Overview

overview

10

Static

static

10

4cbdc3c3e5...d0.exe

windows7-x64

10

4cbdc3c3e5...d0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    42s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 09:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4cbdc3c3e547443e0823133a8b60e9d0.exe

  • Size

    1.9MB

  • MD5

    4cbdc3c3e547443e0823133a8b60e9d0

  • SHA1

    60dadbf030c46b39c49f26ea0c63b641054b0868

  • SHA256

    d7a78307889ab55af6a1475ef731eaf1b19524601e093220afa3830707ff4810

  • SHA512

    279bd66342c8fcd5ab473fe9803e616bcf0c15bc465253e0c48cb66333cb24dde0e25110d47c1ef042de271e0ff5bd1c00674ac8b84811c1edadeb5554ed5ef9

  • SSDEEP

    49152:rUemzJa9HGZwhL28UOHQUrvqY8ejOmuPy:r1mk9HGZ4L28UOHQUuYiB

Score
10/10
eternity

Malware Config

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cbdc3c3e547443e0823133a8b60e9d0.exe
    "C:\Users\Admin\AppData\Local\Temp\4cbdc3c3e547443e0823133a8b60e9d0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1000
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:1612
    • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
      "C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:812
      • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
        "{path}"
        3⤵
        • Executes dropped EXE
        PID:1632
      • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
        "{path}"
        3⤵
        • Executes dropped EXE
        PID:844
      • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
        "{path}"
        3⤵
        • Executes dropped EXE
        PID:536
      • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
        "{path}"
        3⤵
        • Executes dropped EXE
        PID:1028
      • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
        "{path}"
        3⤵
        • Executes dropped EXE
        PID:1608

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
    Filesize

    1.8MB

    MD5

    68d348019229f619929995cf7f7dfa4d

    SHA1

    9e2f888c42d51f91c900bec478e703fe145e1a54

    SHA256

    6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

    SHA512

    31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
    Filesize

    1.8MB

    MD5

    68d348019229f619929995cf7f7dfa4d

    SHA1

    9e2f888c42d51f91c900bec478e703fe145e1a54

    SHA256

    6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

    SHA512

    31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
    Filesize

    1.8MB

    MD5

    68d348019229f619929995cf7f7dfa4d

    SHA1

    9e2f888c42d51f91c900bec478e703fe145e1a54

    SHA256

    6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

    SHA512

    31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
    Filesize

    1.8MB

    MD5

    68d348019229f619929995cf7f7dfa4d

    SHA1

    9e2f888c42d51f91c900bec478e703fe145e1a54

    SHA256

    6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

    SHA512

    31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
    Filesize

    1.8MB

    MD5

    68d348019229f619929995cf7f7dfa4d

    SHA1

    9e2f888c42d51f91c900bec478e703fe145e1a54

    SHA256

    6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

    SHA512

    31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
    Filesize

    1.8MB

    MD5

    68d348019229f619929995cf7f7dfa4d

    SHA1

    9e2f888c42d51f91c900bec478e703fe145e1a54

    SHA256

    6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

    SHA512

    31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
    Filesize

    1.8MB

    MD5

    68d348019229f619929995cf7f7dfa4d

    SHA1

    9e2f888c42d51f91c900bec478e703fe145e1a54

    SHA256

    6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

    SHA512

    31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.txt
    Filesize

    1KB

    MD5

    9aa668d8646de2af1c2ff69441224905

    SHA1

    c98ada8ea9571af448e88d1e9d1dca6538046848

    SHA256

    85ac0909ffe96915433c40d85959efe8e7571fb659dffdc0f72a32d113ccc31c

    SHA512

    43468e125ab106edbcb1f7a49bbe919f2d833a0a88e349938ef35fd6024d9921d4921a6244ba630fcf3ba34fa4a46659f90f6a88900471286ee95220182329d2

    Download Submit

  • \Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
    Filesize

    1.8MB

    MD5

    68d348019229f619929995cf7f7dfa4d

    SHA1

    9e2f888c42d51f91c900bec478e703fe145e1a54

    SHA256

    6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

    SHA512

    31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    Download Submit

  • \Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
    Filesize

    1.8MB

    MD5

    68d348019229f619929995cf7f7dfa4d

    SHA1

    9e2f888c42d51f91c900bec478e703fe145e1a54

    SHA256

    6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

    SHA512

    31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    Download Submit

  • \Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
    Filesize

    1.8MB

    MD5

    68d348019229f619929995cf7f7dfa4d

    SHA1

    9e2f888c42d51f91c900bec478e703fe145e1a54

    SHA256

    6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

    SHA512

    31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    Download Submit

  • \Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
    Filesize

    1.8MB

    MD5

    68d348019229f619929995cf7f7dfa4d

    SHA1

    9e2f888c42d51f91c900bec478e703fe145e1a54

    SHA256

    6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

    SHA512

    31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    Download Submit

  • \Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
    Filesize

    1.8MB

    MD5

    68d348019229f619929995cf7f7dfa4d

    SHA1

    9e2f888c42d51f91c900bec478e703fe145e1a54

    SHA256

    6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

    SHA512

    31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    Download Submit

  • \Users\Admin\AppData\Local\Temp\dd_dotNetFx40_Full_x86_x64_decompression_log.exe
    Filesize

    1.8MB

    MD5

    68d348019229f619929995cf7f7dfa4d

    SHA1

    9e2f888c42d51f91c900bec478e703fe145e1a54

    SHA256

    6a3e51e28e36cd97a2583a95027eb800a228e40572070be67ec9fcd5790e2077

    SHA512

    31bb14a79825d2c86fce283ff928accf8e387da06dff03614ab50c55ab18aa9ef7ad055f5c3569529bffae8d9d5c9891b31e54da3d5e58a0f173fc6af0ef51a6

    Download Submit

  • memory/812-67-0x000000000BC80000-0x000000000BDD2000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/812-66-0x0000000007F80000-0x0000000008124000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/812-65-0x0000000000440000-0x0000000000452000-memory.dmp

    Filesize

    72KB

    Download

  • memory/812-63-0x0000000000260000-0x000000000043E000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1000-54-0x00000000010C0000-0x00000000012AA000-memory.dmp

    Filesize

    1.9MB

    Download

  • memory/1000-55-0x0000000076561000-0x0000000076563000-memory.dmp

    Filesize

    8KB

    Download