Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
21/03/2023, 14:30
General
-
Target
479354191ee61a48e8330c242c25cc40fab9d14e8ae11c46bab377a9ca72fe20.exe
-
Size
5.7MB
-
MD5
0c158c613020ccee1f0a847af22e812b
-
SHA1
1782efa3990505c5eaa67ae97fdd58acdd7fa77d
-
SHA256
479354191ee61a48e8330c242c25cc40fab9d14e8ae11c46bab377a9ca72fe20
-
SHA512
e4e9be53b79e417a7ae97288aa1fb79eeaa5253c70524bc1dd87acd6d3838e4d7ad7e3ecbdbb00835a56d77fcb59080d6727147c88af1dd0c5ea37338c57d6b0
-
SSDEEP
98304:fA0BK0SjRd/sgrZxumE0+j75AVSiFwntBgYGPFW4R7o+mSA1IJlWw20unynRQ:fAKVqd0gtxp+IFsg/hVmSAy6Eq
Malware Config
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 7 IoCs
-
Loads dropped DLL 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies system certificate store 2 TTPs 13 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\479354191ee61a48e8330c242c25cc40fab9d14e8ae11c46bab377a9ca72fe20.exe"C:\Users\Admin\AppData\Local\Temp\479354191ee61a48e8330c242c25cc40fab9d14e8ae11c46bab377a9ca72fe20.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\installer.exeC:\Users\Admin\AppData\Local\Temp\installer.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=83.0.4254.70 --initial-client-data=0x2b0,0x2b4,0x2b8,0x28c,0x2bc,0x7ff9b1a3f0f0,0x7ff9b1a3f100,0x7ff9b1a3f1103⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\installer.exe" --version3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202303211530231\assistant\_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202303211530231\assistant\_sfx.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202303211530231\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202303211530231\assistant\assistant_installer.exe" --version3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202303211530231\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202303211530231\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0xa34f48,0xa34f58,0xa34f644⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp2F32.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp2F32.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD59da5ef057aa459e93ede916babe0289b
SHA1e7f5c0001c4ebae21a9b2175d81881b1e438b2a4
SHA2560b4efa63f5a70afd9f14231bdc20f943b9ac5907d1ccfa9bb8f5f0c9dcdf8072
SHA512e5e4eadcfe36192f73794019c5bec3d27e0269c7615fbad79922a38b10b9c23c780389f57e423659c6d397c316e984605c880f815fef136a9e0e5c04d3ca4a3b
-
Filesize
1.4MB
MD5e9a2209b61f4be34f25069a6e54affea
SHA16368b0a81608c701b06b97aeff194ce88fd0e3c0
SHA256e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f
SHA51259e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5
-
Filesize
1.4MB
MD5e9a2209b61f4be34f25069a6e54affea
SHA16368b0a81608c701b06b97aeff194ce88fd0e3c0
SHA256e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f
SHA51259e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5
-
Filesize
1.4MB
MD5e9a2209b61f4be34f25069a6e54affea
SHA16368b0a81608c701b06b97aeff194ce88fd0e3c0
SHA256e950f17f4181009eeafa9f5306e8a9dfd26d88ca63b1838f44ff0efc738e7d1f
SHA51259e46277ca79a43ed8b0a25b24eff013e251a75f90587e013b9c12851e5dd7283b6172f7d48583982f6a32069457778ee440025c1c754bf7bb6ce8ae1d2c3fc5
-
Filesize
1.8MB
MD54c8fbed0044da34ad25f781c3d117a66
SHA18dd93340e3d09de993c3bc12db82680a8e69d653
SHA256afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a
SHA512a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481
-
Filesize
1.8MB
MD54c8fbed0044da34ad25f781c3d117a66
SHA18dd93340e3d09de993c3bc12db82680a8e69d653
SHA256afe569ce9e4f71c23ba5f6e8fd32be62ac9538e397cde8f2ecbe46faa721242a
SHA512a04e6fd052d2d63a0737c83702c66a9af834f9df8423666508c42b3e1d8384300239c9ddacdc31c1e85140eb1193bcfac209f218750b40342492ffce6e9da481
-
Filesize
105.7MB
MD5cfc5c08412c1b719c2e883a87604956d
SHA1bcc4627949c0a8991cf23fe8b615d3eebb4e5877
SHA256d0b7845134eea98b642e6673d65ecf925a905fa7c8564b18e13d52657c30d41a
