Analysis

  • max time kernel
    82s
  • max time network
    180s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/09/2022, 22:16

General

  • Target

    453547830b48abba823150cfadab2717f43153598dbba7595bfacc13196a7c2d.exe

  • Size

    423KB

  • MD5

    f37639060cdf9b426d38afa1a05375c6

  • SHA1

    08da192b66493852158e6393e30cc23d8ff54aa2

  • SHA256

    453547830b48abba823150cfadab2717f43153598dbba7595bfacc13196a7c2d

  • SHA512

    143fe1a1e26b0fb8f4cc785a425c9420795af0a5eff902f8b97910d6e88c830e20397f95a07773e1a229876fbe8a569abc4b260bb56ea318bf19b37191e1053d

  • SSDEEP

    6144:qq1VGlkatj2ER0u+GIIIIIIIhIIIIIIIIIIIIIIIU:d0txm5

Malware Config

Signatures

  • Detects Eternity clipper 2 IoCs
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\453547830b48abba823150cfadab2717f43153598dbba7595bfacc13196a7c2d.exe
    "C:\Users\Admin\AppData\Local\Temp\453547830b48abba823150cfadab2717f43153598dbba7595bfacc13196a7c2d.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "SteamsService" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SteamsService.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4036
    • C:\Users\Admin\AppData\Local\Microsoft\SteamsService.exe
      "C:\Users\Admin\AppData\Local\Microsoft\SteamsService.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3852
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        PID:5008
  • C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "SteamsService" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Microsoft\SteamsService.exe"
    1⤵
    • Adds Run key to start application
    PID:4832

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\SteamsService.exe

          Filesize

          423KB

          MD5

          f37639060cdf9b426d38afa1a05375c6

          SHA1

          08da192b66493852158e6393e30cc23d8ff54aa2

          SHA256

          453547830b48abba823150cfadab2717f43153598dbba7595bfacc13196a7c2d

          SHA512

          143fe1a1e26b0fb8f4cc785a425c9420795af0a5eff902f8b97910d6e88c830e20397f95a07773e1a229876fbe8a569abc4b260bb56ea318bf19b37191e1053d

        • C:\Users\Admin\AppData\Local\Microsoft\SteamsService.exe

          Filesize

          423KB

          MD5

          f37639060cdf9b426d38afa1a05375c6

          SHA1

          08da192b66493852158e6393e30cc23d8ff54aa2

          SHA256

          453547830b48abba823150cfadab2717f43153598dbba7595bfacc13196a7c2d

          SHA512

          143fe1a1e26b0fb8f4cc785a425c9420795af0a5eff902f8b97910d6e88c830e20397f95a07773e1a229876fbe8a569abc4b260bb56ea318bf19b37191e1053d

        • memory/3040-118-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-119-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-120-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-121-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-122-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-123-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-124-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-125-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-126-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-127-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-128-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-129-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-130-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-131-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-133-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-135-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-134-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-136-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-132-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-137-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-139-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-138-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-140-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-141-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-142-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-144-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-143-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-145-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-146-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-147-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-148-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-149-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-150-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-151-0x0000000000BF0000-0x0000000000C60000-memory.dmp

          Filesize

          448KB

        • memory/3040-153-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-152-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-154-0x00000000054A0000-0x000000000553C000-memory.dmp

          Filesize

          624KB

        • memory/3040-155-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-156-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-157-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-158-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-160-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-161-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-164-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-163-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-162-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-159-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-165-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-166-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-167-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-168-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-170-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-169-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-171-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-173-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-172-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-174-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-175-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-178-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-179-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-177-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-181-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-180-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-176-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-182-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-183-0x00000000779B0000-0x0000000077B3E000-memory.dmp

          Filesize

          1.6MB

        • memory/3040-197-0x0000000004EB0000-0x0000000004EEC000-memory.dmp

          Filesize

          240KB

        • memory/3040-198-0x0000000004F00000-0x0000000004F06000-memory.dmp

          Filesize

          24KB

        • memory/3040-199-0x000000000A9A0000-0x000000000AE9E000-memory.dmp

          Filesize

          5.0MB

        • memory/3040-200-0x00000000063E0000-0x0000000006472000-memory.dmp

          Filesize

          584KB

        • memory/3040-203-0x0000000006380000-0x000000000638A000-memory.dmp

          Filesize

          40KB

        • memory/3852-273-0x0000000001220000-0x0000000001290000-memory.dmp

          Filesize

          448KB

        • memory/3852-324-0x0000000000FD0000-0x0000000000FEA000-memory.dmp

          Filesize

          104KB

        • memory/3852-325-0x0000000000ED0000-0x0000000000ED6000-memory.dmp

          Filesize

          24KB

        • memory/5008-360-0x0000000000400000-0x0000000000410000-memory.dmp

          Filesize

          64KB