Overview

overview

10

Static

static

0228790fc8...9c.exe

windows7_x64

10

0228790fc8...9c.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    92s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    17-05-2022 11:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe

  • Size

    1.3MB

  • MD5

    ad5bb64a50628c388bb7ae7a64c39488

  • SHA1

    92487fe379e1175eb63b4c7ccfdf56e570e86396

  • SHA256

    0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c

  • SHA512

    2f2f62a1f7f0fa452a0e01ae7f9f154a7c31264d4c7648c2be4194212492ba3fa48a5d13df096ac844d5db9ac9dfc76b6bde52ec7e6dc2137ded41a314e91a4a

Score
10/10
eternitystealersuricata

Malware Config

Signatures

  • Detects Eternity stealer 1 IoCs
    stealer
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity
  • suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)

    suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)

    suricata
  • suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)

    suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)

    suricata
  • suricata: ET MALWARE Win32/Eternity Stealer Activity (POST)

    suricata: ET MALWARE Win32/Eternity Stealer Activity (POST)

    suricata
  • suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)

    suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)

    suricata
  • suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)

    suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)

    suricata
  • Executes dropped EXE 1 IoCs
  • Drops startup file 2 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe
    "C:\Users\Admin\AppData\Local\Temp\0228790fc81ebe8afb505e1ee8b77b3f2bb507c8e41613f1abfea2ec4dfb719c.exe"
    1⤵
    • Drops startup file
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Users\Admin\AppData\Local\Temp\dcd.exe
      "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
      2⤵
      • Executes dropped EXE
      PID:720
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 548 -s 1960
      2⤵
      • Program crash
      PID:3356
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 408 -p 548 -ip 548
    1⤵
      PID:3404

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\dcd.exe
      Filesize

      227KB

      MD5

      b5ac46e446cead89892628f30a253a06

      SHA1

      f4ad1044a7f77a1b02155c3a355a1bb4177076ca

      SHA256

      def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

      SHA512

      bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\dcd.exe
      Filesize

      227KB

      MD5

      b5ac46e446cead89892628f30a253a06

      SHA1

      f4ad1044a7f77a1b02155c3a355a1bb4177076ca

      SHA256

      def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

      SHA512

      bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

      Download Submit
    • memory/548-130-0x0000000000DF0000-0x0000000000F04000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/548-131-0x00007FF8BA280000-0x00007FF8BAD41000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/720-132-0x0000000000000000-mapping.dmp
      Download