Analysis

  • max time kernel
    112s
  • max time network
    115s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-09-2022 06:27

General

  • Target

    0x00090000000139f7-58.exe

  • Size

    334KB

  • MD5

    126fe59c0f926132abfef83696fc9aac

  • SHA1

    c4f2047455d5f02af5ec8cf9644f8cd491fd7e46

  • SHA256

    fa2a334940cbe72ec5ac5fb691299d9964b6de2a778172c9b8d6738a9cdbd01b

  • SHA512

    36927d1d03463220057b1acd58a45dc9a6cf9f25d21652c35dc891125ce4da36807aea90548cf0a4dfc6c2e2c3ffab893fa2426831866182436d8242522549a5

  • SSDEEP

    6144:PKGpPpPGy64jkNmK8BQBxzBLkGa1x4mJorAR/IbwVx:PKGpRPnKPbLkGa1KAR/

Malware Config

Extracted

Family

eternity

C2

http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x00090000000139f7-58.exe
    "C:\Users\Admin\AppData\Local\Temp\0x00090000000139f7-58.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:1096
    • C:\Windows\system32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:268
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:520
        • C:\Windows\system32\netsh.exe
          netsh wlan show profile
          3⤵
            PID:1360
          • C:\Windows\system32\findstr.exe
            findstr All
            3⤵
              PID:1368
          • C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe
            "C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:924

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Defense Evasion

        Install Root Certificate

        1
        T1130

        Modify Registry

        1
        T1112

        Credential Access

        Credentials in Files

        1
        T1081

        Discovery

        System Information Discovery

        2
        T1082

        Query Registry

        1
        T1012

        Collection

        Data from Local System

        1
        T1005

        Email Collection

        1
        T1114

        Command and Control

        Web Service

        1
        T1102

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\Tor\libcrypto-1_1.dll
          Filesize

          3.5MB

          MD5

          3406f79392c47a72bed2f0067b3ce466

          SHA1

          a8e2940d61fc840441c4e2a835959d197929ffdf

          SHA256

          e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d

          SHA512

          930d794aa8715dcd23fafbead7fe2ec95d2863783b4c52279870cad93d5b6cf02ba8a13e2653d2bf731e9882bf63f43a7e44788ce47505346be3fe8e8b872fa4

        • C:\Users\Admin\AppData\Local\Temp\Tor\libevent-2-1-7.dll
          Filesize

          1.1MB

          MD5

          a3bf8e33948d94d490d4613441685eee

          SHA1

          75ed7f6e2855a497f45b15270c3ad4aed6ad02e2

          SHA256

          91c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585

          SHA512

          c20ef2efcacb5f8c7e2464de7fde68bf610ab2e0608ff4daed9bf676996375db99bee7e3f26c5bd6cca63f9b2d889ed5460ec25004130887cd1a90b892be2b28

        • C:\Users\Admin\AppData\Local\Temp\Tor\libgcc_s_sjlj-1.dll
          Filesize

          1.0MB

          MD5

          bd40ff3d0ce8d338a1fe4501cd8e9a09

          SHA1

          3aae8c33bf0ec9adf5fbf8a361445969de409b49

          SHA256

          ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c

          SHA512

          404fb3c107006b832b8e900f6e27873324cd0a7946cdccf4ffeea365a725892d929e8b160379af9782bcd6cfeb4c3c805740e21280b42bb2ce8f39f26792e5a1

        • C:\Users\Admin\AppData\Local\Temp\Tor\libssl-1_1.dll
          Filesize

          1.1MB

          MD5

          9e3d55fbf890c6cbffd836f2aef4ba31

          SHA1

          715890ba3bda3431470cca4f4bc492c0f63fa138

          SHA256

          e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0

          SHA512

          9848f28fd96c21dd054cbf3e722e56373696c1f7803c137afc7c7203325d9738fa6b984d95cd49ff78a6d95c8f9406f869af3c3783901da3cc003e2b09497d65

        • C:\Users\Admin\AppData\Local\Temp\Tor\libssp-0.dll
          Filesize

          246KB

          MD5

          b77328da7cead5f4623748a70727860d

          SHA1

          13b33722c55cca14025b90060e3227db57bf5327

          SHA256

          46541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7

          SHA512

          2f1bd13357078454203092ed5ddc23a8baa5e64202fba1e4f98eacf1c3c184616e527468a96ff36d98b9324426dddfa20b62b38cf95c6f5c0dc32513ebace9e2

