MALICIOUS — 803_Win32.EternalRocks.bin

MALICIOUS — 803_Win32.EternalRocks.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Eternalrocks1 family. 7 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 94189147ba9749fd0f184fe94b345b7385348361480360a59f12adf477f61c97
• SHA-1: f1c027679d5009da067b12af258adc8afaade178
• MD5: 496131b90f83e8278462d2dd21213646
• imphash: f051371b13a6ad83d52e4fb619d303a0
• ssdeep: 6144:TztgTcIX6E+QQMl6CnvXj7e9KOoFRJyFOwt3eN6qWZGTeeLhznw/wHJRGHUQBaB:Tz6TcOGQQMlf6iFRJyFOy3eUqWZGKeL
• TLSH: T13247CD7CCD71D6BEFF3F47E75C024ADE2176781C18607887101C6B40D20A69B2AB56AA
• Submitted as: 803_Win32.EternalRocks.bin
• File type: pe · Size: 346112 bytes
• Verdict: malicious (100/100) · Family: Eternalrocks1

Detections (7 of 52 engines)

• capa (capabilities): capability:execution/powershell
• ClamAV (daily): {MD5}bin.trojan.eternalrocks1.7929.UNOFFICIAL
• YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
• Microsoft Defender: TrojanDownloader:Win32/Eterock.A
• Emsisoft (Emergency Kit): Generic.Backdoor.ShadowBrokers.A3B68A18
• Trellix Stinger (McAfee): Trojan-Bluedoom!8632E7433FD4
• Kaspersky (KVRT): Trojan.Win32.Reconyc.hxyl

MITRE ATT&CK

• T1059.001
• T1071.001
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged {MD5}bin.trojan.eternalrocks1.7929.UNOFFICIAL (rule {MD5}bin.trojan.eternalrocks1.7929.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged TrojanDownloader:Win32/Eterock.A (rule TrojanDownloader:Win32/Eterock.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Generic.Backdoor.ShadowBrokers.A3B68A18 (rule Generic.Backdoor.ShadowBrokers.A3B68A18) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Trojan-Bluedoom!8632E7433FD4 (rule Trojan-Bluedoom!8632E7433FD4) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Trojan.Win32.Reconyc.hxyl (rule Trojan.Win32.Reconyc.hxyl) - engine signal, weight 0.55, confidence 0.85
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
• YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://api.nuget.org/packages/taskscheduler.2.5.23.nupkg, https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg, http://api.nuget.org/packages/sharpziplib.0.86.0.nupkg - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2414 behavior events · 1 ATT&CK techniques · 31 dropped files.

Runtime network

• none

Dropped files

• /opt/CAPEv2/storage/analyses/6140/files/e7120939c325e9b497c87a1e8af9bf6d852cbc3d0bdea47559a7b198dfb0de89 - e7120939c325e9b497c87a1e8af9bf6d852cbc3d0bdea47559a7b198dfb0de89
• /opt/CAPEv2/storage/analyses/6140/files/c08207222075c63d6ea3e87e80e0be16c30241cf2c193e063c42b5f8df46f4a3 - c08207222075c63d6ea3e87e80e0be16c30241cf2c193e063c42b5f8df46f4a3
• /opt/CAPEv2/storage/analyses/6140/files/723ef109024a7d1b03e6335ee53d0140027b2224765fe5fed23d1b07906a03a6 - 723ef109024a7d1b03e6335ee53d0140027b2224765fe5fed23d1b07906a03a6
• /opt/CAPEv2/storage/analyses/6140/files/66dd8af1840214c87b51175659c5ac5b2c5fbe19b881ec10494e1e5624ab57cf - 66dd8af1840214c87b51175659c5ac5b2c5fbe19b881ec10494e1e5624ab57cf
• /opt/CAPEv2/storage/analyses/6140/files/1eebb7cba7cd54c8501f2f8e9f6f1d83a7a295d4adf86cf59d0e3571404be9e0 - 1eebb7cba7cd54c8501f2f8e9f6f1d83a7a295d4adf86cf59d0e3571404be9e0
• /opt/CAPEv2/storage/analyses/6140/files/3e16c6c423ec88857afc1559a5e976f79c80f8eec13c9f7b53971929165dfa49 - 3e16c6c423ec88857afc1559a5e976f79c80f8eec13c9f7b53971929165dfa49
• /opt/CAPEv2/storage/analyses/6140/files/90892020c8b6844e1a8060c8eacd717231ef5df53f50df2dbdca854b18cd51b9 - 90892020c8b6844e1a8060c8eacd717231ef5df53f50df2dbdca854b18cd51b9
• /opt/CAPEv2/storage/analyses/6140/files/9ef4ed79ba2075550cba86ffaf34e0c00a7eaa73c8bb539de4c3d06810864e10 - 9ef4ed79ba2075550cba86ffaf34e0c00a7eaa73c8bb539de4c3d06810864e10
• /opt/CAPEv2/storage/analyses/6140/files/a5cedbb6a252c47d0f3d2828bb05a319e97ef9158f802a91723af9b19f4fbd30 - a5cedbb6a252c47d0f3d2828bb05a319e97ef9158f802a91723af9b19f4fbd30
• /opt/CAPEv2/storage/analyses/6140/files/a529eb42bc10d6fbd759f4988205ff522e53da52a902df28fd04f10a23b96fc0 - a529eb42bc10d6fbd759f4988205ff522e53da52a902df28fd04f10a23b96fc0
• /opt/CAPEv2/storage/analyses/6140/files/9e7267f0929ee74c5fb17790773990f50c73c5d6ed4df8f6e2eb77f9636cf168 - 9e7267f0929ee74c5fb17790773990f50c73c5d6ed4df8f6e2eb77f9636cf168
• /opt/CAPEv2/storage/analyses/6140/files/4048a9a4c2f8a9bd64728c035528c4cc3bf3ecd69ec44ba261856f28217f4388 - 4048a9a4c2f8a9bd64728c035528c4cc3bf3ecd69ec44ba261856f28217f4388
• /opt/CAPEv2/storage/analyses/6140/files/8d170964ab3f4f8af2ab50dfe10abd069978a30b5410ff84b09f397ccd7d26b0 - 8d170964ab3f4f8af2ab50dfe10abd069978a30b5410ff84b09f397ccd7d26b0
• /opt/CAPEv2/storage/analyses/6140/files/e64daddf49f64ea5ba6e76bd7989147606ad87b89e649fb332a5e5b5aca117f6 - e64daddf49f64ea5ba6e76bd7989147606ad87b89e649fb332a5e5b5aca117f6
• /opt/CAPEv2/storage/analyses/6140/files/40cf96d4459aa72bcceacc32a7cdbfb2533e0beb170fc20d53ca3c5213ba7f6a - 40cf96d4459aa72bcceacc32a7cdbfb2533e0beb170fc20d53ca3c5213ba7f6a

Embedded URLs

• http://api.nuget.org/packages/taskscheduler.2.5.23.nupkg
• https://api.nuget.org/packages/taskscheduler.2.5.23.nupkg
• http://api.nuget.org/packages/sharpziplib.0.86.0.nupkg
• https://api.nuget.org/packages/sharpziplib.0.86.0.nupkg
• http://download.microsoft.com/download/a/3/f/a3f1bf98-18f3-4036-9b68-8e6de530ce0a/NetFx64.exe
• http://download.microsoft.com/download/5/6/7/567758a3-759e-473e-bf8f-52154438565a/dotnetfx.exe

Embedded domains

• api.nuget.org
• download.microsoft.com

File paths

• C:\Program
• c:\Program

More Eternalrocks1 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report