Analysis

  • max time kernel
    150s
  • max time network
    176s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/09/2022, 22:16

General

  • Target

    cdef9022412b98764813da2d8310179897caa8f9de07d3f1bad762b60a95802a.exe

  • