eternity | 01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8

General

Target

01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe
Size

821KB
MD5

f0fb2e060ed8f72274ab31e693d646f1
SHA1

3d50e7a572554c7366928f7a165300d2ea60a39c
SHA256

01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8
SHA512

b642e31d469fe1e7edfad5172d5bcba2c3929db50e0becc771709ea22b40aa7b64cab0c0bc89c10e1862f60bf943eae7107ae9d905fe425c33cc5be2b245f1c1

Score

10^/10

Detects Eternity stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/3664-130-0x0000000000E30000-0x0000000000F02000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)
suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)
suricata
suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)
suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)
suricata
suricata: ET MALWARE Win32/Eternity Stealer Activity (POST)
suricata: ET MALWARE Win32/Eternity Stealer Activity (POST)
suricata
suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)
suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)
suricata
suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)
suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)
suricata
Executes dropped EXE 1 IoCs

Processes:

dcd.exe

pid process

3388 dcd.exe

pid	process
3388	dcd.exe

Drops startup file 2 IoCs

Processes:

01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe	01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe	01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2088 3664 WerFault.exe 01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe

description pid process

Token: SeDebugPrivilege 3664 01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe

pid	pid_target	process	target process
2088	3664	WerFault.exe	01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe

description	pid	process
Token: SeDebugPrivilege	3664	01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe

description	pid	process	target process
PID 3664 wrote to memory of 3388	3664	01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe	dcd.exe
PID 3664 wrote to memory of 3388	3664	01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe	dcd.exe
PID 3664 wrote to memory of 3388	3664	01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe	dcd.exe

C:\Users\Admin\AppData\Local\Temp\01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe
"C:\Users\Admin\AppData\Local\Temp\01806a0d4b8e1ec385d206d28a27518f1a6c6373061a1e486d21de92b7fe50a8.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3664 -s 1944
  2⤵
  - Program crash
  PID:2088

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 3664 -ip 3664
1⤵
PID:2808

C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
memory/3388-132-0x0000000000000000-mapping.dmp

Download
memory/3664-130-0x0000000000E30000-0x0000000000F02000-memory.dmp

Filesize
840KB

Download
memory/3664-131-0x00007FFEFD280000-0x00007FFEFDD41000-memory.dmp

Filesize
10.8MB

Download