Analysis

  • max time kernel
    70s
  • max time network
    143s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/09/2022, 22:16

General

  • Target

    8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe

  • Size

    2.7MB

  • MD5

    51e3a7f01dc6d68c33d184520cf578dc

  • SHA1

    e081194ec46e6d0806265ecb56fd7eefde49f5b4

  • SHA256

    8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d

  • SHA512

    5585b28b66b9ed968e0f88fbe8b42fdd6430c9cb302a1927f8fc4f458e50983928d6ca47bb7dade1c73a592248913c714b0edf718234bbb9a224e2c386f2b4c8

  • SSDEEP

    49152:BelBeMQvuPKQn1Q18QVwTG3+U7R2lUBk/LejWF2jFyr7btf7iHVQJp5JJKkVc:ABeMIub1QY6ZWgsL0FjMbl7iKJpxVc

Score
10/10

Malware Config

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe
    "C:\Users\Admin\AppData\Local\Temp\8ba6a24338e06b435fe5e63200785bf86d3b3cd809599b6a41e6bd1a6eafab4d.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4820
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
        PID:4896
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
          PID:4292
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
          2⤵
          • Accesses Microsoft Outlook profiles
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:4000
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1196
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              4⤵
                PID:1664
              • C:\Windows\SysWOW64\netsh.exe
                netsh wlan show profile
                4⤵
                  PID:1916
                • C:\Windows\SysWOW64\findstr.exe
                  findstr All
                  4⤵
                    PID:2116
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2900
                  • C:\Windows\SysWOW64\chcp.com
                    chcp 65001
                    4⤵
                      PID:3420
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh wlan show profile name="65001" key=clear
                      4⤵
                        PID:4092
                      • C:\Windows\SysWOW64\findstr.exe
                        findstr Key
                        4⤵
                          PID:3128
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                        3⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5048
                        • C:\Windows\SysWOW64\chcp.com
                          chcp 65001
                          4⤵
                            PID:2692
                          • C:\Windows\SysWOW64\PING.EXE
                            ping 127.0.0.1
                            4⤵
                            • Runs ping.exe
                            PID:2312

                    Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • memory/4000-293-0x00000000062E0000-0x0000000006330000-memory.dmp

                            Filesize

                            320KB

                          • memory/4000-282-0x0000000005D30000-0x0000000005D96000-memory.dmp

                            Filesize

                            408KB

                          • memory/4000-248-0x0000000000400000-0x000000000045A000-memory.dmp

                            Filesize

                            360KB

                          • memory/4820-157-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-164-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-127-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-128-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-130-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-129-0x0000000000910000-0x0000000001332000-memory.dmp

                            Filesize

                            10.1MB

                          • memory/4820-131-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-132-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-133-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-134-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-135-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-136-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-137-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-138-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-139-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-140-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-141-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-142-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-143-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-144-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-145-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-146-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-147-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-149-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-148-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-150-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-151-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-152-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-153-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-156-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-155-0x0000000000910000-0x0000000000912000-memory.dmp

                            Filesize

                            8KB

                          • memory/4820-154-0x00000000FE360000-0x00000000FE731000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/4820-125-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-158-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-159-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-160-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-161-0x0000000000910000-0x0000000001332000-memory.dmp

                            Filesize

                            10.1MB

                          • memory/4820-162-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-163-0x0000000003C00000-0x0000000003C9C000-memory.dmp

                            Filesize

                            624KB

                          • memory/4820-126-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-166-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-165-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-167-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-169-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-171-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-173-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-174-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-172-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-170-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-175-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-176-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-168-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-177-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-179-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-182-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-183-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-181-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-180-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-178-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-198-0x0000000000910000-0x0000000001332000-memory.dmp

                            Filesize

                            10.1MB

                          • memory/4820-201-0x0000000003750000-0x000000000378C000-memory.dmp

                            Filesize

                            240KB

                          • memory/4820-202-0x00000000037C0000-0x00000000037C6000-memory.dmp

                            Filesize

                            24KB

                          • memory/4820-204-0x000000000D2F0000-0x000000000D382000-memory.dmp

                            Filesize

                            584KB

                          • memory/4820-203-0x000000000D7F0000-0x000000000DCEE000-memory.dmp

                            Filesize

                            5.0MB

                          • memory/4820-206-0x0000000003CE0000-0x0000000003CEA000-memory.dmp

                            Filesize

                            40KB

                          • memory/4820-124-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-123-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-122-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-121-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-120-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-119-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-118-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-211-0x00000000FE360000-0x00000000FE731000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/4820-212-0x000000000D520000-0x000000000D53A000-memory.dmp

                            Filesize

                            104KB

                          • memory/4820-213-0x000000000D540000-0x000000000D546000-memory.dmp

                            Filesize

                            24KB

                          • memory/4820-223-0x0000000000910000-0x0000000001332000-memory.dmp

                            Filesize

                            10.1MB

                          • memory/4820-116-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/4820-117-0x0000000077200000-0x000000007738E000-memory.dmp

                            Filesize

                            1.6MB