Overview

overview

10

Static

static

1

test.txt

windows11-21h2-x64

Resubmissions

23-02-2025 11:56

250223-n4c5xswmd1 3

23-02-2025 11:22

250223-ngvrfsvmds 10

23-02-2025 09:27

250223-leqzda1rcr 8

22-02-2025 15:10

250222-skjwks1qa1 1

22-02-2025 15:10

250222-sj2p1askbk 1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    test.txt

  • Size

    18B

  • Sample

    250218-sjbhtatmz4

  • MD5

    5b3f97d48c8751bd031b7ea53545bdb6

  • SHA1

    88be3374c62f23406ec83bb11279f8423bd3f88d

  • SHA256

    d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b

  • SHA512

    ed2de1eec50310ced4bde8ef6ae4b7902920b007df7b6aeb200cfe9fcc0d36ef05af7526c4675be2feac52831668798d5fe3523175efad6f6549b30f30a0b5d6

Score
10/10
hawkeyeremcosdefense_evasiondiscoveryevasionexecutionkeyloggermotwphishingratspywarestealertrojan

Malware Config

Targets

    • Target

      test.txt

    • Size

      18B

    • MD5

      5b3f97d48c8751bd031b7ea53545bdb6

    • SHA1

      88be3374c62f23406ec83bb11279f8423bd3f88d

    • SHA256

      d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b

    • SHA512

      ed2de1eec50310ced4bde8ef6ae4b7902920b007df7b6aeb200cfe9fcc0d36ef05af7526c4675be2feac52831668798d5fe3523175efad6f6549b30f30a0b5d6

    Score
    10/10
    hawkeyeremcosdefense_evasiondiscoveryevasionexecutionkeyloggermotwphishingratspywarestealertrojan

    • Disables service(s)

      defense_evasionexecution

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • Hawkeye family

      hawkeye

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies security service

      defense_evasion

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Remcos family

      remcos

    • UAC bypass

      defense_evasiontrojan

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      defense_evasion

    • Disables RegEdit via registry modification

      defense_evasion

    • Disables use of System Restore points

      defense_evasion

    • Indicator Removal: Network Share Connection Removal

      Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

      defense_evasion

    • Stops running service(s)

      defense_evasionexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Mark of the Web detected: This indicates that the page was originally saved or cloned.

      phishingmotw

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Account Manipulation

1
T1098

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Account Manipulation

1
T1098

Create or Modify System Process

4
T1543

Windows Service

4
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

3
T1562

Disable or Modify Tools

2
T1562.001

Indicator Removal

1
T1070

Network Share Connection Removal

1
T1070.005

Modify Registry

3
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Service Stop

2
T1489

Tasks