Overview
overview
8Static
static
7Erebus-mas...03.exe
windows7-x64
5Erebus-mas...03.exe
windows10-2004-x64
5Erebus-mas...64.dll
windows7-x64
1Erebus-mas...64.dll
windows10-2004-x64
1Erebus-mas...86.dll
windows7-x64
3Erebus-mas...86.dll
windows10-2004-x64
3Erebus-mas...64.exe
windows7-x64
1Erebus-mas...64.exe
windows10-2004-x64
1Erebus-mas...86.exe
windows7-x64
1Erebus-mas...86.exe
windows10-2004-x64
3Erebus-mas...64.exe
windows7-x64
8Erebus-mas...64.exe
windows10-2004-x64
8Erebus-mas...jp.exe
windows7-x64
1Erebus-mas...jp.exe
windows10-2004-x64
1Erebus-mas...sp.exe
windows7-x64
1Erebus-mas...sp.exe
windows10-2004-x64
1Erebus-mas...80.exe
windows7-x64
7Erebus-mas...80.exe
windows10-2004-x64
7Erebus-mas...es.exe
windows7-x64
7Erebus-mas...es.exe
windows10-2004-x64
7Erebus-mas...b.xlsx
windows7-x64
3Erebus-mas...b.xlsx
windows10-2004-x64
1Erebus-mas...ter.py
ubuntu-18.04-amd64
3Erebus-mas...ter.py
debian-9-armhf
3Erebus-mas...ter.py
debian-9-mips
3Erebus-mas...ter.py
debian-9-mipsel
3Erebus-mas...er.ps1
windows7-x64
3Erebus-mas...er.ps1
windows10-2004-x64
3Erebus-mas...to.exe
windows7-x64
1Erebus-mas...to.exe
windows10-2004-x64
1Erebus-mas...le.exe
windows7-x64
1Erebus-mas...le.exe
windows10-2004-x64
1Analysis
-
max time kernel
23s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2024, 06:57
Behavioral task
behavioral1
Sample
Erebus-master/exp/0803.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Erebus-master/exp/0803.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Erebus-master/exp/16075/x64.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Erebus-master/exp/16075/x64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Erebus-master/exp/16075/x86.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Erebus-master/exp/16075/x86.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Erebus-master/exp/8120/x64.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Erebus-master/exp/8120/x64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Erebus-master/exp/8120/x86.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
Erebus-master/exp/8120/x86.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Erebus-master/exp/com/1405_1322_x64.exe
Resource
win7-20241023-en
Behavioral task
behavioral12
Sample
Erebus-master/exp/com/1405_1322_x64.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Erebus-master/exp/jp/jp.exe
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
Erebus-master/exp/jp/jp.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Erebus-master/exp/sp/sp.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Erebus-master/exp/sp/sp.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Erebus-master/gather/chrome80.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Erebus-master/gather/chrome80.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Erebus-master/gather/cookies.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Erebus-master/gather/cookies.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Erebus-master/local/2020-04-10-mssb.xlsx
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Erebus-master/local/2020-04-10-mssb.xlsx
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Erebus-master/local/windows-exploit-suggester.py
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral24
Sample
Erebus-master/local/windows-exploit-suggester.py
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral25
Sample
Erebus-master/local/windows-exploit-suggester.py
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral26
Sample
Erebus-master/local/windows-exploit-suggester.py
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral27
Sample
Erebus-master/modules/gather.ps1
Resource
win7-20241023-en
Behavioral task
behavioral28
Sample
Erebus-master/modules/gather.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Erebus-master/post/BadPotato.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Erebus-master/post/BadPotato.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Erebus-master/post/HiveJack-Console.exe
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
Erebus-master/post/HiveJack-Console.exe
Resource
win10v2004-20241007-en
General
-
Target
Erebus-master/local/2020-04-10-mssb.xlsx
-
Size
2.0MB
-
MD5
38e8f6c37833ccad83d74cedf5e949d1
-
SHA1
89cca86bd5bfa041641f510f3bcd5c05a3ada026
-
SHA256
8fd62c91d0edf3ba7a90d891f8113a1c1d8c62fd44c94bc4d481648a34111142
-
SHA512
f8a5617492d9dc16bd5d64231ea2f605b08779ead8e23a614b67ad47b6840c34be9bb9126a06cf6eeab274d13bd5656543d88a28d4dbacb1dca8d1b97d1c07f9
-
SSDEEP
49152:1xbSb/H0Vt7xMhl7Q0DICxR2thuuV4uA+OsQwVKc:vgcVbW9Q0DIC72pV4upOwN
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1752 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1752 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1752 EXCEL.EXE 1752 EXCEL.EXE 1752 EXCEL.EXE 1752 EXCEL.EXE 1752 EXCEL.EXE 1752 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Erebus-master\local\2020-04-10-mssb.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5af724ae319717c0a83a19a5e656d48b6
SHA1259c53d22595c58a2560432551662fa588ab6508
SHA256fc73c906d7342a6f9370d5a307c96cc1c32a07127bac7c0b77e7217e4f33267a
SHA5121af255734ce4a8ac4ac6ed97e5ba0dcd2aa7f0d4218d7dd3809b97d6f2faa5bfb6cdadf8d8be13eeba1cf1141e0511e9f295ebc67909703a7e19bd9c713eb0ab