MALICIOUS — 792_Win32.EternalRocks.bin

MALICIOUS — 792_Win32.EternalRocks.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Eternalrocks1 family. 8 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 6bc73659a9f251eef5c4e4e4aa7c05ff95b3df58cde829686ceee8bd845f3442
• SHA-1: ca6e367bc08a3c7fb38994201ab9e6feb828798b
• MD5: 7215ff96a6bd77ebd87c2c018ada3cd1
• imphash: 3346cb40178ad6947f0e7b0bc203b92c
• ssdeep: 12288:XGm4jr15+btYHDOlTz6TcOGQQMlf6iFRJyFOy3eUqWZGKeLh7w/wHJRGHUQBaBF:fQr++SFz6TccDbp
• TLSH: T1954DC7BCCD31D6BDFF3B4BA35C024ECE2066741C18643847081DEB15E209A9B6A756B9
• Submitted as: 792_Win32.EternalRocks.bin
• File type: pe · Size: 597504 bytes
• Verdict: malicious (100/100) · Family: Eternalrocks1

Detections (8 of 52 engines)

• capa (capabilities): capability:execution/powershell
• ClamAV (daily): {MD5}bin.trojan.eternalrocks1.7931.UNOFFICIAL
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: TrojanDownloader:Win32/Eterock.A
• Emsisoft (Emergency Kit): Generic.Backdoor.ShadowBrokers.07B3E2B2
• Trellix Stinger (McAfee): Generic Trojan.hg
• Kaspersky (KVRT): Trojan.Win32.Reconyc.mcne

MITRE ATT&CK

• T1059.001
• T1071.001
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

• ClamAV (daily) flagged {MD5}bin.trojan.eternalrocks1.7931.UNOFFICIAL (rule {MD5}bin.trojan.eternalrocks1.7931.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 5 finding(s), e.g. RWX/private injected region in svchost.exe (pid 948) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged TrojanDownloader:Win32/Eterock.A (rule TrojanDownloader:Win32/Eterock.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Generic.Backdoor.ShadowBrokers.07B3E2B2 (rule Generic.Backdoor.ShadowBrokers.07B3E2B2) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Generic Trojan.hg (rule Generic Trojan.hg) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan.Win32.Reconyc.mcne (rule Trojan.Win32.Reconyc.mcne) - engine signal, weight 0.55, confidence 0.85
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://api.nuget.org/packages/taskscheduler.2.5.23.nupkg, https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg, http://api.nuget.org/packages/sharpziplib.0.86.0.nupkg - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

7242 behavior events · 1 ATT&CK techniques · 2 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/6139/files/a419b2d3e395cb78ee120716ef2b33219b636645228a383b4c50d70dbfde9c68 - a419b2d3e395cb78ee120716ef2b33219b636645228a383b4c50d70dbfde9c68
• /opt/CAPEv2/storage/analyses/6139/files/414438acc1333dd6a5ea78bb971d57ce7fd8400b5759dc6037097ce39c2866bb - 414438acc1333dd6a5ea78bb971d57ce7fd8400b5759dc6037097ce39c2866bb

Embedded URLs

• http://api.nuget.org/packages/taskscheduler.2.5.23.nupkg
• https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg
• http://api.nuget.org/packages/sharpziplib.0.86.0.nupkg
• https://api.nuget.org/packages/sharpziplib.0.86.0.nupkg
• http://download.microsoft.com/download/a/3/f/a3f1bf98-18f3-4036-9b68-8e6de530ce0a/NetFx64.exe
• http://download.microsoft.com/download/5/6/7/567758a3-759e-473e-bf8f-52154438565a/dotnetfx.exe

Embedded domains

• api.nuget.org
• download.microsoft.com

File paths

• C:\Windows\UpdateInstaller.exe
• f:\dd\vctools\crt\vcruntime\src\internal\per_thread_data.cpp
• C:\Program
• f:\dd\vctools\crt\vcruntime\src\internal\winapi_downlevel.cpp
• f:\dd\vctools\crt\vcruntime\src\eh\std_exception.cpp
• c:\Program

More Eternalrocks1 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report