Analysis
-
max time kernel
195s -
max time network
216s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 16:53
Static task
static1
Behavioral task
behavioral1
Sample
e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe
Resource
win10v2004-20221111-en
General
-
Target
e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe
-
Size
2.2MB
-
MD5
9b04bee73265c18fb37dc762ad0ef630
-
SHA1
601ae17fc243ff04210226840d311056afac1ac3
-
SHA256
e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc
-
SHA512
3fdec20d310f8e62ac8c3a528e159cca6f14b17cf36cc1bc0084fba8c4aca50fc904d731523b68bcf2a742afe4afcf8d5d40fb8825f79b75762c8234a84577f9
-
SSDEEP
49152:nvhJpDW35RtymHRno4q4YISDt/tvs1nYtUL0EgLh:nvJDWB/YISDtFsFYtULaV
Malware Config
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
-
payload_urls
http://167.88.170.23/w993.exe
http://167.88.170.23/s101.exe,http://167.88.170.23/101.exe,http://167.88.170.23/R101.exe
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Executes dropped EXE 2 IoCs
Processes:
e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exee8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exepid process 4072 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe 4700 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exee8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exedescription pid process target process PID 1680 set thread context of 3820 1680 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 4072 set thread context of 4700 4072 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exedescription pid process Token: SeDebugPrivilege 4700 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exee8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.execmd.exee8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exedescription pid process target process PID 1680 wrote to memory of 3820 1680 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 1680 wrote to memory of 3820 1680 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 1680 wrote to memory of 3820 1680 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 1680 wrote to memory of 3820 1680 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 1680 wrote to memory of 3820 1680 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 1680 wrote to memory of 3820 1680 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 1680 wrote to memory of 3820 1680 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 1680 wrote to memory of 3820 1680 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 3820 wrote to memory of 1472 3820 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe cmd.exe PID 3820 wrote to memory of 1472 3820 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe cmd.exe PID 3820 wrote to memory of 1472 3820 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe cmd.exe PID 1472 wrote to memory of 4124 1472 cmd.exe chcp.com PID 1472 wrote to memory of 4124 1472 cmd.exe chcp.com PID 1472 wrote to memory of 4124 1472 cmd.exe chcp.com PID 1472 wrote to memory of 1988 1472 cmd.exe PING.EXE PID 1472 wrote to memory of 1988 1472 cmd.exe PING.EXE PID 1472 wrote to memory of 1988 1472 cmd.exe PING.EXE PID 1472 wrote to memory of 1724 1472 cmd.exe schtasks.exe PID 1472 wrote to memory of 1724 1472 cmd.exe schtasks.exe PID 1472 wrote to memory of 1724 1472 cmd.exe schtasks.exe PID 1472 wrote to memory of 4072 1472 cmd.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 1472 wrote to memory of 4072 1472 cmd.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 1472 wrote to memory of 4072 1472 cmd.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 4072 wrote to memory of 4700 4072 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 4072 wrote to memory of 4700 4072 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 4072 wrote to memory of 4700 4072 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 4072 wrote to memory of 4700 4072 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 4072 wrote to memory of 4700 4072 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 4072 wrote to memory of 4700 4072 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 4072 wrote to memory of 4700 4072 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe PID 4072 wrote to memory of 4700 4072 e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe"C:\Users\Admin\AppData\Local\Temp\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe"{path}"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\ServiceHub\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe"C:\Users\Admin\AppData\Local\ServiceHub\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ServiceHub\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe"{path}"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exe.logFilesize
1KB
MD584e77a587d94307c0ac1357eb4d3d46f
SHA183cc900f9401f43d181207d64c5adba7a85edc1e
SHA256e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
-
C:\Users\Admin\AppData\Local\ServiceHub\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exeFilesize
2.2MB
MD59b04bee73265c18fb37dc762ad0ef630
SHA1601ae17fc243ff04210226840d311056afac1ac3
SHA256e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc
SHA5123fdec20d310f8e62ac8c3a528e159cca6f14b17cf36cc1bc0084fba8c4aca50fc904d731523b68bcf2a742afe4afcf8d5d40fb8825f79b75762c8234a84577f9
-
C:\Users\Admin\AppData\Local\ServiceHub\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exeFilesize
2.2MB
MD59b04bee73265c18fb37dc762ad0ef630
SHA1601ae17fc243ff04210226840d311056afac1ac3
SHA256e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc
SHA5123fdec20d310f8e62ac8c3a528e159cca6f14b17cf36cc1bc0084fba8c4aca50fc904d731523b68bcf2a742afe4afcf8d5d40fb8825f79b75762c8234a84577f9
-
C:\Users\Admin\AppData\Local\ServiceHub\e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc.exeFilesize
2.2MB
MD59b04bee73265c18fb37dc762ad0ef630
SHA1601ae17fc243ff04210226840d311056afac1ac3
SHA256e8eeec263be0e7b249b8e16ef458a6d4c5241d5fb868e975666bab0658344edc
SHA5123fdec20d310f8e62ac8c3a528e159cca6f14b17cf36cc1bc0084fba8c4aca50fc904d731523b68bcf2a742afe4afcf8d5d40fb8825f79b75762c8234a84577f9
-
memory/1472-140-0x0000000000000000-mapping.dmp
-
memory/1680-137-0x00000000057A0000-0x00000000057AA000-memory.dmpFilesize
40KB
-
memory/1680-133-0x0000000000BD0000-0x0000000000E08000-memory.dmpFilesize
2.2MB
-
memory/1680-136-0x0000000005950000-0x00000000059EC000-memory.dmpFilesize
624KB
-
memory/1680-135-0x00000000057B0000-0x0000000005842000-memory.dmpFilesize
584KB
-
memory/1680-134-0x0000000005E60000-0x0000000006404000-memory.dmpFilesize
5.6MB
-
memory/1724-144-0x0000000000000000-mapping.dmp
-
memory/1988-143-0x0000000000000000-mapping.dmp
-
memory/3820-139-0x0000000000400000-0x0000000000552000-memory.dmpFilesize
1.3MB
-
memory/3820-138-0x0000000000000000-mapping.dmp
-
memory/4072-145-0x0000000000000000-mapping.dmp
-
memory/4124-142-0x0000000000000000-mapping.dmp
-
memory/4700-148-0x0000000000000000-mapping.dmp