrojan

Malware Config

Targets

    • Target

      dda389463f20a2133611fcb4a5070567bd66c7fed4f4fbb6fca9519c04c08617

    • Size

      125KB

    • MD5

      e21a97e24764f966e63ef8aaa40c3187

    • SHA1

      9248e675dfcc45beae7eff04db8fb1c55ad4b456

    • SHA256

      dda389463f20a2133611fcb4a5070567bd66c7fed4f4fbb6fca9519c04c08617

    • SHA512

      f9b3e6e1629a3e744e68d1693a5118fd6372d7a42485b9addafdb3b5737ecd145049ab8f07edb36c837ca48450e58122a20e3a1d37b63f416f0868081281a786

    • SSDEEP

      3072:PGffby9J6xjifDpYYgr3B82Z7UD5gbQjicQRVO7:OHbypryF82Z7kgbQQo

    Score
    10/10
    hawkeyextremeratkeyloggerpersistenceratspywarestealertrojan

    • Detect XtremeRAT payload

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks