Overview

overview

10

Static

static

02cc96d77c...08.exe

windows7_x64

10

02cc96d77c...08.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    88s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    17-05-2022 11:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    02cc96d77c375a798a8e70247ffb52f854b05523bd3d8d2ba6d165e406f76c08.exe

  • Size

    811KB

  • MD5

    7a595e537041af7a24c5e83e773bb3eb

  • SHA1

    2c2a9f52303694aa8682774ce36ed09a9bae2f92

  • SHA256

    02cc96d77c375a798a8e70247ffb52f854b05523bd3d8d2ba6d165e406f76c08

  • SHA512

    70b488fcb7a4517e1b184c1ebd910a4ab113499506d4844252290a82db8ae89e982ef0a5c7200648bf28a8c3e88208823e463d790e14768c383cd77451ec780d

Score
10/10
eternitystealersuricata

Malware Config

Signatures

  • Detects Eternity stealer 1 IoCs
    stealer
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

    eternity
  • suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)

    suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eternitypr .net in TLS SNI)

    suricata
  • suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)

    suricata: ET MALWARE Observed Win32/Eternity Stealer Domain (eterprx .net in TLS SNI)

    suricata
  • suricata: ET MALWARE Win32/Eternity Stealer Activity (POST)

    suricata: ET MALWARE Win32/Eternity Stealer Activity (POST)

    suricata
  • suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)

    suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eternitypr .net)

    suricata
  • suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)

    suricata: ET MALWARE Win32/Eternity Stealer CnC Domain in DNS Lookup (eterprx .net)

    suricata
  • Executes dropped EXE 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02cc96d77c375a798a8e70247ffb52f854b05523bd3d8d2ba6d165e406f76c08.exe
    "C:\Users\Admin\AppData\Local\Temp\02cc96d77c375a798a8e70247ffb52f854b05523bd3d8d2ba6d165e406f76c08.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2000
    • C:\Users\Admin\AppData\Local\Temp\dcd.exe
      "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
      2⤵
      • Executes dropped EXE
      PID:4116
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2000 -s 1852
      2⤵
      • Program crash
      PID:4400
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 412 -p 2000 -ip 2000
    1⤵
      PID:4320

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\dcd.exe
      Filesize

      227KB

      MD5

      b5ac46e446cead89892628f30a253a06

      SHA1

      f4ad1044a7f77a1b02155c3a355a1bb4177076ca

      SHA256

      def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

      SHA512

      bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\dcd.exe
      Filesize

      227KB

      MD5

      b5ac46e446cead89892628f30a253a06

      SHA1

      f4ad1044a7f77a1b02155c3a355a1bb4177076ca

      SHA256

      def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

      SHA512

      bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

      Download Submit

    • memory/2000-130-0x0000000000F90000-0x0000000001062000-memory.dmp

      Filesize

      840KB

      Download

    • memory/2000-131-0x00007FFE0F180000-0x00007FFE0FC41000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4116-132-0x0000000000000000-mapping.dmp

      Download