Analysis
-
max time kernel
152s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:37
Static task
static1
Behavioral task
behavioral1
Sample
6419a1e59348225baafa1b58ed611fc9.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
6419a1e59348225baafa1b58ed611fc9.exe
Resource
win10v2004-20230915-en
General
-
Target
6419a1e59348225baafa1b58ed611fc9.exe
-
Size
1.5MB
-
MD5
6419a1e59348225baafa1b58ed611fc9
-
SHA1
89e4e06f33ddacf9092907bca221ad111fd4dcf1
-
SHA256
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df
-
SHA512
0d85752488eedc84c3bc858e171a1b73ffda869b14b9404e121f5a71cbb4aa64510b51a57890fe3d97ccd9beab854361e009e27e1cc4796f5d5c7bdba36c0634
-
SSDEEP
24576:twFgDyuHZ0uHO/dqvTrHxm/vDlDLIgNgOknWH:phHZ02O/dGc9UgbsY
Malware Config
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
bc1q7lqwyshs9zjpxyhcvwpmfyhad4w7j08qa7yudz
0x0BE5856fBfb983d813E9C8104a9FEE482F9B1b57
Signatures
-
Detects Eternity clipper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1712-22-0x0000000000400000-0x0000000000410000-memory.dmp eternity_clipper -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/892-28-0x0000000000400000-0x000000000045A000-memory.dmp family_redline -
Suspicious use of SetThreadContext 3 IoCs
Processes:
6419a1e59348225baafa1b58ed611fc9.exeInstallUtil.exedescription pid process target process PID 312 set thread context of 5040 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 set thread context of 1712 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 5040 set thread context of 892 5040 InstallUtil.exe InstallUtil.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
6419a1e59348225baafa1b58ed611fc9.exeInstallUtil.exeInstallUtil.exepid process 312 6419a1e59348225baafa1b58ed611fc9.exe 312 6419a1e59348225baafa1b58ed611fc9.exe 312 6419a1e59348225baafa1b58ed611fc9.exe 5040 InstallUtil.exe 5040 InstallUtil.exe 5040 InstallUtil.exe 892 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
6419a1e59348225baafa1b58ed611fc9.exeInstallUtil.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 312 6419a1e59348225baafa1b58ed611fc9.exe Token: SeDebugPrivilege 5040 InstallUtil.exe Token: SeDebugPrivilege 892 InstallUtil.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
6419a1e59348225baafa1b58ed611fc9.exeInstallUtil.exeInstallUtil.execmd.exedescription pid process target process PID 312 wrote to memory of 5040 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 5040 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 5040 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 5040 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 5040 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 5040 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 5040 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 5040 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 1712 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 1712 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 1712 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 1712 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 1712 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 1712 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 1712 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 312 wrote to memory of 1712 312 6419a1e59348225baafa1b58ed611fc9.exe InstallUtil.exe PID 5040 wrote to memory of 892 5040 InstallUtil.exe InstallUtil.exe PID 5040 wrote to memory of 892 5040 InstallUtil.exe InstallUtil.exe PID 5040 wrote to memory of 892 5040 InstallUtil.exe InstallUtil.exe PID 5040 wrote to memory of 892 5040 InstallUtil.exe InstallUtil.exe PID 5040 wrote to memory of 892 5040 InstallUtil.exe InstallUtil.exe PID 5040 wrote to memory of 892 5040 InstallUtil.exe InstallUtil.exe PID 5040 wrote to memory of 892 5040 InstallUtil.exe InstallUtil.exe PID 5040 wrote to memory of 892 5040 InstallUtil.exe InstallUtil.exe PID 1712 wrote to memory of 4080 1712 InstallUtil.exe cmd.exe PID 1712 wrote to memory of 4080 1712 InstallUtil.exe cmd.exe PID 1712 wrote