eternity | 0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c

General

Target

0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe
Size

1.3MB
MD5

ad5bb64a50628c388bb7ae7a64c39488
SHA1

92487fe379e1175eb63b4c7ccfdf56e570e86396
SHA256

0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c
SHA512

2f2f62a1f7f0fa452a0e01ae7f9f154a7c31264d4c7648c2be4194212492ba3fa48a5d13df096ac844d5db9ac9dfc76b6bde52ec7e6dc2137ded41a314e91a4a

Score

10^/10

Detects Eternity stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/548-130-0x0000000000DF0000-0x0000000000F04000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)
suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)
suricata
suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)
suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)
suricata
suricata: ET MALWARE Win32/Eternity Stealer Activity (POST)
suricata: ET MALWARE Win32/Eternity Stealer Activity (POST)
suricata
suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)
suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)
suricata
suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)
suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)
suricata
Executes dropped EXE 1 IoCs

Processes:

dcd.exe

pid process

720 dcd.exe

pid	process
720	dcd.exe

Drops startup file 2 IoCs

Processes:

0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe	0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe	0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3356 548 WerFault.exe 0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe

description pid process

Token: SeDebugPrivilege 548 0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe

pid	pid_target	process	target process
3356	548	WerFault.exe	0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe

description	pid	process
Token: SeDebugPrivilege	548	0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe

description	pid	process	target process
PID 548 wrote to memory of 720	548	0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe	dcd.exe
PID 548 wrote to memory of 720	548	0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe	dcd.exe
PID 548 wrote to memory of 720	548	0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe	dcd.exe

C:\Users\Admin\AppData\Local\Temp\0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe
"C:\Users\Admin\AppData\Local\Temp\0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 548 -s 1960
  2⤵
  - Program crash
  PID:3356

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 548 -ip 548
1⤵
PID:3404

C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
memory/548-130-0x0000000000DF0000-0x0000000000F04000-memory.dmp

Filesize
1.1MB

Download
memory/548-131-0x00007FF8BA280000-0x00007FF8BAD41000-memory.dmp

Filesize
10.8MB

Download
memory/720-132-0x0000000000000000-mapping.dmp

Download