Resubmissions
29-07-2024 21:31
240729-1djk8s1gjn 1029-07-2024 21:18
240729-z5k3psvgqb 729-07-2024 21:15
240729-z343ssvgkb 10Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
29-07-2024 21:15
Behavioral task
behavioral1
Sample
eclipse.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
eclipse.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
eclipse.exe
-
Size
10.8MB
-
MD5
c66f94cba849f1ffb4c6c26b19ebd125
-
SHA1
45ea5bc2c8c957c849c4268d2ccd929b0007e73a
-
SHA256
bbe675e10ea2660c7e54eee706098fcc607f0e2d70b5562bcb8077c789608d38
-
SHA512
e18ec4086c6f4efa81957d197603e788e29a1cbcfef6ef7c3921805faa42bd9f05fb58c2a1f22d4fe3326ced473ceb3381154adf950de340dcafc6058bebc462
-
SSDEEP
196608:MIoAzPA4mtSHeNvX+wfm/pf+xfdkR0ZWKsnarIWOzW0DaqkH:FsvtSUvX+9/pWFGRiBsnarIWeRaDH
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2996 eclipse.exe -
resource yara_rule behavioral1/files/0x00060000000174f7-46.dat upx behavioral1/memory/2996-48-0x000007FEF58A0000-0x000007FEF5E88000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2480 taskmgr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe 2480 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2816 wrote to memory of 2996 2816 eclipse.exe 28 PID 2816 wrote to memory of 2996 2816 eclipse.exe 28 PID 2816 wrote to memory of 2996 2816 eclipse.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\eclipse.exe"C:\Users\Admin\AppData\Local\Temp\eclipse.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\eclipse.exe"C:\Users\Admin\AppData\Local\Temp\eclipse.exe"2⤵
- Loads dropped DLL
PID:2996
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2480
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5db09c9bbec6134db1766d369c339a0a1
SHA1c156d9f2d0e80b4cf41794cd9b8b1e8a352e0a0b
SHA256b1aac1e461174bbae952434e4dac092590d72b9832a04457c94bd9bb7ee8ad79
SHA512653a7fff6a2b6bffb9ea2c0b72ddb83c9c53d555e798eea47101b0d932358180a01af2b9dab9c27723057439c1eaffb8d84b9b41f6f9cd1c3c934f1794104d45