Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2022, 14:33
Behavioral task
behavioral1
Sample
3068-170-0x0000000011720000-0x000000001177A000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3068-170-0x0000000011720000-0x000000001177A000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3068-170-0x0000000011720000-0x000000001177A000-memory.exe
-
Size
360KB
-
MD5
67b5f9a451b706a968af4aaee3f5cb0a
-
SHA1
cfb39b4ec20489dde5043f002fab09ae8a5e2c33
-
SHA256
6594a916427ac64008780c912ba9799b9092f349ae740f3b6ca6156e8f274f12
-
SHA512
7d76c0092820bb1df8c0f5d06dd02710c50d06f59097c2f3360f902cdcdb60c82fc3577dff98e2e215a1ff681e1a8e07b19a7825d97219a10e338c1ff8446013
-
SSDEEP
6144:pl/CaMHU/A581nCyAkY1pBUDPsheJ+Wb9v6wev:7FSU/AqOkS/Y4k
Malware Config
Extracted
eternity
http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 3068-170-0x0000000011720000-0x000000001177A000-memory.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3068-170-0x0000000011720000-0x000000001177A000-memory.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3068-170-0x0000000011720000-0x000000001177A000-memory.exe Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3068-170-0x0000000011720000-0x000000001177A000-memory.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 3068-170-0x0000000011720000-0x000000001177A000-memory.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 3068-170-0x0000000011720000-0x000000001177A000-memory.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1964 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1540 3068-170-0x0000000011720000-0x000000001177A000-memory.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1540 3068-170-0x0000000011720000-0x000000001177A000-memory.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1540 wrote to memory of 4796 1540 3068-170-0x0000000011720000-0x000000001177A000-memory.exe 84 PID 1540 wrote to memory of 4796 1540 3068-170-0x0000000011720000-0x000000001177A000-memory.exe 84 PID 4796 wrote to memory of 5112 4796 cmd.exe 86 PID 4796 wrote to memory of 5112 4796 cmd.exe 86 PID 4796 wrote to memory of 4056 4796 cmd.exe 87 PID 4796 wrote to memory of 4056 4796 cmd.exe 87 PID 4796 wrote to memory of 3596 4796 cmd.exe 88 PID 4796 wrote to memory of 3596 4796 cmd.exe 88 PID 1540 wrote to memory of 4812 1540 3068-170-0x0000000011720000-0x000000001177A000-memory.exe 89 PID 1540 wrote to memory of 4812 1540 3068-170-0x0000000011720000-0x000000001177A000-memory.exe 89 PID 4812 wrote to memory of 3624 4812 cmd.exe 91 PID 4812 wrote to memory of 3624 4812 cmd.exe 91 PID 4812 wrote to memory of 3724 4812 cmd.exe 92 PID 4812 wrote to memory of 3724 4812 cmd.exe 92 PID 4812 wrote to memory of 3644 4812 cmd.exe 93 PID 4812 wrote to memory of 3644 4812 cmd.exe 93 PID 1540 wrote to memory of 4500 1540 3068-170-0x0000000011720000-0x000000001177A000-memory.exe 106 PID 1540 wrote to memory of 4500 1540 3068-170-0x0000000011720000-0x000000001177A000-memory.exe 106 PID 4500 wrote to memory of 1808 4500 cmd.exe 108 PID 4500 wrote to memory of 1808 4500 cmd.exe 108 PID 4500 wrote to memory of 1964 4500 cmd.exe 109 PID 4500 wrote to memory of 1964 4500 cmd.exe 109 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3068-170-0x0000000011720000-0x000000001177A000-memory.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 3068-170-0x0000000011720000-0x000000001177A000-memory.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3068-170-0x0000000011720000-0x000000001177A000-memory.exe"C:\Users\Admin\AppData\Local\Temp\3068-170-0x0000000011720000-0x000000001177A000-memory.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1540 -
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:5112
-
-
C:\Windows\system32\netsh.exenetsh wlan show profile3⤵PID:4056
-
-
C:\Windows\system32\findstr.exefindstr All3⤵PID:3596
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key2⤵
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:3624
-
-
C:\Windows\system32\netsh.exenetsh wlan show profile name="65001" key=clear3⤵PID:3724
-
-
C:\Windows\system32\findstr.exefindstr Key3⤵PID:3644
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\3068-170-0x0000000011720000-0x000000001177A000-memory.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:1808
-
-
C:\Windows\system32\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:1964
-
-