A deep dive into Data Privacy: Unraveling EternalRocks Ransomware

February 7, 2024

During this data privacy week, we will be looking at the recent ransomware attack on KQ. This attack was steered by a ransomware group known as ransommex which have since been continually active. In this blog, we will be analyzing sample malware to get the gist of what really happens at a technical point when a user executes a malicious file up to complete compromise of the user’s system.

There are two ways to analyze malware samples: static or dynamic analysis. We will use static analysis on a malware sample called EternalRocks worm that you can find here. EternalRocks emerged as a significant threat in the realm of cybersecurity in the year 2017. By delving into the code and artifacts without executing this malware, we aim to unravel the secrets of it and understand its potential impact on digital landscapes which will equally compare to recent more improve malwares.
File analysis

On downloading the sample, we can extract it as follows; using the password “infected” without the quotes.

Figure 1: Extracting the malware from the archive.
Figure 1: Extracting the malware from the archive.

Using file utility, we can see that it is indeed a windows executable. This dictates that this file is meant to be executed on a windows environment. This makes sense as most corporates will run windows as their main backbone operating system.

Figure 2: File structure.
Figure 2: File structure.

On this file’s metadata, the hacking group that goes by the name Shadow Brokers hacking group, had implanted fake details to make the executable look like it’s a legit software from Microsoft in the eyes of a defender.

Figure 3: Malware file metadata.
Figure 3: Malware file metadata.

Code Review

We can open the malware sample of EternalRocks in ghidra for a thorough review. Ghidra is a free open-source reverse engineering tool which will help us understand the inner workings of this malware. This process will involve analyzing the logic, functions, and potential vulnerabilities embedded within the code. Additionally, we will scrutinize any obfuscation techniques employed to impede static analysis, unraveling the layers that conceal the true nature of this malware.

This malware being a network, work spreads through public SMB exploits that is, eternalblue, eternalchampion, eternalromance and eternalsynergy. First stage malware UpdateInstaller.exe downloads necessary .NET components (for later stages) TaskScheduler and SharpZLib from Internet, while dropping svchost.exe.

Figure 4: Malware downloads TaskScheduler.
Figure 4: Malware downloads TaskScheduler.
Figure 5: Malware downloads SharpZlib executable.
Figure 5: Malware downloads SharpZlib executable.

Figure 5 Malware downloads SharpZlib executable.After downloading the archives, they are unzipped as shown below and stored in the path “c:\\Program Files\\Microsoft Updates”. This is done for both files after they are downloaded.

Figure 6: Malware extracts the files downloaded.
Figure 6: Malware extracts the files downloaded.

Component svchost.exe is used for downloading, unpacking and running Tor from along with C2 (ubgdgno5eswkhmpy.onion) communication requesting further instructions.

Figure 7: Malware executes svchost.exe file.
Figure 7: Malware executes svchost.exe file.

Second stage malware taskhost.exe is being downloaded after a predefined period (24h) from https://ubgdgno5eswkhmpy.onion/updates/download?id=PC and run. After initial run it drops the (contained) and unpacks directories payloads/, configs/ and bins/. After that, starts a random scan of opened 445 ports on Internet, while running contained exploits (inside directory bins/) and pushing the first stage malware through payloads (inside directory payloads/). Also, it expects running Tor process from first stage for further C2 communication.

Figure 8: Malware saves the files needed in disk C as shown
Figure 8: Malware saves the files needed in disk C as shown

Host base indicators

The paths are:
c:\Program Files\Microsoft Updates\
c:\Program Files\Microsoft Updates\svchost.exe
c:\Program Files\Microsoft Updates\installed.fgh
c:\Program Files\Microsoft Updates\ICSharpCode.SharpZipLib.dll
c:\Program Files\Microsoft Updates\Microsoft.Win32.TaskScheduler.dll
c:\Program Files\Microsoft Updates\SharpZLib\
c:\Program Files\Microsoft Updates\temp\
c:\Program Files\Microsoft Updates\temp\Tor\
c:\Program Files\Microsoft Updates\required.glo
c:\Program Files\Microsoft Updates\taskhost.exe
c:\Program Files\Microsoft Updates\
c:\Program Files\Microsoft Updates\TaskScheduler\
c:\Program Files\Microsoft Updates\torunzip.exe – in older variants

For persistence the two scheduled tasks ServiceHost and TaskHost had multiple triggers.

Figure 9: Task list on windows system.png
Figure 9: Task list on windows system.png

Among the IOCs shared on the internet include:



In conclusion, the static analysis of EternalRocks yields invaluable insights into its composition and functionalities. This knowledge empowers organizations to fortify their defenses and respond effectively to the ever-evolving landscape of cybersecurity threats. Ongoing vigilance and analysis remain paramount in safeguarding digital assets from emerging and sophisticated malware strains. Now that we have understood a high-level overview of how malware works, what can we do to protect ourselves?

Among the good habits recommended by malware researchers are:

  • Keeping software up to date – regular software updates ensure timely security patches.
  • Antivirus software – Use of antivirus software helps guard against known viruses and new ones through behavioral techniques.
  • Educating employees against attacks such as phishing etc. – users remain the weakest link up to date.




Share Article