Analysis
- max time kernel
144s - max time network
195s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
03/12/2022, 08:34
General
- Target 620000.vbc.exe
- Size 334KB
- Sample221203-kgetfscb2t
- SHA256 28fb5919e3a1fc15519abf1b5b9307dfadb14d8f6d3a983572aaed61583ceb9b
Malware Config
Extracted
-
eternity
-
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
Signatures
- Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 7 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\620000.vbc.exe"C:\Users\Admin\AppData\Local\Temp\620000.vbc.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\netsh.exenetsh wlan show profile3⤵
-
-
C:\Windows\system32\findstr.exefindstr All3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe"C:\Users\Admin\AppData\Local\Temp\Tor\Tor.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
libcrypto-1_1.dll
libevent-2-1-7.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
tor.exe
zlib1.dll
libcrypto-1_1.dll
libevent-2-1-7.dll
libgcc_s_sjlj-1.dll
libssl-1_1.dll
libssp-0.dll
libwinpthread-1.dll
zlib1.dll
memory/592-70-0x0000000075B11000-0x0000000075B13000-memory.dmp
memory/592-82-0x00000000746E0000-0x00000000747C6000-memory.dmp
memory/592-85-0x0000000000CA0000-0x00000000010B3000-memory.dmp
memory/592-84-0x0000000000CA0000-0x00000000010B3000-memory.dmp
memory/592-83-0x00000000746B0000-0x00000000746D6000-memory.dmp
memory/592-81-0x00000000747D0000-0x0000000074AC5000-memory.dmp
memory/592-80-0x0000000074CF0000-0x0000000074DEB000-memory.dmp
memory/592-77-0x0000000074CF0000-0x0000000074DEB000-memory.dmp
memory/592-78-0x00000000746B0000-0x00000000746D6000-memory.dmp
memory/592-79-0x0000000000CA0000-0x00000000010B3000-memory.dmp
memory/780-59-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp
memory/1160-54-0x00000000003F0000-0x000000000044A000-memory.dmp