eternity | 01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6

General

Target

01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe
Size

1.6MB
MD5

51f680c87f810a25cb8d9f4a217156b6
SHA1

a9cd1c857692aa49dfa9fc93cde2204002326d31
SHA256

01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6
SHA512

f7a723641bb65eb4763784da1c2c36d9b0ae07cc7241eb9ef816e20308cfbd1ee77780503768d5784f90a1bc387c09271ccf98fbee0bc8fec2ac9c5b20563c7d

Score

10^/10

eternity spyware stealer suricata

Malware Config

Signatures

Detects Eternity stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4372-130-0x0000000000600000-0x000000000079C000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)
suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)
suricata
suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)
suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)
suricata
suricata: ET MALWARE Win32/Eternity Stealer Activity (POST)
suricata: ET MALWARE Win32/Eternity Stealer Activity (POST)
suricata
suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)
suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)
suricata
suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)
suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)
suricata
Drops file in Drivers directory 1 IoCs

Processes:

SmotaProxy_v1.1.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts SmotaProxy_v1.1.exe
Executes dropped EXE 2 IoCs

Processes:

SmotaProxy_v1.1.exedcd.exe

pid process

4080 SmotaProxy_v1.1.exe
3864 dcd.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	SmotaProxy_v1.1.exe

pid	process
4080	SmotaProxy_v1.1.exe
3864	dcd.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4648 4372 WerFault.exe 01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe

description pid process

Token: SeDebugPrivilege 4372 01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe

pid	pid_target	process	target process
4648	4372	WerFault.exe	01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe

description	pid	process
Token: SeDebugPrivilege	4372	01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe

description	pid	process	target process
PID 4372 wrote to memory of 4080	4372	01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe	SmotaProxy_v1.1.exe
PID 4372 wrote to memory of 4080	4372	01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe	SmotaProxy_v1.1.exe
PID 4372 wrote to memory of 3864	4372	01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe	dcd.exe
PID 4372 wrote to memory of 3864	4372	01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe	dcd.exe
PID 4372 wrote to memory of 3864	4372	01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe	dcd.exe

C:\Users\Admin\AppData\Local\Temp\01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe
"C:\Users\Admin\AppData\Local\Temp\01084efc7da9b5f5aaa6e109ac5ea39756687c9334df85f757c89149d30a79b6.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\v5osubqu.4zy\SmotaProxy_v1.1.exe
  "C:\Users\Admin\AppData\Local\Temp\v5osubqu.4zy\SmotaProxy_v1.1.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  PID:4080
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4372 -s 2428
  2⤵
  - Program crash
  PID:4648

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 4372 -ip 4372
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\v5osubqu.4zy\SmotaProxy_v1.1.exe

Filesize
367KB

MD5
c305f6bfc6eb098e6831479181e01dc4

SHA1
74afedfd0f083d237a6a22470515adf8b50c089d

SHA256
40fc3e9e4e2b3f191e11de34dd6b135b7ef0da85b35b206a90f12fed240d71e7

SHA512
64634d629816ab39f9c08daea3da296e6fcee4b24210f70e05aa44586b19ce445758bb43e470567fc7d691c0dd202b1804e8524fe7a27ec62cca1fd0f91baf19

Download Submit
C:\Users\Admin\AppData\Local\Temp\v5osubqu.4zy\SmotaProxy_v1.1.exe

Filesize
367KB

MD5
c305f6bfc6eb098e6831479181e01dc4

SHA1
74afedfd0f083d237a6a22470515adf8b50c089d

SHA256
40fc3e9e4e2b3f191e11de34dd6b135b7ef0da85b35b206a90f12fed240d71e7

SHA512
64634d629816ab39f9c08daea3da296e6fcee4b24210f70e05aa44586b19ce445758bb43e470567fc7d691c0dd202b1804e8524fe7a27ec62cca1fd0f91baf19

Download Submit
memory/3864-135-0x0000000000000000-mapping.dmp

Download
memory/4080-133-0x0000000000000000-mapping.dmp

Download
memory/4372-130-0x0000000000600000-0x000000000079C000-memory.dmp

Filesize
1.6MB

Download
memory/4372-131-0x00000000028E0000-0x0000000002930000-memory.dmp

Filesize
320KB

Download
memory/4372-132-0x00007FFE12770000-0x00007FFE13231000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads