Analysis
-
max time kernel
120s -
max time network
54s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
02-12-2024 22:43
General
-
Target
0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe
-
Size
999KB
-
MD5
db1c31fdb09a47b7215e8869810bec00
-
SHA1
6c3391975646000d28f4e64a935f738d9d3d62ee
-
SHA256
0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebe
-
SHA512
6042ee6b16f7b140460d424d20a9caa95606fcbcab7cb5953c454377e20c0e5ca0f6075f0469ae9a9aa654f48edd85f71b8700f322727c09a1db622d958dfbd5
-
SSDEEP
24576:ghyp66+rMAW4bzZJfkgmT6sGIcBRLYP64:AypmA4bNJfkgm2sMBRLN4
Malware Config
Signatures
-
HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
-
Hawkeye family
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 50 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe"C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe"C:\Users\Admin\AppData\Local\Temp\0627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebeN.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe -f "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\EFS.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CryptSvc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
321B
MD5e62221a3bb549a72fcc4afa60d34e620
SHA1d60b16b540e0e3ed459a30cce0678d1fc8a1989a
SHA256587f8f51485b575f30e5e1608f70b31b9d8bb384318802373cc52cbdf2a4aa95
SHA5125b6f6a3a88961b62870e486b02e41d065b3f054f3ad45f7c7e01aff3ba151893e36fd3c13771ed9e3738aaa525296a8ee72adc05fb32932ec3af259404172aed
-
Filesize
321B
MD5c3609e29395ccd5fd8407fed36414e75
SHA104c0c5dc3fcced0c5581c44af17fa60260fb591a
SHA256a32df1c247d5738af4241edc4aa520dbb21013d05d47cac5db96ccfb48de7857
SHA5128bbd7b458f2be6e91c46cad8f682e109c7a7317f9ae89e5ce889ae7d4db5775b83d03016f47b56aa75bd5646a50c06ae7adbf2fc8af6b9f8a976f2ce30de3533
-
Filesize
8KB
MD5e5cfadb65f5a6b27b6a559cb3c286b95
SHA1f33ab26def2759aad5248cf1affa413777148584
SHA256251b78d864900e3a2b6cc168463421e1bc4ca31bfcabe941b595989bda0e5314
SHA512b833256eb469717036cd81673e6b4d2bfa00093955b3d202fcfade785f530c51ccb9c23d883f3d263b985996560f3e67d5c7df51963974b526c79f3ded043d9b
-
Filesize
999KB
MD5db1c31fdb09a47b7215e8869810bec00
SHA16c3391975646000d28f4e64a935f738d9d3d62ee
SHA2560627bcf01d45625dc90d6163a5918c8d3c9572e750adb2ffdf0227bb0d74aebe
SHA5126042ee6b16f7b140460d424d20a9caa95606fcbcab7cb5953c454377e20c0e5ca0f6075f0469ae9a9aa654f48edd85f71b8700f322727c09a1db622d958dfbd5
-
Filesize
4B
MD55a45828dead8c065099cb653a2185df1
SHA1313356f0d1754c304429ead3a51f38a36bb028c7
SHA256c4b6fe20fadf12a363d8583f4a43eaf17bdffe8c65aa383e15cd0f38ee7acdc5
SHA51227e4352ac9786dfbf7c37c9299c61299dcf946826b3bf2e61009adabfc8447ec379f764d26a85e0dd43779482030a38e041830789843aa6d405ec4f21e1577b8
-
Filesize
444KB
-
Filesize
1.5MB
-
Filesize
444KB
-
Filesize
444KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
440KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
920KB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
920KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
920KB
-
Filesize
5.7MB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
920KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
920KB