eternity | 28fb5919e3a1fc15519abf1b5b9307dfadb14d8f6d3a983572aaed61583ceb9b

General

Target
620000.vbc.exe
Size 334KB
Sample221203-kgetfscb2t
SHA256 28fb5919e3a1fc15519abf1b5b9307dfadb14d8f6d3a983572aaed61583ceb9b
MD5 81255ba900760f07de634deb83472328
SHA1 b0573f0321587d845992f171ca5c6af8660fbbc7
SHA512 8972fa848656dc1696634aecc4d69d0c411bfe92708511e4300036dfd269aefdc47a7bda3c9c3ce029c4bebb924220684ebc45954b62ffc8059a7b787927a532
SSDEEP 6144:0FneHO3bFq1IeEEc9kGY4mNq0wnxJ9anp9bzi1GjFjsC:0FneUI1bWJvxJ94x5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

eternity collection spyware stealer

Malware Config

Extracted

Family

eternity

C2

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	620000.vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	620000.vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	620000.vbc.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3548	4660	WerFault.exe	83

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	620000.vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	620000.vbc.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4660	620000.vbc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4660	620000.vbc.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4660 wrote to memory of 536	4660	620000.vbc.exe	86
PID 4660 wrote to memory of 536	4660	620000.vbc.exe	86
PID 536 wrote to memory of 1592	536	cmd.exe	88
PID 536 wrote to memory of 1592	536	cmd.exe	88
PID 536 wrote to memory of 3968	536	cmd.exe	89
PID 536 wrote to memory of 3968	536	cmd.exe	89
PID 536 wrote to memory of 1824	536	cmd.exe	90
PID 536 wrote to memory of 1824	536	cmd.exe	90
PID 4660 wrote to memory of 1596	4660	620000.vbc.exe	91
PID 4660 wrote to memory of 1596	4660	620000.vbc.exe	91
PID 1596 wrote to memory of 3536	1596	cmd.exe	93
PID 1596 wrote to memory of 3536	1596	cmd.exe	93
PID 1596 wrote to memory of 4152	1596	cmd.exe	94
PID 1596 wrote to memory of 4152	1596	cmd.exe	94
PID 1596 wrote to memory of 4668	1596	cmd.exe	95
PID 1596 wrote to memory of 4668	1596	cmd.exe	95

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	620000.vbc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	620000.vbc.exe

C:\Users\Admin\AppData\Local\Temp\620000.vbc.exe
"C:\Users\Admin\AppData\Local\Temp\620000.vbc.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4660
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1592
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile
    3⤵
    PID:3968
- - C:\Windows\system32\findstr.exe
    findstr All
    3⤵
    PID:1824
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1596
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3536
- - C:\Windows\system32\netsh.exe
    netsh wlan show profile name="65001" key=clear
    3⤵
    PID:4152
- - C:\Windows\system32\findstr.exe
    findstr Key
    3⤵
    PID:4668
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4660 -s 1744
  2⤵
  - Program crash
  PID:3548

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 4660 -ip 4660
1⤵
PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4660-137-0x000001F8FB920000-0x000001F8FB970000-memory.dmp

Download

memory/4660-134-0x00007FFBB4C00000-0x00007FFBB56C1000-memory.dmp

Download

memory/4660-133-0x00007FFBB4C00000-0x00007FFBB56C1000-memory.dmp

Download

memory/4660-132-0x000001F8F86F0000-0x000001F8F874A000-memory.dmp

Download

memory/4660-144-0x00007FFBB4C00000-0x00007FFBB56C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads