Analysis

  • max time kernel
    91s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-09-2022 06:27

General

  • Target

    0x00090000000139f7-58.exe

  • Size

    334KB

  • MD5

    126fe59c0f926132abfef83696fc9aac

  • SHA1

    c4f2047455d5f02af5ec8cf9644f8cd491fd7e46

  • SHA256

    fa2a334940cbe72ec5ac5fb691299d9964b6de2a778172c9b8d6738a9cdbd01b

  • SHA512

    36927d1d03463220057b1acd58a45dc9a6cf9f25d21652c35dc891125ce4da36807aea90548cf0a4dfc6c2e2c3ffab893fa2426831866182436d8242522549a5

Malware Config

Extracted

Family

eternity

C2

http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles ⋅ 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 ⋅ 1 TTPs
  • Looks up external IP address via web service ⋅ 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry ⋅ 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 16 IoCs
  • outlook_office_path ⋅ 1 IoCs
  • outlook_win_path ⋅ 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x00090000000139f7-58.exe
    "C:\Users\Admin\AppData\Local\Temp\0x00090000000139f7-58.exe"
    Accesses Microsoft Outlook profiles
    Checks processor information in registry
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    outlook_office_path
    outlook_win_path
    PID:4972
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      Suspicious use of WriteProcessMemory
      PID:4512
      • C:\Windows\system32\chcp.com
        chcp 65001
        PID:4184
      • C:\Windows\system32\netsh.exe
        netsh wlan show profile
        PID:5016
      • C:\Windows\system32\findstr.exe
        findstr All
        PID:4528
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
      Suspicious use of WriteProcessMemory
      PID:2208
      • C:\Windows\system32\chcp.com
        chcp 65001
        PID:220
      • C:\Windows\system32\netsh.exe
        netsh wlan show profile name="65001" key=clear
        PID:388
      • C:\Windows\system32\findstr.exe
        findstr Key
        PID:1776

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Persistence

                Privilege Escalation

                  Replay Monitor

                  00:00 00:00

                  Downloads

                  • memory/220-140-0x0000000000000000-mapping.dmp
                  • memory/388-141-0x0000000000000000-mapping.dmp
                  • memory/1776-142-0x0000000000000000-mapping.dmp
                  • memory/2208-139-0x0000000000000000-mapping.dmp
                  • memory/4184-136-0x0000000000000000-mapping.dmp
                  • memory/4512-134-0x0000000000000000-mapping.dmp
                  • memory/4528-138-0x0000000000000000-mapping.dmp
                  • memory/4972-132-0x000001A0A1D60000-0x000001A0A1DBA000-memory.dmp
                  • memory/4972-133-0x00007FFBDC0C0000-0x00007FFBDCB81000-memory.dmp
                  • memory/4972-135-0x000001A0BD280000-0x000001A0BD2D0000-memory.dmp
                  • memory/4972-143-0x00007FFBDC0C0000-0x00007FFBDCB81000-memory.dmp
                  • memory/5016-137-0x0000000000000000-mapping.dmp