Extracted

• • Target

    HAWB eHAWB 1 Copy516328125292121001.exe

  • Size

    663KB

  • MD5

    350558346cfe1dd301a21470193072db

  • SHA1

    967ba98bbc9db9e98a31b5687cfd2fed6567022d

  • SHA256

    7efed1829051f94d9c430e22e88f59f64350397a1b0d355fd65951aee34d0f13

  • SHA512

    1e1156773d19217f27cc15c3f42c07de19d5a7399c8c40fd11ac1bfca931c1b5bc762ad6b51184f558e99c8e2792b023b1dd7a07b4138262e1df30b63de5cd0e

  • SSDEEP

    12288:wbntTHA1OjiQRmIZ1sCLq3LVI4D1wGFP8vyvQTXCTRDer3yv:wbn83yZVLe7hweEy4Tykr3yv

  Score

  10^/10

  guloaderremcoscrypteddiscoverydownloaderrathawkeyekeyloggerspywarestealertrojan

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • HawkEye

    HawkEye is a malware kit that has seen continuous development since at least 2013.

    keyloggertrojanstealerspywarehawkeye

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos

  • Checks QEMU agent file

    Checks presence of QEMU agent, possibly to detect virtualization.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of NtCreateThreadExHideFromDebugger

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2