Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2023 08:04
Static task
static1
Behavioral task
behavioral1
Sample
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe
Resource
win10v2004-20230915-en
General
-
Target
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe
-
Size
1.5MB
-
MD5
6419a1e59348225baafa1b58ed611fc9
-
SHA1
89e4e06f33ddacf9092907bca221ad111fd4dcf1
-
SHA256
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df
-
SHA512
0d85752488eedc84c3bc858e171a1b73ffda869b14b9404e121f5a71cbb4aa64510b51a57890fe3d97ccd9beab854361e009e27e1cc4796f5d5c7bdba36c0634
-
SSDEEP
24576:twFgDyuHZ0uHO/dqvTrHxm/vDlDLIgNgOknWH:phHZ02O/dGc9UgbsY
Malware Config
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
bc1q7lqwyshs9zjpxyhcvwpmfyhad4w7j08qa7yudz
0x0BE5856fBfb983d813E9C8104a9FEE482F9B1b57
Signatures
-
Detects Eternity clipper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2328-21-0x0000000000400000-0x0000000000410000-memory.dmp eternity_clipper -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1736-29-0x0000000000400000-0x000000000045A000-memory.dmp family_redline -
Executes dropped EXE 2 IoCs
Processes:
InstallUtil.exeInstallUtil.exepid process 4676 InstallUtil.exe 836 InstallUtil.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exeInstallUtil.exedescription pid process target process PID 5100 set thread context of 4380 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 set thread context of 2328 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 4380 set thread context of 1736 4380 InstallUtil.exe InstallUtil.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exeInstallUtil.exeInstallUtil.exepid process 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe 4380 InstallUtil.exe 4380 InstallUtil.exe 4380 InstallUtil.exe 1736 InstallUtil.exe 1736 InstallUtil.exe 1736 InstallUtil.exe 1736 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exeInstallUtil.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe Token: SeDebugPrivilege 4380 InstallUtil.exe Token: SeDebugPrivilege 1736 InstallUtil.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exeInstallUtil.exeInstallUtil.execmd.exedescription pid process target process PID 5100 wrote to memory of 4380 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 4380 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 4380 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 4380 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 4380 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 4380 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 4380 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 4380 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 2328 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 2328 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 2328 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 2328 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 2328 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 2328 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 2328 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 5100 wrote to memory of 2328 5100 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe InstallUtil.exe PID 4380 wrote to memory of 1736 4380 InstallUtil.exe InstallUtil.exe PID 4380 wrote to memory of 1736 4380 InstallUtil.exe InstallUtil.exe PID 4380 wrote to memory of 1736 4380 InstallUtil.exe InstallUtil.exe PID 4380 wrote to memory of 1736 4380 InstallUtil.exe InstallUtil.exe PID 4380 wrote to memory of 1736 4380 InstallUtil.exe InstallUtil.exe PID 4380 wrote to memory of 1736 4380 InstallUtil.exe InstallUtil.exe PID 4380 wrote to memory of 1736 4380 InstallUtil.exe InstallUtil.exe PID 4380 wrote to memory of 1736 4380 InstallUtil.exe InstallUtil.exe PID 2328 wrote to memory of 3612 2328 InstallUtil.exe cmd.exe PID 2328 wrote to memory of 3612 2328 InstallUtil.exe cmd.exe PID 2328 wrote to memory of 3612 2328 InstallUtil.exe cmd.exe PID 3612 wrote to memory of 3336 3612 cmd.exe chcp.com PID 3612 wrote to memory of 3336 3612 cmd.exe chcp.com PID 3612 wrote to memory of 3336 3612 cmd.exe chcp.com PID 3612 wrote to memory of 5080 3612 cmd.exe PING.EXE PID 3612 wrote to memory of 5080 3612 cmd.exe PING.EXE PID 3612 wrote to memory of 5080 3612 cmd.exe PING.EXE PID 3612 wrote to memory of 4428 3612 cmd.exe schtasks.exe PID 3612 wrote to memory of 4428 3612 cmd.exe schtasks.exe PID 3612 wrote to memory of 4428 3612 cmd.exe schtasks.exe PID 3612 wrote to memory of 4676 3612 cmd.exe InstallUtil.exe PID 3612 wrote to memory of 4676 3612 cmd.exe InstallUtil.exe PID 3612 wrote to memory of 4676 3612 cmd.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe"C:\Users\Admin\AppData\Local\Temp\189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "InstallUtil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "InstallUtil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exeC:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.logFilesize
