Analysis

  • max time kernel
    206s
  • max time network
    210s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26/08/2022, 06:00

General

  • Target

    a18b2b6648a6e116fb85974ed5b174eb.exe

  • Size

    532KB

  • MD5

    a18b2b6648a6e116fb85974ed5b174eb

  • SHA1

    2335736ebb5b727dd221adaaf4a6e319d54650c1

  • SHA256

    7f69f2fe22dfaa47d7fdb7dd3a78b6feae38ea490dc2b81b7d044cd64836429b

  • SHA512

    179c9a08696e37c4d5b46b8e5195edee16d93098f2f400cd4312a2879edc149fb3472b1bb6e50bd3022cd88074950fea369c93a54d25e2d05842add78e9ade9e

  • SSDEEP

    12288:J7EaM88A/SFXR2i8u+kkXdXoDzXQfYw4wunnq:lP/KpR2pL5XtoDDQf4bq

Malware Config

Extracted

Family

eternity

C2

http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion

Signatures

  • Detects Eternity clipper 4 IoCs
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a18b2b6648a6e116fb85974ed5b174eb.exe
    "C:\Users\Admin\AppData\Local\Temp\a18b2b6648a6e116fb85974ed5b174eb.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:304
    • C:\Users\Admin\AppData\Local\Temp\Stealer.exe
      "C:\Users\Admin\AppData\Local\Temp\Stealer.exe"
      2⤵
      • Executes dropped EXE
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • outlook_office_path
      • outlook_win_path
      PID:808
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\system32\chcp.com
          chcp 65001
          4⤵
            PID:1484
          • C:\Windows\system32\netsh.exe
            netsh wlan show profile
            4⤵
              PID:468
            • C:\Windows\system32\findstr.exe
              findstr All
              4⤵
                PID:824
            • C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe
              "C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1836
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Stealer.exe"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:1748
              • C:\Windows\system32\chcp.com
                chcp 65001
                4⤵
                  PID:1428
                • C:\Windows\system32\PING.EXE
                  ping 127.0.0.1
                  4⤵
                  • Runs ping.exe
                  PID:2008
            • C:\Users\Admin\AppData\Local\Temp\Clipper.exe
              "C:\Users\Admin\AppData\Local\Temp\Clipper.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious use of AdjustPrivilegeToken
              PID:1160

          Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\Clipper.exe

                  Filesize

                  38KB

                  MD5

                  8ca91deb0b495906ddcb1baf997dedf7

                  SHA1

                  cdfe17d5ab94cfc7ed67b1ece1013e74be060ef4

                  SHA256

                  bcb1c93cfd5eae7f95a20b426bec5b7151734a4eba469a1caaf6b8cb665b9890

                  SHA512

                  b76b633fe9f1ae3f196541b41bcb8ff8d63865b6285c3a3672dc9141269df3d0dde7dc83589d7f69936d772f74a340be6141d30d22b3522c72c1a91b8be1ddec

                • C:\Users\Admin\AppData\Local\Temp\Clipper.exe

                  Filesize

                  38KB

                  MD5

                  8ca91deb0b495906ddcb1baf997dedf7

                  SHA1

                  cdfe17d5ab94cfc7ed67b1ece1013e74be060ef4

                  SHA256

                  bcb1c93cfd5eae7f95a20b426bec5b7151734a4eba469a1caaf6b8cb665b9890

                  SHA512

                  b76b633fe9f1ae3f196541b41bcb8ff8d63865b6285c3a3672dc9141269df3d0dde7dc83589d7f69936d772f74a340be6141d30d22b3522c72c1a91b8be1ddec

                • C:\Users\Admin\AppData\Local\Temp\Stealer.exe

                  Filesize

                  336KB

                  MD5

                  d1cdefb0ed7a84fdb2aba99ec065d2e2

                  SHA1

                  9cad12bc5214a118e72424b6d7799d362383f8f5

                  SHA256

                  80b855a33f26827638ffe23996eab1ee83c1582c207c9c76ed7b94856040268e

                  SHA512

                  a92a29a92e3835b5a9d4325227239b14b18f9e493645d7598178f6f195b28511996bbc615b461b369f1d070cddff1732fd4d1adc8ce646c2aac5e429756a1b3e

                • C:\Users\Admin\AppData\Local\Temp\Stealer.exe

                  Filesize

                  336KB

                  MD5

                  d1cdefb0ed7a84fdb2aba99ec065d2e2

                  SHA1

                  9cad12bc5214a118e72424b6d7799d362383f8f5

                  SHA256

                  80b855a33f26827638ffe23996eab1ee83c1582c207c9c76ed7b94856040268e

                  SHA512

                  a92a29a92e3835b5a9d4325227239b14b18f9e493645d7598178f6f195b28511996bbc615b461b369f1d070cddff1732fd4d1adc8ce646c2aac5e429756a1b3e

                • C:\Users\Admin\AppData\Local\Temp\Tor\libcrypto-1_1.dll

                  Filesize

                  3.5MB

                  MD5

                  3406f79392c47a72bed2f0067b3ce466

                  SHA1

                  a8e2940d61fc840441c4e2a835959d197929ffdf

                  SHA256

                  e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d

                  SHA512

                  930d794aa8715dcd23fafbead7fe2ec95d2863783b4c52279870cad93d5b6cf02ba8a13e2653d2bf731e9882bf63f43a7e44788ce47505346be3fe8e8b872fa4

                • C:\Users\Admin\AppData\Local\Temp\Tor\libevent-2-1-7.dll

                  Filesize

                  1.1MB

                  MD5

                  a3bf8e33948d94d490d4613441685eee

                  SHA1

                  75ed7f6e2855a497f45b15270c3ad4aed6ad02e2

                  SHA256

                  91c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585

                  SHA512

                  c20ef2efcacb5f8c7e2464de7fde68bf610ab2e0608ff4daed9bf676996375db99bee7e3f26c5bd6cca63f9b2d889ed5460ec25004130887cd1a90b892be2b28

                • C:\Users\Admin\AppData\Local\Temp\Tor\libgcc_s_sjlj-1.dll

                  Filesize

                  1.0MB

                  MD5

                  bd40ff3d0ce8d338a1fe4501cd8e9a09

                  SHA1

                  3aae8c33bf0ec9adf5fbf8a361445969de409b49

                  SHA256

                  ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c

                  SHA512

                  404fb3c107006b832b8e900f6e27873324cd0a7946cdccf4ffeea365a725892d929e8b160379af9782bcd6cfeb4c3c805740e21280b42bb2ce8f39f26792e5a1

                • C:\Users\Admin\AppData\Local\Temp\Tor\libssl-1_1.dll

                  Filesize

                  1.1MB

                  MD5

                  9e3d55fbf890c6cbffd836f2aef4ba31

                  SHA1

                  715890ba3bda3431470cca4f4bc492c0f63fa138

                  SHA256

                  e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0

                  SHA512

                  9848f28fd96c21dd054cbf3e722e56373696c1f7803c137afc7c7203325d9738fa6b984d95cd49ff78a6d95c8f9406f869af3c3783901da3cc003e2b09497d65

                • C:\Users\Admin\AppData\Local\Temp\Tor\libssp-0.dll

                  Filesize

                  246KB

                  MD5

                  b77328da7cead5f4623748a70727860d

                  SHA1

                  13b33722c55cca14025b90060e3227db57bf5327

                  SHA256

                  46541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7

                  SHA512

                  2f1bd13357078454203092ed5ddc23a8baa5e64202fba1e4f98eacf1c3c184616e527468a96ff36d98b9324426dddfa20b62b38cf95c6f5c0dc32513ebace9e2

                • C:\Users\Admin\AppData\Local\Temp\Tor\libwinpthread-1.dll

                  Filesize

                  512KB

                  MD5

                  19d7cc4377f3c09d97c6da06fbabc7dc

                  SHA1

                  3a3ba8f397fb95ed5df22896b2c53a326662fcc9

                  SHA256

                  228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d

                  SHA512

                  23711285352cdec6815b5dd6e295ec50568fab7614706bc8d5328a4a0b62991c54b16126ed9e522471d2367b6f32fa35feb41bfa77b3402680d9a69f53962a4a

                • C:\Users\Admin\AppData\Local\Temp\Tor\tor.exe

                  Filesize

                  4.0MB

                  MD5

                  67ab12cf6cabc14588e4f51b21c2134a

                  SHA1

                  32a4ff564f38bf4b62007e419f19c991e60d6e14

                  SHA256

                  f0aaae0364306bb7a4681d01935c96c2ac76b3576b7982990f86bcaf811a45ba

                  SHA512

                  2a1c67e9d23d6b050e35c5a8e159309cf598095239406c60a9f721fddc912e21afab7036cbd9f77197cc4241df5f8fa6aa9d7294762659178c6edeb4699d5bec

                • C:\Users\Admin\AppData\Local\Temp\Tor\zlib1.dll

                  Filesize

                  121KB

                  MD5

                  6f98da9e33cd6f3dd60950413d3638ac

                  SHA1

                  e630bdf8cebc165aa81464ff20c1d55272d05675

                  SHA256

                  219d9d5bf0de4c2251439c89dd5f2959ee582e7f9f7d5ff66a29c88753a3a773

                  SHA512

                  2983faaf7f47a8f79a38122aa617e65e7deddd19ba9a98b62acf17b48e5308099b852f21aaf8ca6fe11e2cc76c36eed7ffa3307877d4e67b1659fe6e4475205c

                • \Users\Admin\AppData\Local\Temp\Clipper.exe

                  Filesize

                  38KB

                  MD5

                  8ca91deb0b495906ddcb1baf997dedf7

                  SHA1

                  cdfe17d5ab94cfc7ed67b1ece1013e74be060ef4

                  SHA256

                  bcb1c93cfd5eae7f95a20b426bec5b7151734a4eba469a1caaf6b8cb665b9890

                  SHA512

                  b76b633fe9f1ae3f196541b41bcb8ff8d63865b6285c3a3672dc9141269df3d0dde7dc83589d7f69936d772f74a340be6141d30d22b3522c72c1a91b8be1ddec

                • \Users\Admin\AppData\Local\Temp\Stealer.exe

                  Filesize

                  336KB

                  MD5

                  d1cdefb0ed7a84fdb2aba99ec065d2e2

                  SHA1

                  9cad12bc5214a118e72424b6d7799d362383f8f5

                  SHA256

                  80b855a33f26827638ffe23996eab1ee83c1582c207c9c76ed7b94856040268e

                  SHA512

                  a92a29a92e3835b5a9d4325227239b14b18f9e493645d7598178f6f195b28511996bbc615b461b369f1d070cddff1732fd4d1adc8ce646c2aac5e429756a1b3e

                • \Users\Admin\AppData\Local\Temp\Tor\libcrypto-1_1.dll

                  Filesize

                  3.5MB

                  MD5

                  3406f79392c47a72bed2f0067b3ce466

                  SHA1

                  a8e2940d61fc840441c4e2a835959d197929ffdf

                  SHA256

                  e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d

                  SHA512

                  930d794aa8715dcd23fafbead7fe2ec95d2863783b4c52279870cad93d5b6cf02ba8a13e2653d2bf731e9882bf63f43a7e44788ce47505346be3fe8e8b872fa4

                • \Users\Admin\AppData\Local\Temp\Tor\libevent-2-1-7.dll

                  Filesize

                  1.1MB

                  MD5

                  a3bf8e33948d94d490d4613441685eee

                  SHA1

                  75ed7f6e2855a497f45b15270c3ad4aed6ad02e2

                  SHA256

                  91c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585

                  SHA512

                  c20ef2efcacb5f8c7e2464de7fde68bf610ab2e0608ff4daed9bf676996375db99bee7e3f26c5bd6cca63f9b2d889ed5460ec25004130887cd1a90b892be2b28

                • \Users\Admin\AppData\Local\Temp\Tor\libgcc_s_sjlj-1.dll

                  Filesize

                  1.0MB

                  MD5

                  bd40ff3d0ce8d338a1fe4501cd8e9a09

                  SHA1

                  3aae8c33bf0ec9adf5fbf8a361445969de409b49

                  SHA256

                  ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c

                  SHA512

                  404fb3c107006b832b8e900f6e27873324cd0a7946cdccf4ffeea365a725892d929e8b160379af9782bcd6cfeb4c3c805740e21280b42bb2ce8f39f26792e5a1

                • \Users\Admin\AppData\Local\Temp\Tor\libssl-1_1.dll

                  Filesize

                  1.1MB

                  MD5

                  9e3d55fbf890c6cbffd836f2aef4ba31

                  SHA1

                  715890ba3bda3431470cca4f4bc492c0f63fa138

                  SHA256

                  e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0

                  SHA512

                  9848f28fd96c21dd054cbf3e722e56373696c1f7803c137afc7c7203325d9738fa6b984d95cd49ff78a6d95c8f9406f869af3c3783901da3cc003e2b09497d65

                • \Users\Admin\AppData\Local\Temp\Tor\libssp-0.dll

                  Filesize

                  246KB

                  MD5

                  b77328da7cead5f4623748a70727860d

                  SHA1

                  13b33722c55cca14025b90060e3227db57bf5327

                  SHA256

                  46541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7

                  SHA512

                  2f1bd13357078454203092ed5ddc23a8baa5e64202fba1e4f98eacf1c3c184616e527468a96ff36d98b9324426dddfa20b62b38cf95c6f5c0dc32513ebace9e2

                • \Users\Admin\AppData\Local\Temp\Tor\libwinpthread-1.dll

                  Filesize

                  512KB

                  MD5

                  19d7cc4377f3c09d97c6da06fbabc7dc

                  SHA1

                  3a3ba8f397fb95ed5df22896b2c53a326662fcc9

                  SHA256

                  228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d

                  SHA512

                  23711285352cdec6815b5dd6e295ec50568fab7614706bc8d5328a4a0b62991c54b16126ed9e522471d2367b6f32fa35feb41bfa77b3402680d9a69f53962a4a

                • \Users\Admin\AppData\Local\Temp\Tor\zlib1.dll

                  Filesize

                  121KB

                  MD5

                  6f98da9e33cd6f3dd60950413d3638ac

                  SHA1

                  e630bdf8cebc165aa81464ff20c1d55272d05675

                  SHA256

                  219d9d5bf0de4c2251439c89dd5f2959ee582e7f9f7d5ff66a29c88753a3a773

                  SHA512

                  2983faaf7f47a8f79a38122aa617e65e7deddd19ba9a98b62acf17b48e5308099b852f21aaf8ca6fe11e2cc76c36eed7ffa3307877d4e67b1659fe6e4475205c

                • memory/304-57-0x0000000000400000-0x00000000004E6000-memory.dmp

                  Filesize

                  920KB

                • memory/304-58-0x00000000047F0000-0x0000000004868000-memory.dmp

                  Filesize

                  480KB

                • memory/304-65-0x00000000005F8000-0x0000000000657000-memory.dmp

                  Filesize

                  380KB

                • memory/304-56-0x0000000000220000-0x000000000028C000-memory.dmp

                  Filesize

                  432KB

                • memory/304-54-0x00000000005F8000-0x0000000000657000-memory.dmp

                  Filesize

                  380KB

                • memory/304-71-0x0000000000400000-0x00000000004E6000-memory.dmp

                  Filesize

                  920KB

                • memory/304-60-0x0000000074C91000-0x0000000074C93000-memory.dmp

                  Filesize

                  8KB

                • memory/304-59-0x00000000049B0000-0x0000000004A26000-memory.dmp

                  Filesize

                  472KB

                • memory/304-70-0x00000000005F8000-0x0000000000657000-memory.dmp

                  Filesize

                  380KB

                • memory/304-55-0x00000000005F8000-0x0000000000657000-memory.dmp

                  Filesize

                  380KB

                • memory/468-79-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

                  Filesize

                  8KB

                • memory/808-74-0x0000000000FC0000-0x000000000101A000-memory.dmp

                  Filesize

                  360KB

                • memory/1160-72-0x0000000000CD0000-0x0000000000CE0000-memory.dmp

                  Filesize

                  64KB

                • memory/1836-100-0x000000006F620000-0x000000006F71B000-memory.dmp

                  Filesize

                  1004KB

                • memory/1836-98-0x0000000073370000-0x0000000073396000-memory.dmp

                  Filesize

                  152KB

                • memory/1836-99-0x0000000001020000-0x0000000001433000-memory.dmp

                  Filesize

                  4.1MB

                • memory/1836-101-0x000000006F180000-0x000000006F475000-memory.dmp

                  Filesize

                  3.0MB

                • memory/1836-103-0x0000000073370000-0x0000000073396000-memory.dmp

                  Filesize

                  152KB

                • memory/1836-102-0x000000006F090000-0x000000006F176000-memory.dmp

                  Filesize

                  920KB

                • memory/1836-104-0x0000000001020000-0x0000000001433000-memory.dmp

                  Filesize

                  4.1MB

                • memory/1836-105-0x0000000001020000-0x0000000001433000-memory.dmp

                  Filesize

                  4.1MB

                • memory/1836-106-0x0000000001020000-0x0000000001433000-memory.dmp

                  Filesize

                  4.1MB

                • memory/1836-97-0x000000006F620000-0x000000006F71B000-memory.dmp

                  Filesize

                  1004KB