        • C:\Users\Admin\AppData\Local\Temp\Tor\libwinpthread-1.dll
          Filesize

          512KB

          MD5

          19d7cc4377f3c09d97c6da06fbabc7dc

          SHA1

          3a3ba8f397fb95ed5df22896b2c53a326662fcc9

          SHA256

          228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d

          SHA512

          23711285352cdec6815b5dd6e295ec50568fab7614706bc8d5328a4a0b62991c54b16126ed9e522471d2367b6f32fa35feb41bfa77b3402680d9a69f53962a4a

        • C:\Users\Admin\AppData\Local\Temp\Tor\tor.exe
          Filesize

          4.0MB

          MD5

          67ab12cf6cabc14588e4f51b21c2134a

          SHA1

          32a4ff564f38bf4b62007e419f19c991e60d6e14

          SHA256

          f0aaae0364306bb7a4681d01935c96c2ac76b3576b7982990f86bcaf811a45ba

          SHA512

          2a1c67e9d23d6b050e35c5a8e159309cf598095239406c60a9f721fddc912e21afab7036cbd9f77197cc4241df5f8fa6aa9d7294762659178c6edeb4699d5bec

        • C:\Users\Admin\AppData\Local\Temp\Tor\zlib1.dll
          Filesize

          121KB

          MD5

          6f98da9e33cd6f3dd60950413d3638ac

          SHA1

          e630bdf8cebc165aa81464ff20c1d55272d05675

          SHA256

          219d9d5bf0de4c2251439c89dd5f2959ee582e7f9f7d5ff66a29c88753a3a773

          SHA512

          2983faaf7f47a8f79a38122aa617e65e7deddd19ba9a98b62acf17b48e5308099b852f21aaf8ca6fe11e2cc76c36eed7ffa3307877d4e67b1659fe6e4475205c

        • \Users\Admin\AppData\Local\Temp\Tor\libcrypto-1_1.dll
          Filesize

          3.5MB

          MD5

          3406f79392c47a72bed2f0067b3ce466

          SHA1

          a8e2940d61fc840441c4e2a835959d197929ffdf

          SHA256

          e4b6b2ca32b1e2ba26959ec7380c4f117418d3a724f60494ff3cb81505fbf43d

          SHA512

          930d794aa8715dcd23fafbead7fe2ec95d2863783b4c52279870cad93d5b6cf02ba8a13e2653d2bf731e9882bf63f43a7e44788ce47505346be3fe8e8b872fa4

        • \Users\Admin\AppData\Local\Temp\Tor\libevent-2-1-7.dll
          Filesize

          1.1MB

          MD5

          a3bf8e33948d94d490d4613441685eee

          SHA1

          75ed7f6e2855a497f45b15270c3ad4aed6ad02e2

          SHA256

          91c812a33871e40b264761f1418e37ebfeb750fe61ca00cbcbe9f3769a8bf585

          SHA512

          c20ef2efcacb5f8c7e2464de7fde68bf610ab2e0608ff4daed9bf676996375db99bee7e3f26c5bd6cca63f9b2d889ed5460ec25004130887cd1a90b892be2b28

        • \Users\Admin\AppData\Local\Temp\Tor\libgcc_s_sjlj-1.dll
          Filesize

          1.0MB

          MD5

          bd40ff3d0ce8d338a1fe4501cd8e9a09

          SHA1

          3aae8c33bf0ec9adf5fbf8a361445969de409b49

          SHA256

          ebda776a2a353f8f0690b1c7706b0cdaff3d23e1618515d45e451fc19440501c

          SHA512

          404fb3c107006b832b8e900f6e27873324cd0a7946cdccf4ffeea365a725892d929e8b160379af9782bcd6cfeb4c3c805740e21280b42bb2ce8f39f26792e5a1

        • \Users\Admin\AppData\Local\Temp\Tor\libssl-1_1.dll
          Filesize

          1.1MB

          MD5

          9e3d55fbf890c6cbffd836f2aef4ba31

          SHA1

          715890ba3bda3431470cca4f4bc492c0f63fa138

          SHA256

          e6f4cf41373e8770c670cf5e85461f25385314ed9d8a2b37381bc84f5c0dd5c0

          SHA512

          9848f28fd96c21dd054cbf3e722e56373696c1f7803c137afc7c7203325d9738fa6b984d95cd49ff78a6d95c8f9406f869af3c3783901da3cc003e2b09497d65

        • \Users\Admin\AppData\Local\Temp\Tor\libssp-0.dll
          Filesize

          246KB

          MD5

          b77328da7cead5f4623748a70727860d

          SHA1

          13b33722c55cca14025b90060e3227db57bf5327

          SHA256

          46541d9e28c18bc11267630920b97c42f104c258b55e2f62e4a02bcd5f03e0e7

          SHA512

          2f1bd13357078454203092ed5ddc23a8baa5e64202fba1e4f98eacf1c3c184616e527468a96ff36d98b9324426dddfa20b62b38cf95c6f5c0dc32513ebace9e2

        • \Users\Admin\AppData\Local\Temp\Tor\libwinpthread-1.dll
          Filesize

          512KB

          MD5

          19d7cc4377f3c09d97c6da06fbabc7dc

          SHA1

          3a3ba8f397fb95ed5df22896b2c53a326662fcc9

          SHA256

          228fcfe9ed0574b8da32dd26eaf2f5dbaef0e1bd2535cb9b1635212ccdcbf84d

          SHA512

          23711285352cdec6815b5dd6e295ec50568fab7614706bc8d5328a4a0b62991c54b16126ed9e522471d2367b6f32fa35feb41bfa77b3402680d9a69f53962a4a

        • \Users\Admin\AppData\Local\Temp\Tor\zlib1.dll
          Filesize

          121KB

          MD5

          6f98da9e33cd6f3dd60950413d3638ac

          SHA1

          e630bdf8cebc165aa81464ff20c1d55272d05675

          SHA256

          219d9d5bf0de4c2251439c89dd5f2959ee582e7f9f7d5ff66a29c88753a3a773

          SHA512

          2983faaf7f47a8f79a38122aa617e65e7deddd19ba9a98b62acf17b48e5308099b852f21aaf8ca6fe11e2cc76c36eed7ffa3307877d4e67b1659fe6e4475205c

        • memory/268-55-0x0000000000000000-mapping.dmp
        • memory/520-56-0x0000000000000000-mapping.dmp
        • memory/924-82-0x0000000074730000-0x0000000074816000-memory.dmp
          Filesize

          920KB

        • memory/924-80-0x0000000074D10000-0x0000000074E0B000-memory.dmp
          Filesize

          1004KB

        • memory/924-89-0x0000000001060000-0x0000000001473000-memory.dmp
          Filesize

          4.1MB

        • memory/924-88-0x0000000001060000-0x0000000001473000-memory.dmp
          Filesize

          4.1MB

        • memory/924-60-0x0000000000000000-mapping.dmp
        • memory/924-70-0x0000000075211000-0x0000000075213000-memory.dmp
          Filesize

          8KB

        • memory/924-77-0x0000000074D10000-0x0000000074E0B000-memory.dmp
          Filesize

          1004KB

        • memory/924-78-0x0000000074700000-0x0000000074726000-memory.dmp
          Filesize

          152KB

        • memory/924-79-0x0000000001060000-0x0000000001473000-memory.dmp
          Filesize

          4.1MB

        • memory/924-87-0x0000000074730000-0x0000000074816000-memory.dmp
          Filesize

          920KB

        • memory/924-81-0x0000000074820000-0x0000000074B15000-memory.dmp
          Filesize

          3.0MB

        • memory/924-86-0x0000000074820000-0x0000000074B15000-memory.dmp
          Filesize

          3.0MB

        • memory/924-83-0x0000000074700000-0x0000000074726000-memory.dmp
          Filesize

          152KB

        • memory/924-84-0x0000000001060000-0x0000000001473000-memory.dmp
          Filesize

          4.1MB

        • memory/924-85-0x0000000074D10000-0x0000000074E0B000-memory.dmp
          Filesize

          1004KB

        • memory/1096-54-0x0000000000A20000-0x0000000000A7A000-memory.dmp
          Filesize

          360KB

        • memory/1360-57-0x0000000000000000-mapping.dmp
        • memory/1360-59-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp
          Filesize

          8KB

        • memory/1368-58-0x0000000000000000-mapping.dmp