MALICIOUS — 782_Win32.EternalRocks.bin

MALICIOUS — 782_Win32.EternalRocks.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Eternalrocks1 family. 7 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 44472436a5b46d19cb34fa0e74924e4efc80dfa2ed491773a2852b03853221a2
• SHA-1: 25861c01098e38fc1fe024792d16c2c1629bbb82
• MD5: d9b74fa657e49e89d458ec8fa764b953
• imphash: d8584eb10be97093c07f00553557c177
• ssdeep: 12288:Vi+Nwhm35C2vhXxKeg+5rk2hKt1Hbw/DuvldqJ1ghw0XbfjxyFfmcikB1b2wk7c:VZ5C2+eg+5rk261HUruHl
• TLSH: T1C24E947CC937C2BDFB7F8AE27C120ACD502A741C54603CCF010DDA25D18AA6756B65AA
• Submitted as: 782_Win32.EternalRocks.bin
• File type: pe · Size: 653824 bytes
• Verdict: malicious (100/100) · Family: Eternalrocks1

Detections (7 of 52 engines)

• capa (capabilities): capability:execution/powershell
• ClamAV (daily): {MD5}bin.trojan.eternalrocks1.7934.UNOFFICIAL
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: TrojanDownloader:Win32/Eterock.A
• Emsisoft (Emergency Kit): Trojan-Downloader.VB
• Kaspersky (KVRT): Trojan.Win32.Reconyc.hylf

MITRE ATT&CK

• T1059.001
• T1071.001
• T1543.003
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

• ClamAV (daily) flagged {MD5}bin.trojan.eternalrocks1.7934.UNOFFICIAL (rule {MD5}bin.trojan.eternalrocks1.7934.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 5 finding(s), e.g. RWX/private injected region in svchost.exe (pid 932) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged TrojanDownloader:Win32/Eterock.A (rule TrojanDownloader:Win32/Eterock.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan-Downloader.VB (rule Trojan-Downloader.VB) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan.Win32.Reconyc.hylf (rule Trojan.Win32.Reconyc.hylf) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://api.nuget.org/packages/taskscheduler.2.5.23.nupkg, https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg, http://api.nuget.org/packages/sharpziplib.0.86.0.nupkg - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

28365 behavior events · 2 ATT&CK techniques · 4 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/6136/files/a419b2d3e395cb78ee120716ef2b33219b636645228a383b4c50d70dbfde9c68 - a419b2d3e395cb78ee120716ef2b33219b636645228a383b4c50d70dbfde9c68
• /opt/CAPEv2/storage/analyses/6136/files/fed1f6e37d4349cf31eed58d4b48da017446b4c9a53a04c8ea5906d306575eab - fed1f6e37d4349cf31eed58d4b48da017446b4c9a53a04c8ea5906d306575eab
• 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54 - 9df288d7098c73a9fa5fd19c46ca81266b7c841420ea36617cd9587196703e54
• 046803e73879d876c4fbf57eb71238bb95a1400f2bb7587b629254024df56535 - 046803e73879d876c4fbf57eb71238bb95a1400f2bb7587b629254024df56535

Embedded URLs

• http://api.nuget.org/packages/taskscheduler.2.5.23.nupkg
• https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg
• http://api.nuget.org/packages/sharpziplib.0.86.0.nupkg
• https://api.nuget.org/packages/sharpziplib.0.86.0.nupkg
• http://download.microsoft.com/download/a/3/f/a3f1bf98-18f3-4036-9b68-8e6de530ce0a/NetFx64.exe
• http://download.microsoft.com/download/5/6/7/567758a3-759e-473e-bf8f-52154438565a/dotnetfx.exe

Embedded domains

• api.nuget.org
• download.microsoft.com

File paths

• f:\dd\vctools\crt\vcruntime\src\internal\per_thread_data.cpp
• C:\Windows\UpdateInstaller.exe
• C:\Program
• f:\dd\vctools\crt\vcruntime\src\internal\winapi_downlevel.cpp
• f:\dd\vctools\crt\vcruntime\src\eh\std_exception.cpp
• c:\Program

More Eternalrocks1 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report