to memory of 4080 1712 InstallUtil.exe cmd.exe PID 4080 wrote to memory of 4840 4080 cmd.exe chcp.com PID 4080 wrote to memory of 4840 4080 cmd.exe chcp.com PID 4080 wrote to memory of 4840 4080 cmd.exe chcp.com PID 4080 wrote to memory of 4084 4080 cmd.exe PING.EXE PID 4080 wrote to memory of 4084 4080 cmd.exe PING.EXE PID 4080 wrote to memory of 4084 4080 cmd.exe PING.EXE PID 4080 wrote to memory of 4132 4080 cmd.exe schtasks.exe PID 4080 wrote to memory of 4132 4080 cmd.exe schtasks.exe PID 4080 wrote to memory of 4132 4080 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6419a1e59348225baafa1b58ed611fc9.exe"C:\Users\Admin\AppData\Local\Temp\6419a1e59348225baafa1b58ed611fc9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "InstallUtil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.14⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "InstallUtil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.logFilesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
memory/312-4-0x0000000005A90000-0x0000000005AA0000-memory.dmpFilesize
64KB
-
memory/312-9-0x0000000005A90000-0x0000000005AA0000-memory.dmpFilesize
64KB
-
memory/312-3-0x0000000005840000-0x00000000058D2000-memory.dmpFilesize
584KB
-
memory/312-18-0x0000000005A90000-0x0000000005AA0000-memory.dmpFilesize
64KB
-
memory/312-5-0x00000000057B0000-0x00000000057BA000-memory.dmpFilesize
40KB
-
memory/312-6-0x0000000005AA0000-0x0000000005B3C000-memory.dmpFilesize
624KB
-
memory/312-2-0x0000000005DF0000-0x0000000006394000-memory.dmpFilesize
5.6MB
-
memory/312-8-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/312-7-0x00000000067A0000-0x00000000067E2000-memory.dmpFilesize
264KB
-
memory/312-10-0x00000000077C0000-0x00000000077DA000-memory.dmpFilesize
104KB
-
memory/312-11-0x0000000007830000-0x0000000007836000-memory.dmpFilesize
24KB
-
memory/312-1-0x0000000000E60000-0x0000000000FD8000-memory.dmpFilesize
1.5MB
-
memory/312-13-0x0000000005A90000-0x0000000005AA0000-memory.dmpFilesize
64KB
-
memory/312-0-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/312-27-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/892-34-0x0000000007730000-0x0000000007742000-memory.dmpFilesize
72KB
-
memory/892-40-0x0000000008060000-0x00000000080C6000-memory.dmpFilesize
408KB
-
memory/892-45-0x00000000098D0000-0x0000000009DFC000-memory.dmpFilesize
5.2MB
-
memory/892-44-0x00000000091D0000-0x0000000009392000-memory.dmpFilesize
1.8MB
-
memory/892-43-0x0000000007700000-0x0000000007710000-memory.dmpFilesize
64KB
-
memory/892-42-0x0000000008F80000-0x0000000008FF6000-memory.dmpFilesize
472KB
-
memory/892-41-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/892-35-0x0000000007860000-0x000000000796A000-memory.dmpFilesize
1.0MB
-
memory/892-37-0x00000000077D0000-0x000000000781C000-memory.dmpFilesize
304KB
-
memory/892-28-0x0000000000400000-0x000000000045A000-memory.dmpFilesize
360KB
-
memory/892-29-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/892-36-0x0000000007790000-0x00000000077CC000-memory.dmpFilesize
240KB
-
memory/892-32-0x0000000007700000-0x0000000007710000-memory.dmpFilesize
64KB
-
memory/892-33-0x00000000085B0000-0x0000000008BC8000-memory.dmpFilesize
6.1MB
-
memory/1712-23-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/1712-39-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/1712-22-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/5040-14-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/5040-31-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/5040-15-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/5040-12-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB
-
memory/5040-17-0x0000000005350000-0x0000000005360000-memory.dmpFilesize
64KB
-
memory/5040-21-0x0000000005350000-0x0000000005360000-memory.dmpFilesize
64KB
-
memory/5040-20-0x0000000005350000-0x0000000005360000-memory.dmpFilesize
64KB
-
memory/5040-19-0x00000000749E0000-0x0000000075190000-memory.dmpFilesize
7.7MB
-
memory/5040-16-0x0000000005350000-0x0000000005360000-memory.dmpFilesize
64KB