Overview
overview
7Static
static
3Eclipse_Bu....5.zip
windows7-x64
1Eclipse_Bu....5.zip
windows10-2004-x64
1REALEclipt....5.exe
windows7-x64
7REALEclipt....5.exe
windows10-2004-x64
7REALEclipt...ME.txt
windows7-x64
1REALEclipt...ME.txt
windows10-2004-x64
1REALEclipt...Ui.dll
windows7-x64
1REALEclipt...Ui.dll
windows10-2004-x64
1REALEclipt...32.dll
windows7-x64
3REALEclipt...32.dll
windows10-2004-x64
3REALEclipt...ig.cfg
windows7-x64
3REALEclipt...ig.cfg
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
03/04/2024, 18:55
Behavioral task
behavioral1
Sample
Eclipse_Build_4.0.5.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Eclipse_Build_4.0.5.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
REALEcliptic_Build_4.0.5/ECLIPSE_4.0.5.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
REALEcliptic_Build_4.0.5/ECLIPSE_4.0.5.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
REALEcliptic_Build_4.0.5/README.txt
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
REALEcliptic_Build_4.0.5/README.txt
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
REALEcliptic_Build_4.0.5/bin/drawUi.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
REALEcliptic_Build_4.0.5/bin/drawUi.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral9
Sample
REALEcliptic_Build_4.0.5/bin/glew32.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
REALEcliptic_Build_4.0.5/bin/glew32.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
REALEcliptic_Build_4.0.5/config.cfg
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
REALEcliptic_Build_4.0.5/config.cfg
Resource
win10v2004-20240226-en
General
-
Target
REALEcliptic_Build_4.0.5/config.cfg
-
Size
252B
-
MD5
a3493d169d199224377f9c56bf480e72
-
SHA1
0c6aa9694d5a9d729cc76f128f1fc9ac1f042d7c
-
SHA256
69018e16bf06c80ff707ebf4cc10b03866acac14fc42eff982ff6fe94906bb95
-
SHA512
dee7b4cf599b9a179de27a68db732ab0bd343b3d0e2e733258cc371a058a316dca0b21ee40645fc4566f2a3e8dfe1fb06996b129974d8751f19a1a4cb102db25
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.cfg rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\cfg_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\cfg_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\cfg_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\cfg_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\cfg_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.cfg\ = "cfg_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\cfg_auto_file\shell\Read rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2600 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2600 AcroRd32.exe 2600 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2716 2276 cmd.exe 28 PID 2276 wrote to memory of 2716 2276 cmd.exe 28 PID 2276 wrote to memory of 2716 2276 cmd.exe 28 PID 2716 wrote to memory of 2600 2716 rundll32.exe 29 PID 2716 wrote to memory of 2600 2716 rundll32.exe 29 PID 2716 wrote to memory of 2600 2716 rundll32.exe 29 PID 2716 wrote to memory of 2600 2716 rundll32.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\REALEcliptic_Build_4.0.5\config.cfg1⤵
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\REALEcliptic_Build_4.0.5\config.cfg2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\REALEcliptic_Build_4.0.5\config.cfg"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2600
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b6b2eb4b1601380833b74375354cc4f6
SHA150d7bc8a7b19f07dcd267c6fa459828647f7d474
SHA256118f408a05e2186a8ecfde91feccb7e98745676f31ff71fc2dc51879e0cfec88
SHA512a0a38cdb7d092d0789a2c70d44b765f0bd48fc1f58ac53769149a16afebdb45c19a6968828a5bcab0735eb83d31ebda77bbbab5ee5151a3247c112c20418f0fa