Analysis

  • max time kernel
    112s
  • max time network
    115s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-09-2022 06:27

General

  • Target

    0x00090000000139f7-58.exe

  • Size

    334KB

  • MD5

    126fe59c0f926132abfef83696fc9aac

  • SHA1

    c4f2047455d5f02af5ec8cf9644f8cd491fd7e46

  • SHA256

    fa2a334940cbe72ec5ac5fb691299d9964b6de2a778172c9b8d6738a9cdbd01b

  • SHA512

    36927d1d03463220057b1acd58a45dc9a6cf9f25d21652c35dc891125ce4da36807aea90548cf0a4dfc6c2e2c3ffab893fa2426831866182436d8242522549a5

Malware Config

Extracted

Family

eternity

C2

http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Executes dropped EXE ⋅ 1 IoCs
  • Loads dropped DLL ⋅ 7 IoCs
  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles ⋅ 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 ⋅ 1 TTPs
  • Looks up external IP address via web service ⋅ 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry ⋅ 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store ⋅ 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 16 IoCs
  • outlook_office_path ⋅ 1 IoCs
  • outlook_win_path ⋅ 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x00090000000139f7-58.exe
    "C:\Users\Admin\AppData\Local\Temp\0x00090000000139f7-58.exe"
    Accesses Microsoft Outlook profiles
    Checks processor information in registry
    Modifies system certificate store
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    outlook_office_path
    outlook_win_path
    PID:1096
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      Suspicious use of WriteProcessMemory
      PID:268
      • C:\Windows\system32\chcp.com
        chcp 65001
        PID:520
      • C:\Windows\system32\netsh.exe
        netsh wlan show profile
        PID:1360
      • C:\Windows\system32\findstr.exe
        findstr All
        PID:1368
    • C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe
      "C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe"
      Executes dropped EXE
      Loads dropped DLL
      PID:924

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Persistence

                Privilege Escalation

                  Replay Monitor

                  00:00 00:00

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\Tor\libcrypto-1_1.dll
                    MD5

                    3406f79392c47a72bed2f0067b3ce466

                    SHA1

                    a8e2940d61fc840441c4e2a835959d197929ffdf

                    SHA256

                    e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d

                    SHA512

                    930d794aa8715dcd23fafbead7fe2ec95d2863783b4c52279870cad93d5b6cf02ba8a13e2653d2bf731e9882bf63f43a7e44788ce47505346be3fe8e8b872fa4

                  • C:\Users\Admin\AppData\Local\Temp\Tor\libevent-2-1-7.dll
                    MD5

                    a3bf8e33948d94d490d4613441685eee

                    SHA1

                    75ed7f6e2855a497f45b15270c3ad4aed6ad02e2

                    SHA256

                    91c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585

                    SHA512

                    c20ef2efcacb5f8c7e2464de7fde68bf610ab2e0608ff4daed9bf676996375db99bee7e3f26c5bd6cca63f9b2d889ed5460ec25004130887cd1a90b892be2b28

                  • C:\Users\Admin\AppData\Local\Temp\Tor\libgcc_s_sjlj-1.dll
                    MD5

                    bd40ff3d0ce8d338a1fe4501cd8e9a09

                    SHA1

                    3aae8c33bf0ec9adf5fbf8a361445969de409b49

                    SHA256

                    ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c

                    SHA512

                    404fb3c107006b832b8e900f6e27873324cd0a7946cdccf4ffeea365a725892d929e8b160379af9782bcd6cfeb4c3c805740e21280b42bb2ce8f39f26792e5a1

                  • C:\Users\Admin\AppData\Local\Temp\Tor\libssl-1_1.dll
                    MD5

                    9e3d55fbf890c6cbffd836f2aef4ba31

                    SHA1

                    715890ba3bda3431470cca4f4bc492c0f63fa138

                    SHA256

                    e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0

                    SHA512

                    9848f28fd96c21dd054cbf3e722e56373696c1f7803c137afc7c7203325d9738fa6b984d95cd49ff78a6d95c8f9406f869af3c3783901da3cc003e2b09497d65

                  • C:\Users\Admin\AppData\Local\Temp\Tor\libssp-0.dll
                    MD5

                    b77328da7cead5f4623748a70727860d

                    SHA1

                    13b33722c55cca14025b90060e3227db57bf5327

                    SHA256

                    46541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7

                    SHA512

                    2f1bd13357078454203092ed5ddc23a8baa5e64202fba1e4f98eacf1c3c184616e527468a96ff36d98b9324426dddfa20b62b38cf95c6f5c0dc32513ebace9e2

                  • C:\Users\Admin\AppData\Local\Temp\Tor\libwinpthread-1.dll
                    MD5

                    19d7cc4377f3c09d97c6da06fbabc7dc

                    SHA1

                    3a3ba8f397fb95ed5df22896b2c53a326662fcc9

                    SHA256

                    228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d

                    SHA512

                    23711285352cdec6815b5dd6e295ec50568fab7614706bc8d5328a4a0b62991c54b16126ed9e522471d2367b6f32fa35feb41bfa77b3402680d9a69f53962a4a

                  • C:\Users\Admin\AppData\Local\Temp\Tor\tor.exe
                    MD5

                    67ab12cf6cabc14588e4f51b21c2134a

                    SHA1

                    32a4ff564f38bf4b62007e419f19c991e60d6e14

                    SHA256

                    f0aaae0364306bb7a4681d01935c96c2ac76b3576b7982990f86bcaf811a45ba

                    SHA512

                    2a1c67e9d23d6b050e35c5a8e159309cf598095239406c60a9f721fddc912e21afab7036cbd9f77197cc4241df5f8fa6aa9d7294762659178c6edeb4699d5bec

                  • C:\Users\Admin\AppData\Local\Temp\Tor\zlib1.dll
                    MD5

                    6f98da9e33cd6f3dd60950413d3638ac

                    SHA1

                    e630bdf8cebc165aa81464ff20c1d55272d05675

                    SHA256

                    219d9d5bf0de4c2251439c89dd5f2959ee582e7f9f7d5ff66a29c88753a3a773

                    SHA512

                    2983faaf7f47a8f79a38122aa617e65e7deddd19ba9a98b62acf17b48e5308099b852f21aaf8ca6fe11e2cc76c36eed7ffa3307877d4e67b1659fe6e4475205c

                  • \Users\Admin\AppData\Local\Temp\Tor\libcrypto-1_1.dll
                    MD5

                    3406f79392c47a72bed2f0067b3ce466

                    SHA1

                    a8e2940d61fc840441c4e2a835959d197929ffdf

                    SHA256

                    e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d

                    SHA512

                    930d794aa8715dcd23fafbead7fe2ec95d2863783b4c52279870cad93d5b6cf02ba8a13e2653d2bf731e9882bf63f43a7e44788ce47505346be3fe8e8b872fa4

                  • \Users\Admin\AppData\Local\Temp\Tor\libevent-2-1-7.dll
                    MD5

                    a3bf8e33948d94d490d4613441685eee

                    SHA1

                    75ed7f6e2855a497f45b15270c3ad4aed6ad02e2

                    SHA256

                    91c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585

                    SHA512

                    c20ef2efcacb5f8c7e2464de7fde68bf610ab2e0608ff4daed9bf676996375db99bee7e3f26c5bd6cca63f9b2d889ed5460ec25004130887cd1a90b892be2b28

                  • \Users\Admin\AppData\Local\Temp\Tor\libgcc_s_sjlj-1.dll
                    MD5

                    bd40ff3d0ce8d338a1fe4501cd8e9a09

                    SHA1

                    3aae8c33bf0ec9adf5fbf8a361445969de409b49

                    SHA256

                    ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c

                    SHA512

                    404fb3c107006b832b8e900f6e27873324cd0a7946cdccf4ffeea365a725892d929e8b160379af9782bcd6cfeb4c3c805740e21280b42bb2ce8f39f26792e5a1

                  • \Users\Admin\AppData\Local\Temp\Tor\libssl-1_1.dll
                    MD5

                    9e3d55fbf890c6cbffd836f2aef4ba31

                    SHA1

                    715890ba3bda3431470cca4f4bc492c0f63fa138

                    SHA256

                    e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0

                    SHA512

                    9848f28fd96c21dd054cbf3e722e56373696c1f7803c137afc7c7203325d9738fa6b984d95cd49ff78a6d95c8f9406f869af3c3783901da3cc003e2b09497d65

                  • \Users\Admin\AppData\Local\Temp\Tor\libssp-0.dll
                    MD5

                    b77328da7cead5f4623748a70727860d

                    SHA1

                    13b33722c55cca14025b90060e3227db57bf5327

                    SHA256

                    46541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7

                    SHA512

                    2f1bd13357078454203092ed5ddc23a8baa5e64202fba1e4f98eacf1c3c184616e527468a96ff36d98b9324426dddfa20b62b38cf95c6f5c0dc32513ebace9e2

                  • \Users\Admin\AppData\Local\Temp\Tor\libwinpthread-1.dll
                    MD5

                    19d7cc4377f3c09d97c6da06fbabc7dc

                    SHA1

                    3a3ba8f397fb95ed5df22896b2c53a326662fcc9

                    SHA256

                    228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d

                    SHA512

                    23711285352cdec6815b5dd6e295ec50568fab7614706bc8d5328a4a0b62991c54b16126ed9e522471d2367b6f32fa35feb41bfa77b3402680d9a69f53962a4a

                  • \Users\Admin\AppData\Local\Temp\Tor\zlib1.dll
                    MD5

                    6f98da9e33cd6f3dd60950413d3638ac

                    SHA1

                    e630bdf8cebc165aa81464ff20c1d55272d05675

                    SHA256

                    219d9d5bf0de4c2251439c89dd5f2959ee582e7f9f7d5ff66a29c88753a3a773

                    SHA512

                    2983faaf7f47a8f79a38122aa617e65e7deddd19ba9a98b62acf17b48e5308099b852f21aaf8ca6fe11e2cc76c36eed7ffa3307877d4e67b1659fe6e4475205c

                  • memory/268-55-0x0000000000000000-mapping.dmp
                  • memory/520-56-0x0000000000000000-mapping.dmp
                  • memory/924-82-0x0000000074730000-0x0000000074816000-memory.dmp
                  • memory/924-80-0x0000000074D10000-0x0000000074E0B000-memory.dmp
                  • memory/924-89-0x0000000001060000-0x0000000001473000-memory.dmp
                  • memory/924-88-0x0000000001060000-0x0000000001473000-memory.dmp
                  • memory/924-60-0x0000000000000000-mapping.dmp
                  • memory/924-70-0x0000000075211000-0x0000000075213000-memory.dmp
                  • memory/924-77-0x0000000074D10000-0x0000000074E0B000-memory.dmp
                  • memory/924-78-0x0000000074700000-0x0000000074726000-memory.dmp
                  • memory/924-79-0x0000000001060000-0x0000000001473000-memory.dmp
                  • memory/924-87-0x0000000074730000-0x0000000074816000-memory.dmp
                  • memory/924-81-0x0000000074820000-0x0000000074B15000-memory.dmp
                  • memory/924-86-0x0000000074820000-0x0000000074B15000-memory.dmp
                  • memory/924-83-0x0000000074700000-0x0000000074726000-memory.dmp
                  • memory/924-84-0x0000000001060000-0x0000000001473000-memory.dmp
                  • memory/924-85-0x0000000074D10000-0x0000000074E0B000-memory.dmp
                  • memory/1096-54-0x0000000000A20000-0x0000000000A7A000-memory.dmp
                  • memory/1360-57-0x0000000000000000-mapping.dmp
                  • memory/1360-59-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp
                  • memory/1368-58-0x0000000000000000-mapping.dmp