General

  • Target

    dormitabis.exe

  • Size

    799KB

  • Sample

    250603-162braxmy8

  • MD5

    cc2d7ffa4e44d187d4918ef7f07f64e5

  • SHA1

    8ae38995bc14d8707fe6ec85a635df375cd1ae59

  • SHA256

    bc6f38469085cf4724b652f7e59989b42ef0df386c695d1dd2ba363c6e747736

  • SHA512

    5f884bdc80dcfbf079b4742296654ea8466694ecc1bb3471505ad08c9569e20e7782b42bbc94addce1fff43603efd1ae6ecec860aa0e8b0272fd888aa7e9240a

  • SSDEEP

    12288:mHDuQtqB5urTIoYWBQk1E+VF9mOx9EiIs/7XmZmBvjV6UDWi:+uQtqBorTlYWBhE+V3mOs

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    YourPassword

Targets

    • Target

      dormitabis.exe

    • Size

      799KB

    • MD5

      cc2d7ffa4e44d187d4918ef7f07f64e5

    • SHA1

      8ae38995bc14d8707fe6ec85a635df375cd1ae59

    • SHA256

      bc6f38469085cf4724b652f7e59989b42ef0df386c695d1dd2ba363c6e747736

    • SHA512

      5f884bdc80dcfbf079b4742296654ea8466694ecc1bb3471505ad08c9569e20e7782b42bbc94addce1fff43603efd1ae6ecec860aa0e8b0272fd888aa7e9240a

    • SSDEEP

      12288:mHDuQtqB5urTIoYWBQk1E+VF9mOx9EiIs/7XmZmBvjV6UDWi:+uQtqBorTlYWBhE+V3mOs

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

    • Hawkeye family

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Deletes itself

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Uses the VBS compiler for execution

    • Accesses Microsoft Outlook accounts

    • Adds Run key to start application

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks