eternity | 05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3

Analysis

Target

05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3.exe
Size

3.4MB
MD5

2e4de9ef1804c3616638a00344425e45
SHA1

5ee95d0a73e42a343afcd65f5f62c5fba58d7f82
SHA256

05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3
SHA512

4f696e07d49f5ab9d0e70b5d0be6db71169c3608889bb105a32113acfac603d63ffa904f5c74a33151aa6d469a9bf166519f0607a66191cb68932ce392d91323

Score

10^/10

eternity

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3136 1736 WerFault.exe 05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3.exe

pid	pid_target	process	target process
3136	1736	WerFault.exe	05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3.exe

C:\Users\Admin\AppData\Local\Temp\05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3.exe
"C:\Users\Admin\AppData\Local\Temp\05821994caa06407e84a713aa141667d2b22f83318721a1edaed49c07fc273b3.exe"
1⤵
PID:1736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 1272
  2⤵
  - Program crash
  PID:3136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1736 -ip 1736
1⤵
PID:1984

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1736-130-0x0000000000CD0000-0x0000000001040000-memory.dmp

Filesize
3.4MB

Download