Resubmissions

11-12-2023 22:40

231211-2lhvcaaefk 10

20-05-2023 01:00

230520-bc6lyahd59 10

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2023 01:00

General

  • Target

    e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe

  • Size

    2.1MB

  • MD5

    141fab15a9ee48b8caadd462553dbff3

  • SHA1

    36797395bb85f08ac5cf7eacb81c8d9ce78b3701

  • SHA256

    e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454

  • SHA512

    67ff417f350ba875ea4af66088e7bd9f91ee39c52ff4ad27b34526a506efbeb1a14258cca39762d87d8f98f0c6b8427ecc784fc9df4fade95d0f2b3bf86be6ca

  • SSDEEP

    49152:KFMqbjBFzfnVMDpUFvPnA4UCV1a56xd/BOEZb8v/:4M2NVfVMDpUFvmczxB4A

Score
10/10

Malware Config

Extracted

Family

eternity

Attributes
  • payload_urls

    http://167.88.170.23/swo/sw.exe

    http://167.88.170.23/swo/swo.exe,http://167.88.170.23/1300.exe

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
    "C:\Users\Admin\AppData\Local\Temp\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SRLHjykjP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF5BF.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2784
    • C:\Users\Admin\AppData\Local\Temp\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
      "{path}"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:812
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2404
        • C:\Windows\SysWOW64\chcp.com
          chcp 65001
          4⤵
            PID:2492
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1
            4⤵
            • Runs ping.exe
            PID:1688
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe" /rl HIGHEST /f
            4⤵
            • Creates scheduled task(s)
            PID:1788
          • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
            "C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2212
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SRLHjykjP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp754F.tmp"
              5⤵
              • Creates scheduled task(s)
              PID:5024
            • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
              "{path}"
              5⤵
              • Executes dropped EXE
              PID:1096
    • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
      C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SRLHjykjP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCDDF.tmp"
        2⤵
        • Creates scheduled task(s)
        PID:3760
      • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
        "{path}"
        2⤵
        • Executes dropped EXE
        PID:4260
    • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
      C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1296
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SRLHjykjP" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB3EA.tmp"
        2⤵
        • Creates scheduled task(s)
        PID:1636
      • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
        "{path}"
        2⤵
        • Executes dropped EXE
        PID:1308
      • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe
        "{path}"
        2⤵
        • Executes dropped EXE
        PID:4264

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe.log

      Filesize

      1KB

      MD5

      17573558c4e714f606f997e5157afaac

      SHA1

      13e16e9415ceef429aaf124139671ebeca09ed23

      SHA256

      c18db6aecad2436da4a63ff26af4e3a337cca48f01c21b8db494fe5ccc60e553

      SHA512

      f4edf13f05a0d142e4dd42802098c8c44988ee8869621a62c2b565a77c9a95857f636583ff8d6d9baa366603d98b9bfbf1fc75bc6f9f8f83c80cb1215b2941cc

    • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe

      Filesize

      2.1MB

      MD5

      141fab15a9ee48b8caadd462553dbff3

      SHA1

      36797395bb85f08ac5cf7eacb81c8d9ce78b3701

      SHA256

      e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454

      SHA512

      67ff417f350ba875ea4af66088e7bd9f91ee39c52ff4ad27b34526a506efbeb1a14258cca39762d87d8f98f0c6b8427ecc784fc9df4fade95d0f2b3bf86be6ca

    • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe

      Filesize

      2.1MB

      MD5

      141fab15a9ee48b8caadd462553dbff3

      SHA1

      36797395bb85f08ac5cf7eacb81c8d9ce78b3701

      SHA256

      e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454

      SHA512

      67ff417f350ba875ea4af66088e7bd9f91ee39c52ff4ad27b34526a506efbeb1a14258cca39762d87d8f98f0c6b8427ecc784fc9df4fade95d0f2b3bf86be6ca

    • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe

      Filesize

      2.1MB

      MD5

      141fab15a9ee48b8caadd462553dbff3

      SHA1

      36797395bb85f08ac5cf7eacb81c8d9ce78b3701

      SHA256

      e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454

      SHA512

      67ff417f350ba875ea4af66088e7bd9f91ee39c52ff4ad27b34526a506efbeb1a14258cca39762d87d8f98f0c6b8427ecc784fc9df4fade95d0f2b3bf86be6ca

    • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe

      Filesize

      2.1MB

      MD5

      141fab15a9ee48b8caadd462553dbff3

      SHA1

      36797395bb85f08ac5cf7eacb81c8d9ce78b3701

      SHA256

      e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454

      SHA512

      67ff417f350ba875ea4af66088e7bd9f91ee39c52ff4ad27b34526a506efbeb1a14258cca39762d87d8f98f0c6b8427ecc784fc9df4fade95d0f2b3bf86be6ca

    • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe

      Filesize

      2.1MB

      MD5

      141fab15a9ee48b8caadd462553dbff3

      SHA1

      36797395bb85f08ac5cf7eacb81c8d9ce78b3701

      SHA256

      e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454

      SHA512

      67ff417f350ba875ea4af66088e7bd9f91ee39c52ff4ad27b34526a506efbeb1a14258cca39762d87d8f98f0c6b8427ecc784fc9df4fade95d0f2b3bf86be6ca

    • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe

      Filesize

      2.1MB

      MD5

      141fab15a9ee48b8caadd462553dbff3

      SHA1

      36797395bb85f08ac5cf7eacb81c8d9ce78b3701

      SHA256

      e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454

      SHA512

      67ff417f350ba875ea4af66088e7bd9f91ee39c52ff4ad27b34526a506efbeb1a14258cca39762d87d8f98f0c6b8427ecc784fc9df4fade95d0f2b3bf86be6ca

    • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe

      Filesize

      2.1MB

      MD5

      141fab15a9ee48b8caadd462553dbff3

      SHA1

      36797395bb85f08ac5cf7eacb81c8d9ce78b3701

      SHA256

      e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454

      SHA512

      67ff417f350ba875ea4af66088e7bd9f91ee39c52ff4ad27b34526a506efbeb1a14258cca39762d87d8f98f0c6b8427ecc784fc9df4fade95d0f2b3bf86be6ca

    • C:\Users\Admin\AppData\Local\ServiceHub\e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454.exe

      Filesize

      2.1MB

      MD5

      141fab15a9ee48b8caadd462553dbff3

      SHA1

      36797395bb85f08ac5cf7eacb81c8d9ce78b3701

      SHA256

      e5fa8e9899e8d56149452a34fc6bc6b66bd9c8d69a31cdb1fbf5a90e9db6a454

      SHA512

      67ff417f350ba875ea4af66088e7bd9f91ee39c52ff4ad27b34526a506efbeb1a14258cca39762d87d8f98f0c6b8427ecc784fc9df4fade95d0f2b3bf86be6ca

    • C:\Users\Admin\AppData\Local\Temp\tmp754F.tmp

      Filesize

      1KB

      MD5

      5b5996a2867743b7ff3d5915f3f99beb

      SHA1

      989c016abf0e5cd294cc18df29f1792e5cb3d8fb

      SHA256

      2e05050295f0e81cd10d33070f77251de44916f57689d40eea1778ea7026c047

      SHA512

      5afe2e3d3e3fc697ccfd9e85c853fb6963f82097aa44a3406fde077845c9315561b69389aa0e061a1a265eae6f0b7a2fc5fbd158b572a05b242ab5e2e08f796b

    • C:\Users\Admin\AppData\Local\Temp\tmpB3EA.tmp

      Filesize

      1KB

      MD5

      5b5996a2867743b7ff3d5915f3f99beb

      SHA1

      989c016abf0e5cd294cc18df29f1792e5cb3d8fb

      SHA256

      2e05050295f0e81cd10d33070f77251de44916f57689d40eea1778ea7026c047

      SHA512

      5afe2e3d3e3fc697ccfd9e85c853fb6963f82097aa44a3406fde077845c9315561b69389aa0e061a1a265eae6f0b7a2fc5fbd158b572a05b242ab5e2e08f796b

    • C:\Users\Admin\AppData\Local\Temp\tmpCDDF.tmp

      Filesize

      1KB

      MD5

      5b5996a2867743b7ff3d5915f3f99beb

      SHA1

      989c016abf0e5cd294cc18df29f1792e5cb3d8fb

      SHA256

      2e05050295f0e81cd10d33070f77251de44916f57689d40eea1778ea7026c047

      SHA512

      5afe2e3d3e3fc697ccfd9e85c853fb6963f82097aa44a3406fde077845c9315561b69389aa0e061a1a265eae6f0b7a2fc5fbd158b572a05b242ab5e2e08f796b

    • C:\Users\Admin\AppData\Local\Temp\tmpF5BF.tmp

      Filesize

      1KB

      MD5

      5b5996a2867743b7ff3d5915f3f99beb

      SHA1

      989c016abf0e5cd294cc18df29f1792e5cb3d8fb

      SHA256

      2e05050295f0e81cd10d33070f77251de44916f57689d40eea1778ea7026c047

      SHA512

      5afe2e3d3e3fc697ccfd9e85c853fb6963f82097aa44a3406fde077845c9315561b69389aa0e061a1a265eae6f0b7a2fc5fbd158b572a05b242ab5e2e08f796b

    • memory/812-144-0x0000000000400000-0x0000000000552000-memory.dmp

      Filesize

      1.3MB

    • memory/1296-165-0x0000000005130000-0x0000000005140000-memory.dmp

      Filesize

      64KB

    • memory/2212-152-0x0000000004F10000-0x0000000004F20000-memory.dmp

      Filesize

      64KB

    • memory/2212-153-0x0000000004F10000-0x0000000004F20000-memory.dmp

      Filesize

      64KB

    • memory/2640-139-0x0000000005B90000-0x0000000005BA0000-memory.dmp

      Filesize

      64KB

    • memory/2640-140-0x0000000005B90000-0x0000000005BA0000-memory.dmp

      Filesize

      64KB

    • memory/2640-133-0x0000000000C70000-0x0000000000E88000-memory.dmp

      Filesize

      2.1MB

    • memory/2640-138-0x0000000005BA0000-0x0000000005BF6000-memory.dmp

      Filesize

      344KB

    • memory/2640-137-0x00000000058E0000-0x00000000058EA000-memory.dmp

      Filesize

      40KB

    • memory/2640-136-0x0000000005910000-0x00000000059A2000-memory.dmp

      Filesize

      584KB

    • memory/2640-135-0x0000000005E20000-0x00000000063C4000-memory.dmp

      Filesize

      5.6MB

    • memory/2640-134-0x00000000057D0000-0x000000000586C000-memory.dmp

      Filesize

      624KB

    • memory/2684-159-0x0000000005320000-0x0000000005330000-memory.dmp

      Filesize

      64KB