eternity | 01a1484a30212f8511f04ed162f54d04e921598154bde03e3c594caa41d70342

General

Target

file.exe
Size

772KB
MD5

53a0423e947832839264d0587b5b713f
SHA1

9ed896985d20e83e309e8e7a2dac075840328b1a
SHA256

01a1484a30212f8511f04ed162f54d04e921598154bde03e3c594caa41d70342
SHA512

504db5eacd1b1f02e0adccc3a091ee22454a476fb01227d6afb7bfb124091ee759034ca521983c1d5c83fa5dda92bc2a796435bb71bc18291d006d0148b1abd4
SSDEEP

12288:elDRU68atsFb35lj/KtgtmMoMkZaFS1yVmW13nevA8jHV2KaVfpdw1:yU68atsxz4gtmMSvW13neIi12KaVo1

Score

10^/10

eternity redline doc collection infostealer spyware stealer

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Extracted

Family

redline

Botnet

doc

C2

81.161.229.143:26910

Attributes

auth_value
e067ff186bbd1a16b906849c2001d852

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1876-153-0x0000000000400000-0x0000000000460000-memory.dmp	family_redline

Executes dropped EXE 1 IoCs

Processes:

Stealer.exe

pid process

3460 Stealer.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

file.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation file.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3460	Stealer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	file.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

Stealer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Stealer.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Stealer.exe
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Stealer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

file.exe

description pid process target process

PID 4412 set thread context of 1876 4412 file.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
16	ip-api.com

description	pid	process	target process
PID 4412 set thread context of 1876	4412	file.exe	InstallUtil.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Stealer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Stealer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Stealer.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

file.exeStealer.exeInstallUtil.exe

pid process

4412 file.exe
4412 file.exe
3460 Stealer.exe
1876 InstallUtil.exe
1876 InstallUtil.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

file.exeStealer.exeInstallUtil.exe

description pid process

Token: SeDebugPrivilege 4412 file.exe
Token: SeDebugPrivilege 3460 Stealer.exe
Token: SeDebugPrivilege 1876 InstallUtil.exe

pid	process
4412	file.exe
4412	file.exe
3460	Stealer.exe
1876	InstallUtil.exe
1876	InstallUtil.exe

description	pid	process
Token: SeDebugPrivilege	4412	file.exe
Token: SeDebugPrivilege	3460	Stealer.exe
Token: SeDebugPrivilege	1876	InstallUtil.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

file.exeStealer.execmd.execmd.exe

description	pid	process	target process
PID 4412 wrote to memory of 3460	4412	file.exe	Stealer.exe
PID 4412 wrote to memory of 3460	4412	file.exe	Stealer.exe
PID 3460 wrote to memory of 4540	3460	Stealer.exe	cmd.exe
PID 3460 wrote to memory of 4540	3460	Stealer.exe	cmd.exe
PID 4412 wrote to memory of 1876	4412	file.exe	InstallUtil.exe
PID 4412 wrote to memory of 1876	4412	file.exe	InstallUtil.exe
PID 4412 wrote to memory of 1876	4412	file.exe	InstallUtil.exe
PID 4540 wrote to memory of 3132	4540	cmd.exe	chcp.com
PID 4540 wrote to memory of 3132	4540	cmd.exe	chcp.com
PID 4412 wrote to memory of 1876	4412	file.exe	InstallUtil.exe
PID 4412 wrote to memory of 1876	4412	file.exe	InstallUtil.exe
PID 4540 wrote to memory of 4852	4540	cmd.exe	netsh.exe
PID 4540 wrote to memory of 4852	4540	cmd.exe	netsh.exe
PID 4412 wrote to memory of 1876	4412	file.exe	InstallUtil.exe
PID 4412 wrote to memory of 1876	4412	file.exe	InstallUtil.exe
PID 4412 wrote to memory of 1876	4412	file.exe	InstallUtil.exe
PID 4540 wrote to memory of 1776	4540	cmd.exe	findstr.exe
PID 4540 wrote to memory of 1776	4540	cmd.exe	findstr.exe
PID 3460 wrote to memory of 3128	3460	Stealer.exe	cmd.exe
PID 3460 wrote to memory of 3128	3460	Stealer.exe	cmd.exe
PID 3128 wrote to memory of 5116	3128	cmd.exe	chcp.com
PID 3128 wrote to memory of 5116	3128	cmd.exe	chcp.com
PID 3128 wrote to memory of 5092	3128	cmd.exe	netsh.exe
PID 3128 wrote to memory of 5092	3128	cmd.exe	netsh.exe
PID 3128 wrote to memory of 1500	3128	cmd.exe	findstr.exe
PID 3128 wrote to memory of 1500	3128	cmd.exe	findstr.exe

outlook_office_path 1 IoCs

Processes:

Stealer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Stealer.exe

outlook_win_path 1 IoCs

Processes:

Stealer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Stealer.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Stealer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Stealer.exe"
2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:3460

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
3⤵
- Suspicious use of WriteProcessMemory
PID:4540

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:3132

C:\Windows\system32\netsh.exe
netsh wlan show profile
4⤵
PID:4852

C:\Windows\system32\findstr.exe
findstr All
4⤵
PID:1776

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
3⤵
- Suspicious use of WriteProcessMemory
PID:3128

C:\Windows\system32\chcp.com
chcp 65001
4⤵
PID:5116

C:\Windows\system32\netsh.exe
netsh wlan show profile name="65001" key=clear
4⤵
PID:5092

C:\Windows\system32\findstr.exe
findstr Key
4⤵
PID:1500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1876

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Stealer.exe
Filesize
337KB

MD5
d5cb2b8049acbe8f4b9fcbe032e330d0

SHA1
560614f0290add2a03e2464b38e2b9b1e3e4674d

SHA256
1108265349efc840f7d3ed392113cf5cb11f4327887dd3286296e7aab4c6687f

SHA512
ddd79498d5918dd0c29cdecd803c2e0e2a835f8b56fd7e83ddaf342b195262c0566c859b3434251b81d77e556a721878990df6da2676757fde486c9f085740a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Stealer.exe
Filesize
337KB

MD5
d5cb2b8049acbe8f4b9fcbe032e330d0

SHA1
560614f0290add2a03e2464b38e2b9b1e3e4674d

SHA256
1108265349efc840f7d3ed392113cf5cb11f4327887dd3286296e7aab4c6687f

SHA512
ddd79498d5918dd0c29cdecd803c2e0e2a835f8b56fd7e83ddaf342b195262c0566c859b3434251b81d77e556a721878990df6da2676757fde486c9f085740a9

Download Submit
memory/1500-151-0x0000000000000000-mapping.dmp

Download
memory/1776-147-0x0000000000000000-mapping.dmp

Download
memory/1876-160-0x000000000B810000-0x000000000B860000-memory.dmp

Filesize
320KB

Download
memory/1876-158-0x000000000B310000-0x000000000B376000-memory.dmp

Filesize
408KB

Download
memory/1876-159-0x000000000B790000-0x000000000B806000-memory.dmp

Filesize
472KB

Download
memory/1876-161-0x000000000CE70000-0x000000000D032000-memory.dmp

Filesize
1.8MB

Download
memory/1876-157-0x000000000A7E0000-0x000000000A81C000-memory.dmp

Filesize
240KB

Download
memory/1876-156-0x000000000A780000-0x000000000A792000-memory.dmp

Filesize
72KB

Download
memory/1876-155-0x000000000A850000-0x000000000A95A000-memory.dmp

Filesize
1.0MB

Download
memory/1876-154-0x000000000ACF0000-0x000000000B308000-memory.dmp

Filesize
6.1MB

Download
memory/1876-144-0x0000000000000000-mapping.dmp

Download
memory/1876-153-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/1876-162-0x000000000D570000-0x000000000DA9C000-memory.dmp

Filesize
5.2MB

Download
memory/3128-148-0x0000000000000000-mapping.dmp

Download
memory/3132-145-0x0000000000000000-mapping.dmp

Download
memory/3460-141-0x00007FFD41280000-0x00007FFD41D41000-memory.dmp

Filesize
10.8MB

Download
memory/3460-140-0x0000015BC6A80000-0x0000015BC6ADA000-memory.dmp

Filesize
360KB

Download
memory/3460-163-0x00007FFD41280000-0x00007FFD41D41000-memory.dmp

Filesize
10.8MB

Download
memory/3460-152-0x00007FFD41280000-0x00007FFD41D41000-memory.dmp

Filesize
10.8MB

Download
memory/3460-137-0x0000000000000000-mapping.dmp

Download
memory/3460-143-0x0000015BE1E00000-0x0000015BE1E50000-memory.dmp

Filesize
320KB

Download
memory/4412-136-0x0000000006D10000-0x0000000006D1A000-memory.dmp

Filesize
40KB

Download
memory/4412-132-0x0000000000610000-0x00000000006C2000-memory.dmp

Filesize
712KB

Download
memory/4412-135-0x00000000057E0000-0x0000000005872000-memory.dmp

Filesize
584KB

Download
memory/4412-134-0x0000000005D90000-0x0000000006334000-memory.dmp

Filesize
5.6MB

Download
memory/4412-133-0x0000000005740000-0x00000000057DC000-memory.dmp

Filesize
624KB

Download
memory/4540-142-0x0000000000000000-mapping.dmp

Download
memory/4852-146-0x0000000000000000-mapping.dmp

Download
memory/5092-150-0x0000000000000000-mapping.dmp

Download
memory/5116-149-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads