General
-
Target
dormitabis.exe
-
Size
799KB
-
Sample
250603-19lqgaan6t
-
MD5
cc2d7ffa4e44d187d4918ef7f07f64e5
-
SHA1
8ae38995bc14d8707fe6ec85a635df375cd1ae59
-
SHA256
bc6f38469085cf4724b652f7e59989b42ef0df386c695d1dd2ba363c6e747736
-
SHA512
5f884bdc80dcfbf079b4742296654ea8466694ecc1bb3471505ad08c9569e20e7782b42bbc94addce1fff43603efd1ae6ecec860aa0e8b0272fd888aa7e9240a
-
SSDEEP
12288:mHDuQtqB5urTIoYWBQk1E+VF9mOx9EiIs/7XmZmBvjV6UDWi:+uQtqBorTlYWBhE+V3mOs
Static task
static1
Behavioral task
behavioral1
Sample
dormitabis.exe
Resource
win10v2004-20250502-en
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
YourPassword
Targets
-
-
Target
dormitabis.exe
-
Size
799KB
-
MD5
cc2d7ffa4e44d187d4918ef7f07f64e5
-
SHA1
8ae38995bc14d8707fe6ec85a635df375cd1ae59
-
SHA256
bc6f38469085cf4724b652f7e59989b42ef0df386c695d1dd2ba363c6e747736
-
SHA512
5f884bdc80dcfbf079b4742296654ea8466694ecc1bb3471505ad08c9569e20e7782b42bbc94addce1fff43603efd1ae6ecec860aa0e8b0272fd888aa7e9240a
-
SSDEEP
12288:mHDuQtqB5urTIoYWBQk1E+VF9mOx9EiIs/7XmZmBvjV6UDWi:+uQtqBorTlYWBhE+V3mOs
-
Hawkeye family
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
NirSoft WebBrowserPassView
Password recovery tool for various web browsers
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Uses the VBS compiler for execution
-
Accesses Microsoft Outlook accounts
-
Adds Run key to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1