321B
MD508027eeee0542c93662aef98d70095e4
SHA142402c02bf4763fcd6fb0650fc13386f2eae8f9b
SHA2561b9ec007ac8e7de37c61313c5e1b9444df6dc0cd9110553bfa281b13204a646d
SHA512c4e7a17a1dc1f27c91791439d92435a5d750a065508e9539c9af458f21472a7ce45ba0666ef6855a00386e1a75c518d0908b82d929084a1b67ca4c65997a5979
-
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exeFilesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exeFilesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exeFilesize
41KB
MD55d4073b2eb6d217c19f2b22f21bf8d57
SHA1f0209900fbf08d004b886a0b3ba33ea2b0bf9da8
SHA256ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3
SHA5129ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159
-
memory/836-57-0x00000000745B0000-0x0000000074D60000-memory.dmpFilesize
7.7MB
-
memory/1736-44-0x00000000076B0000-0x00000000076EC000-memory.dmpFilesize
240KB
-
memory/1736-48-0x0000000008E60000-0x0000000008EB0000-memory.dmpFilesize
320KB
-
memory/1736-55-0x0000000074510000-0x0000000074CC0000-memory.dmpFilesize
7.7MB
-
memory/1736-54-0x0000000009090000-0x00000000090AE000-memory.dmpFilesize
120KB
-
memory/1736-53-0x00000000075E0000-0x00000000075F0000-memory.dmpFilesize
64KB
-
memory/1736-34-0x0000000074510000-0x0000000074CC0000-memory.dmpFilesize
7.7MB
-
memory/1736-50-0x00000000091A0000-0x0000000009362000-memory.dmpFilesize
1.8MB
-
memory/1736-51-0x0000000074510000-0x0000000074CC0000-memory.dmpFilesize
7.7MB
-
memory/1736-49-0x0000000008F30000-0x0000000008FA6000-memory.dmpFilesize
472KB
-
memory/1736-29-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/1736-47-0x0000000007F80000-0x0000000007FE6000-memory.dmpFilesize
408KB
-
memory/1736-45-0x00000000076F0000-0x000000000773C000-memory.dmpFilesize
304KB
-
memory/1736-43-0x0000000007780000-0x000000000788A000-memory.dmpFilesize
1.0MB
-
memory/1736-42-0x0000000007650000-0x0000000007662000-memory.dmpFilesize
72KB
-
memory/1736-41-0x0000000008470000-0x0000000008A88000-memory.dmpFilesize
6.1MB
-
memory/1736-36-0x00000000075E0000-0x00000000075F0000-memory.dmpFilesize
64KB
-
memory/1736-52-0x00000000098A0000-0x0000000009DCC000-memory.dmpFilesize
5.2MB
-
memory/2328-23-0x0000000074510000-0x0000000074CC0000-memory.dmpFilesize
7.7MB
-
memory/2328-21-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2328-28-0x0000000074510000-0x0000000074CC0000-memory.dmpFilesize
7.7MB
-
memory/4380-17-0x0000000005610000-0x0000000005620000-memory.dmpFilesize
64KB
-
memory/4380-31-0x0000000074510000-0x0000000074CC0000-memory.dmpFilesize
7.7MB
-
memory/4380-19-0x0000000074510000-0x0000000074CC0000-memory.dmpFilesize
7.7MB
-
memory/4380-12-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/4380-13-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/4380-15-0x0000000074510000-0x0000000074CC0000-memory.dmpFilesize
7.7MB
-
memory/4380-20-0x0000000005610000-0x0000000005620000-memory.dmpFilesize
64KB
-
memory/4380-16-0x0000000005610000-0x0000000005620000-memory.dmpFilesize
64KB
-
memory/4676-37-0x00000000008B0000-0x00000000008BC000-memory.dmpFilesize
48KB
-
memory/4676-46-0x0000000074510000-0x0000000074CC0000-memory.dmpFilesize
7.7MB
-
memory/4676-38-0x0000000005080000-0x000000000509A000-memory.dmpFilesize
104KB
-
memory/4676-40-0x00000000051B0000-0x00000000051C0000-memory.dmpFilesize
64KB
-
memory/4676-39-0x0000000074510000-0x0000000074CC0000-memory.dmpFilesize
7.7MB
-
memory/5100-3-0x0000000004E80000-0x0000000004F12000-memory.dmpFilesize
584KB
-
memory/5100-24-0x0000000074510000-0x0000000074CC0000-memory.dmpFilesize
7.7MB
-
memory/5100-5-0x0000000004F30000-0x0000000004F3A000-memory.dmpFilesize
40KB
-
memory/5100-6-0x0000000005120000-0x00000000051BC000-memory.dmpFilesize
624KB
-
memory/5100-4-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/5100-14-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/5100-18-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/5100-0-0x0000000074510000-0x0000000074CC0000-memory.dmpFilesize
7.7MB
-
memory/5100-11-0x0000000006E20000-0x0000000006E26000-memory.dmpFilesize
24KB
-
memory/5100-10-0x0000000006DB0000-0x0000000006DCA000-memory.dmpFilesize
104KB
-
memory/5100-9-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/5100-8-0x0000000074510000-0x0000000074CC0000-memory.dmpFilesize
7.7MB
-
memory/5100-7-0x0000000005E80000-0x0000000005EC2000-memory.dmpFilesize
264KB
-
memory/5100-2-0x0000000005350000-0x00000000058F4000-memory.dmpFilesize
5.6MB
-
memory/5100-1-0x0000000000DE0000-0x0000000000F58000-memory.dmpFilesize
1.5MB