SHA5120df58e06d49c29afe91889738943c4ef392ceac24c9eeda0642c9802562a29ed6b6f2071562b19881da1e744b264e00ea73cf4bae4a8d7b79c34ef19a94f8f44
-
Filesize
5.1MB
MD52286476af15d1f242c263395e82b1ebb
SHA1b6b339a6282d27b9400002ff5983be4cde9dc9b9
SHA25623d22d6f87dd63327d2ac7b376d1ab2c9e4fe70a60b5c7784d6b9b1a1d0274fa
SHA512218d212ae57cfd25773c323220feeb5a8187f9db775fb09a65cf17f603dc6882f4c2a2e45c16fac5387299a3868a902bc68c68dc1ff0e93a4346b8f8ebe3ebbe
-
Filesize
5.1MB
MD52286476af15d1f242c263395e82b1ebb
SHA1b6b339a6282d27b9400002ff5983be4cde9dc9b9
SHA25623d22d6f87dd63327d2ac7b376d1ab2c9e4fe70a60b5c7784d6b9b1a1d0274fa
SHA512218d212ae57cfd25773c323220feeb5a8187f9db775fb09a65cf17f603dc6882f4c2a2e45c16fac5387299a3868a902bc68c68dc1ff0e93a4346b8f8ebe3ebbe
-
Filesize
5.1MB
MD52286476af15d1f242c263395e82b1ebb
SHA1b6b339a6282d27b9400002ff5983be4cde9dc9b9
SHA25623d22d6f87dd63327d2ac7b376d1ab2c9e4fe70a60b5c7784d6b9b1a1d0274fa
SHA512218d212ae57cfd25773c323220feeb5a8187f9db775fb09a65cf17f603dc6882f4c2a2e45c16fac5387299a3868a902bc68c68dc1ff0e93a4346b8f8ebe3ebbe
-
Filesize
5.1MB
MD52286476af15d1f242c263395e82b1ebb
SHA1b6b339a6282d27b9400002ff5983be4cde9dc9b9
SHA25623d22d6f87dd63327d2ac7b376d1ab2c9e4fe70a60b5c7784d6b9b1a1d0274fa
SHA512218d212ae57cfd25773c323220feeb5a8187f9db775fb09a65cf17f603dc6882f4c2a2e45c16fac5387299a3868a902bc68c68dc1ff0e93a4346b8f8ebe3ebbe
-
Filesize
5.6MB
MD59da5ef057aa459e93ede916babe0289b
SHA1e7f5c0001c4ebae21a9b2175d81881b1e438b2a4
SHA2560b4efa63f5a70afd9f14231bdc20f943b9ac5907d1ccfa9bb8f5f0c9dcdf8072
SHA512e5e4eadcfe36192f73794019c5bec3d27e0269c7615fbad79922a38b10b9c23c780389f57e423659c6d397c316e984605c880f815fef136a9e0e5c04d3ca4a3b
-
Filesize
5.6MB
MD59da5ef057aa459e93ede916babe0289b
SHA1e7f5c0001c4ebae21a9b2175d81881b1e438b2a4
SHA2560b4efa63f5a70afd9f14231bdc20f943b9ac5907d1ccfa9bb8f5f0c9dcdf8072
SHA512e5e4eadcfe36192f73794019c5bec3d27e0269c7615fbad79922a38b10b9c23c780389f57e423659c6d397c316e984605c880f815fef136a9e0e5c04d3ca4a3b
-
Filesize
5.6MB
MD59da5ef057aa459e93ede916babe0289b
SHA1e7f5c0001c4ebae21a9b2175d81881b1e438b2a4
SHA2560b4efa63f5a70afd9f14231bdc20f943b9ac5907d1ccfa9bb8f5f0c9dcdf8072
SHA512e5e4eadcfe36192f73794019c5bec3d27e0269c7615fbad79922a38b10b9c23c780389f57e423659c6d397c316e984605c880f815fef136a9e0e5c04d3ca4a3b
-
Filesize
5.6MB
MD59da5ef057aa459e93ede916babe0289b
SHA1e7f5c0001c4ebae21a9b2175d81881b1e438b2a4
SHA2560b4efa63f5a70afd9f14231bdc20f943b9ac5907d1ccfa9bb8f5f0c9dcdf8072
SHA512e5e4eadcfe36192f73794019c5bec3d27e0269c7615fbad79922a38b10b9c23c780389f57e423659c6d397c316e984605c880f815fef136a9e0e5c04d3ca4a3b
-
Filesize
76KB
MD5dbb92d6b3c324f8871bc508830b05c14
SHA14507d24c7d78a24fe5d92f916ed972709529ced0
SHA256376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8
SHA512d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a
-
Filesize
76KB
MD5dbb92d6b3c324f8871bc508830b05c14
SHA14507d24c7d78a24fe5d92f916ed972709529ced0
SHA256376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8
SHA512d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a
-
Filesize
76KB
MD5dbb92d6b3c324f8871bc508830b05c14
SHA14507d24c7d78a24fe5d92f916ed972709529ced0
SHA256376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8
SHA512d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a
-
Filesize
40B
MD5adc7558a130924d9ffdacdaacf617cd5
SHA14da0bf5ebd4b18f737d2831a2a9d8dd968d90ee6
SHA25628763e2cf04b7e5a9e6f1eda9ab5917cf5f44586fe1016f8857f88d3ef082741
SHA51228025a96810696079f97d2ba68d2c0a55a942048ea8f63c018f7d4a069054abd61dc6a2b82613b15ec5cc7d7d3ebaf329c7e63ee0fd9be55085bbf13d3908d75
-
Filesize
40B
MD5adc7558a130924d9ffdacdaacf617cd5
SHA14da0bf5ebd4b18f737d2831a2a9d8dd968d90ee6
SHA25628763e2cf04b7e5a9e6f1eda9ab5917cf5f44586fe1016f8857f88d3ef082741
SHA51228025a96810696079f97d2ba68d2c0a55a942048ea8f63c018f7d4a069054abd61dc6a2b82613b15ec5cc7d7d3ebaf329c7e63ee0fd9be55085bbf13d3908d75
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
5.7MB
-
Filesize
64KB