Overview

overview

10

Static

static

1

2024-10-11...ar.exe

windows7-x64

10

2024-10-11...ar.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-10-11_03a5ea04ef15bca68edf74f38463087e_hiddentear

  • Size

    660KB

  • Sample

    241011-xqcrnsybpf

  • MD5

    03a5ea04ef15bca68edf74f38463087e

  • SHA1

    ce7ffb5982cb5c5a66854d4931c6be802b06cf3e

  • SHA256

    0dfb3176683efa54883d71a9c575d15f2fcee4293e53dd99db71d9bdfed9913f

  • SHA512

    5f9df5ec1e8338ef0935329decce78f1699dd835a48faacb869212c72e8fef0b6384c8c0e12abf19f41edd76366e9b9ee55152550025839a348ecd3ebde4b706

  • SSDEEP

    12288:u2hpKuNFgElu1Wt2yAS6yFQTWnk1q1vvG2eZkmMwP3OI4kDkRpzA8aR:u2HKQNlZtlAS6yFMOPTVsqrAF

Score
10/10
hawkeyecollectiondiscoverykeyloggerpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      2024-10-11_03a5ea04ef15bca68edf74f38463087e_hiddentear

    • Size

      660KB

    • MD5

      03a5ea04ef15bca68edf74f38463087e

    • SHA1

      ce7ffb5982cb5c5a66854d4931c6be802b06cf3e

    • SHA256

      0dfb3176683efa54883d71a9c575d15f2fcee4293e53dd99db71d9bdfed9913f

    • SHA512

      5f9df5ec1e8338ef0935329decce78f1699dd835a48faacb869212c72e8fef0b6384c8c0e12abf19f41edd76366e9b9ee55152550025839a348ecd3ebde4b706

    • SSDEEP

      12288:u2hpKuNFgElu1Wt2yAS6yFQTWnk1q1vvG2eZkmMwP3OI4kDkRpzA8aR:u2HKQNlZtlAS6yFMOPTVsqrAF

    Score
    10/10
    hawkeyecollectiondiscoverykeyloggerpersistencespywarestealertrojan

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

      collection

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks