Analysis
-
max time kernel
149s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2023 04:37
Behavioral task
behavioral1
Sample
Clipper.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Clipper.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
Miner.exe
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
Miner.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
Rat.exe
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
Rat.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
Stealer.exe
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
Stealer.exe
Resource
win10v2004-20230915-en
General
-
Target
Stealer.exe
-
Size
335KB
-
MD5
841ce3b003ee2d41c5c6b53a983f31c1
-
SHA1
5127475b042a5aaa8ac869d7024082d701a71aad
-
SHA256
a5321ffc44084cba8e5bedc4fe98bc151b5f90a01192fa8d695ffcb0c8363ebd
-
SHA512
18bf3713cf4d2e23346a70801918b5df4c7cf6d10bda15aba64b92881c5d2b66dfa0bc2f8524e031bb7fc739cdc5177c217f12213083f5cbe0d117632bd7e6a6
-
SSDEEP
6144:AwzO189USPgbr8zExVQQdCZiBeB5y0vN4t/xZAbANK:AwzO18CS4xCZi70F8
Malware Config
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
Stealer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Stealer.exe Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Stealer.exe Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Stealer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 33 ip-api.com -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Stealer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 Stealer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Stealer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Stealer.exepid process 1212 Stealer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Stealer.exedescription pid process Token: SeDebugPrivilege 1212 Stealer.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Stealer.execmd.execmd.exedescription pid process target process PID 1212 wrote to memory of 420 1212 Stealer.exe cmd.exe PID 1212 wrote to memory of 420 1212 Stealer.exe cmd.exe PID 420 wrote to memory of 4480 420 cmd.exe chcp.com PID 420 wrote to memory of 4480 420 cmd.exe chcp.com PID 420 wrote to memory of 2460 420 cmd.exe netsh.exe PID 420 wrote to memory of 2460 420 cmd.exe netsh.exe PID 420 wrote to memory of 1260 420 cmd.exe findstr.exe PID 420 wrote to memory of 1260 420 cmd.exe findstr.exe PID 1212 wrote to memory of 3212 1212 Stealer.exe cmd.exe PID 1212 wrote to memory of 3212 1212 Stealer.exe cmd.exe PID 3212 wrote to memory of 1076 3212 cmd.exe chcp.com PID 3212 wrote to memory of 1076 3212 cmd.exe chcp.com PID 3212 wrote to memory of 1688 3212 cmd.exe netsh.exe PID 3212 wrote to memory of 1688 3212 cmd.exe netsh.exe PID 3212 wrote to memory of 2380 3212 cmd.exe findstr.exe PID 3212 wrote to memory of 2380 3212 cmd.exe findstr.exe -
outlook_office_path 1 IoCs
Processes:
Stealer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Stealer.exe -
outlook_win_path 1 IoCs
Processes:
Stealer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Stealer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealer.exe"C:\Users\Admin\AppData\Local\Temp\Stealer.exe"1⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile3⤵
-
C:\Windows\system32\findstr.exefindstr All3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
C:\Windows\system32\netsh.exenetsh wlan show profile name="65001" key=clear3⤵
-
C:\Windows\system32\findstr.exefindstr Key3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1212-0-0x000001D3366B0000-0x000001D33670A000-memory.dmpFilesize
360KB
-
memory/1212-1-0x00007FFDC76E0000-0x00007FFDC81A1000-memory.dmpFilesize
10.8MB
-
memory/1212-2-0x00007FFDC76E0000-0x00007FFDC81A1000-memory.dmpFilesize
10.8MB
-
memory/1212-3-0x000001D350E10000-0x000001D350E20000-memory.dmpFilesize
64KB
-
memory/1212-4-0x000001D350E10000-0x000001D350E20000-memory.dmpFilesize
64KB
-
memory/1212-5-0x000001D350E70000-0x000001D350EC0000-memory.dmpFilesize
320KB
-
memory/1212-7-0x00007FFDC76E0000-0x00007FFDC81A1000-memory.dmpFilesize
10.8MB