Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
30-09-2023 11:43
Static task
static1
Behavioral task
behavioral1
Sample
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe
-
Size
1.5MB
-
MD5
6419a1e59348225baafa1b58ed611fc9
-
SHA1
89e4e06f33ddacf9092907bca221ad111fd4dcf1
-
SHA256
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df
-
SHA512
0d85752488eedc84c3bc858e171a1b73ffda869b14b9404e121f5a71cbb4aa64510b51a57890fe3d97ccd9beab854361e009e27e1cc4796f5d5c7bdba36c0634
-
SSDEEP
24576:twFgDyuHZ0uHO/dqvTrHxm/vDlDLIgNgOknWH:phHZ02O/dGc9UgbsY
Malware Config
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
bc1q7lqwyshs9zjpxyhcvwpmfyhad4w7j08qa7yudz
0x0BE5856fBfb983d813E9C8104a9FEE482F9B1b57
Signatures
-
Detects Eternity clipper 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2484-25-0x0000000000400000-0x0000000000410000-memory.dmp eternity_clipper behavioral1/memory/2484-26-0x0000000000400000-0x0000000000410000-memory.dmp eternity_clipper behavioral1/memory/2484-41-0x0000000000400000-0x0000000000410000-memory.dmp eternity_clipper behavioral1/memory/2484-44-0x0000000000400000-0x0000000000410000-memory.dmp eternity_clipper behavioral1/memory/2484-46-0x0000000000400000-0x0000000000410000-memory.dmp eternity_clipper -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2972-33-0x0000000000400000-0x000000000045A000-memory.dmp family_redline behavioral1/memory/2972-35-0x0000000000400000-0x000000000045A000-memory.dmp family_redline behavioral1/memory/2972-51-0x0000000000400000-0x000000000045A000-memory.dmp family_redline behavioral1/memory/2972-57-0x0000000000400000-0x000000000045A000-memory.dmp family_redline behavioral1/memory/2972-54-0x0000000000400000-0x000000000045A000-memory.dmp family_redline -
Executes dropped EXE 2 IoCs
Processes:
InstallUtil.exeInstallUtil.exepid process 2272 InstallUtil.exe 2080 InstallUtil.exe -
Loads dropped DLL 1 IoCs
Processes:
cmd.exepid process 1984 cmd.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exeInstallUtil.exedescription pid process target process PID 2104 set thread context of 2292 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 set thread context of 2484 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2292 set thread context of 2972 2292 InstallUtil.exe InstallUtil.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exeInstallUtil.exeInstallUtil.exepid process 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe 2292 InstallUtil.exe 2292 InstallUtil.exe 2292 InstallUtil.exe 2972 InstallUtil.exe 2972 InstallUtil.exe 2972 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exeInstallUtil.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe Token: SeDebugPrivilege 2292 InstallUtil.exe Token: SeDebugPrivilege 2972 InstallUtil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exeInstallUtil.exeInstallUtil.execmd.exetaskeng.exedescription pid process target process PID 2104 wrote to memory of 2292 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2292 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2292 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2292 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2292 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2292 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2292 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2292 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2292 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2292 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2292 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2292 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2484 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2484 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2484 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2484 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2484 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2484 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2484 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2484 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2484 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2484 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2484 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2104 wrote to memory of 2484 2104 189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe InstallUtil.exe PID 2292 wrote to memory of 2972 2292 InstallUtil.exe InstallUtil.exe PID 2292 wrote to memory of 2972 2292 InstallUtil.exe InstallUtil.exe PID 2292 wrote to memory of 2972 2292 InstallUtil.exe InstallUtil.exe PID 2292 wrote to memory of 2972 2292 InstallUtil.exe InstallUtil.exe PID 2292 wrote to memory of 2972 2292 InstallUtil.exe InstallUtil.exe PID 2292 wrote to memory of 2972 2292 InstallUtil.exe InstallUtil.exe PID 2292 wrote to memory of 2972 2292 InstallUtil.exe InstallUtil.exe PID 2292 wrote to memory of 2972 2292 InstallUtil.exe InstallUtil.exe PID 2292 wrote to memory of 2972 2292 InstallUtil.exe InstallUtil.exe PID 2292 wrote to memory of 2972 2292 InstallUtil.exe InstallUtil.exe PID 2292 wrote to memory of 2972 2292 InstallUtil.exe InstallUtil.exe PID 2292 wrote to memory of 2972 2292 InstallUtil.exe InstallUtil.exe PID 2484 wrote to memory of 1984 2484 InstallUtil.exe cmd.exe PID 2484 wrote to memory of 1984 2484 InstallUtil.exe cmd.exe PID 2484 wrote to memory of 1984 2484 InstallUtil.exe cmd.exe PID 2484 wrote to memory of 1984 2484 InstallUtil.exe cmd.exe PID 1984 wrote to memory of 2576 1984 cmd.exe chcp.com PID 1984 wrote to memory of 2576 1984 cmd.exe chcp.com PID 1984 wrote to memory of 2576 1984 cmd.exe chcp.com PID 1984 wrote to memory of 2576 1984 cmd.exe chcp.com PID 1984 wrote to memory of 2852 1984 cmd.exe PING.EXE PID 1984 wrote to memory of 2852 1984 cmd.exe PING.EXE PID 1984 wrote to memory of 2852 1984 cmd.exe PING.EXE PID 1984 wrote to memory of 2852 1984 cmd.exe PING.EXE PID 1984 wrote to memory of 240 1984 cmd.exe schtasks.exe PID 1984 wrote to memory of 240 1984 cmd.exe schtasks.exe PID 1984 wrote to memory of 240 1984 cmd.exe schtasks.exe PID 1984 wrote to memory of 240 1984 cmd.exe schtasks.exe PID 1984 wrote to memory of 2272 1984 cmd.exe InstallUtil.exe PID 1984 wrote to memory of 2272 1984 cmd.exe InstallUtil.exe PID 1984 wrote to memory of 2272 1984 cmd.exe InstallUtil.exe PID 1984 wrote to memory of 2272 1984 cmd.exe InstallUtil.exe PID 1984 wrote to memory of 2272 1984 cmd.exe InstallUtil.exe PID 1984 wrote to memory of 2272 1984 cmd.exe InstallUtil.exe PID 1984 wrote to memory of 2272 1984 cmd.exe InstallUtil.exe PID 1488 wrote to memory of 2080 1488 taskeng.exe InstallUtil.exe PID 1488 wrote to memory of 2080 1488 taskeng.exe InstallUtil.exe PID 1488 wrote to memory of 2080 1488 taskeng.exe InstallUtil.exe PID 1488 wrote to memory of 2080 1488 taskeng.exe InstallUtil.exe PID 1488 wrote to memory of 2080 1488 taskeng.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe"C:\Users\Admin\AppData\Local\Temp\189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "InstallUtil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "InstallUtil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\taskeng.exetaskeng.exe {A45CC014-32D1-4EC0-9D5A-4910C49C62B9} S-1-5-21-3849525425-30183055-657688904-1000:KGPMNUDG\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exeC:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exeFilesize
40KB
MD591c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
memory/2080-68-0x0000000073000000-0x00000000736EE000-memory.dmpFilesize
6.9MB
-
memory/2080-67-0x0000000000AF0000-0x0000000000AFC000-memory.dmpFilesize
48KB
-
memory/2104-4-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/2104-7-0x0000000000450000-0x0000000000456000-memory.dmpFilesize
24KB
-
memory/2104-6-0x0000000000430000-0x000000000044A000-memory.dmpFilesize
104KB
-
memory/2104-5-0x0000000005240000-0x0000000005280000-memory.dmpFilesize
256KB
-
memory/2104-0-0x0000000000090000-0x0000000000208000-memory.dmpFilesize
1.5MB
-
memory/2104-3-0x0000000002080000-0x00000000020C2000-memory.dmpFilesize
264KB
-
memory/2104-2-0x0000000005240000-0x0000000005280000-memory.dmpFilesize
256KB
-
memory/2104-1-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/2104-43-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/2272-65-0x0000000073000000-0x00000000736EE000-memory.dmpFilesize
6.9MB
-
memory/2272-64-0x0000000073000000-0x00000000736EE000-memory.dmpFilesize
6.9MB
-
memory/2272-63-0x0000000000210000-0x000000000021C000-memory.dmpFilesize
48KB
-
memory/2292-40-0x00000000047E0000-0x0000000004820000-memory.dmpFilesize
256KB
-
memory/2292-17-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/2292-8-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/2292-10-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/2292-11-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/2292-12-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/2292-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2292-15-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/2292-39-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/2292-19-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/2292-20-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/2292-21-0x00000000047E0000-0x0000000004820000-memory.dmpFilesize
256KB
-
memory/2292-55-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/2292-53-0x00000000047E0000-0x0000000004820000-memory.dmpFilesize
256KB
-
memory/2484-41-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2484-50-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/2484-25-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2484-46-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2484-44-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2484-47-0x0000000074200000-0x00000000748EE000-memory.dmpFilesize
6.9MB
-
memory/2484-26-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2484-24-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2484-22-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2972-57-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/2972-59-0x0000000007290000-0x00000000072D0000-memory.dmpFilesize
256KB
-
memory/2972-58-0x0000000073000000-0x00000000736EE000-memory.dmpFilesize
6.9MB
-
memory/2972-35-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/2972-33-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/2972-31-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/2972-29-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/2972-54-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/2972-51-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/2972-69-0x0000000073000000-0x00000000736EE000-memory.dmpFilesize
6.9MB
-
memory/2972-70-0x0000000007290000-0x00000000072D0000-memory.dmpFilesize
256KB
-
memory/2972-71-0x0000000073000000-0x00000000736EE000-memory.dmpFilesize
6.9MB