eternity | b431ed16767cb8da4350cff864c6eb236b263768199c7b50518b8dda07f8fd35

General

Target

Kulo Proxy.exe
Size

5.5MB
MD5

54e12440f6cf0297e01f7b163ff7b63a
SHA1

74bf40882aefe4cd4580bd075c714f8679ad8652
SHA256

b431ed16767cb8da4350cff864c6eb236b263768199c7b50518b8dda07f8fd35
SHA512

beb92db97661da1709139f46baef4ee97c3950ae345923048bdeaafadd2703a9406f43a12245f8cfce07e88ea29d1e55610c37ca32d6c7185b375aea5fcfb064
SSDEEP

98304:KrIdSnq6IWdXnvYz8t3uYFdgzWk64nTAtS:GMWAc+YFdCXTd

Score

10^/10

eternity credential_access discovery evasion spyware stealer trojan

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/664-1-0x0000000000B10000-0x0000000001094000-memory.dmp	disable_win_def

Detects Eternity stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/664-1-0x0000000000B10000-0x0000000001094000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Kulo Proxy.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Kulo Proxy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Kulo Proxy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Kulo Proxy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Kulo Proxy.exe

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Kulo Proxy.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Kulo Proxy.exe

Drops startup file 2 IoCs

Processes:

Kulo Proxy.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kulo Proxy.exe	Kulo Proxy.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kulo Proxy.exe	Kulo Proxy.exe

Executes dropped EXE 2 IoCs

Processes:

Kulo Proxy.exedcd.exe

pid process

380 Kulo Proxy.exe
4056 dcd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

Kulo Proxy.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Kulo Proxy.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

dcd.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dcd.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

612 powershell.exe
612 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Kulo Proxy.exepowershell.exe

description pid process

Token: SeDebugPrivilege 664 Kulo Proxy.exe
Token: SeDebugPrivilege 612 powershell.exe

pid	process
380	Kulo Proxy.exe
4056	dcd.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Kulo Proxy.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dcd.exe

pid	process
612	powershell.exe
612	powershell.exe

description	pid	process
Token: SeDebugPrivilege	664	Kulo Proxy.exe
Token: SeDebugPrivilege	612	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Kulo Proxy.exe

description	pid	process	target process
PID 664 wrote to memory of 380	664	Kulo Proxy.exe	Kulo Proxy.exe
PID 664 wrote to memory of 380	664	Kulo Proxy.exe	Kulo Proxy.exe
PID 664 wrote to memory of 4056	664	Kulo Proxy.exe	dcd.exe
PID 664 wrote to memory of 4056	664	Kulo Proxy.exe	dcd.exe
PID 664 wrote to memory of 4056	664	Kulo Proxy.exe	dcd.exe
PID 664 wrote to memory of 612	664	Kulo Proxy.exe	powershell.exe
PID 664 wrote to memory of 612	664	Kulo Proxy.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\Kulo Proxy.exe
"C:\Users\Admin\AppData\Local\Temp\Kulo Proxy.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Drops startup file
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:664
- C:\Users\Admin\AppData\Local\Temp\tx1jtsrt.0wu\Kulo Proxy.exe
  "C:\Users\Admin\AppData\Local\Temp\tx1jtsrt.0wu\Kulo Proxy.exe"
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3i24vg4n.uvs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\tx1jtsrt.0wu\Kulo Proxy.exe

Filesize
2.3MB

MD5
f7aaffa9a85cd5b2b147b1c2a117dfd9

SHA1
336ca5e628cf57ba5c4701918ada06bf908d3753

SHA256
4f3728da388cc647f39d12c330ff81b4068d7c908668d56d6e6f0d87631085d9

SHA512
5368be56ced8d1abca50848430755e927cca92a726ded5d609f4fba2cbd93946b1e4c68b235f0e612bd52a025643fcfab3309afbce5ec1e39f3ba5e7e09c564c

Download Submit
memory/612-36-0x00007FF9D8950000-0x00007FF9D9411000-memory.dmp

Filesize
10.8MB

Download
memory/612-33-0x00007FF9D8950000-0x00007FF9D9411000-memory.dmp

Filesize
10.8MB

Download
memory/612-30-0x00000287E6280000-0x00000287E62A2000-memory.dmp

Filesize
136KB

Download
memory/612-32-0x00007FF9D8950000-0x00007FF9D9411000-memory.dmp

Filesize
10.8MB

Download
memory/612-31-0x00007FF9D8950000-0x00007FF9D9411000-memory.dmp

Filesize
10.8MB

Download
memory/664-4-0x00007FF9D8950000-0x00007FF9D9411000-memory.dmp

Filesize
10.8MB

Download
memory/664-15-0x00007FF9D8950000-0x00007FF9D9411000-memory.dmp

Filesize
10.8MB

Download
memory/664-12-0x00007FF9D8950000-0x00007FF9D9411000-memory.dmp

Filesize
10.8MB

Download
memory/664-7-0x00007FF9D8950000-0x00007FF9D9411000-memory.dmp

Filesize
10.8MB

Download
memory/664-6-0x00007FF9D8950000-0x00007FF9D9411000-memory.dmp

Filesize
10.8MB

Download
memory/664-0-0x00007FF9D8953000-0x00007FF9D8955000-memory.dmp

Filesize
8KB

Download
memory/664-3-0x000000001BFC0000-0x000000001C246000-memory.dmp

Filesize
2.5MB

Download
memory/664-2-0x00000000031F0000-0x0000000003240000-memory.dmp

Filesize
320KB

Download
memory/664-1-0x0000000000B10000-0x0000000001094000-memory.dmp

Filesize
5.5MB

Download
memory/664-39-0x00007FF9D8950000-0x00007FF9D9411000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads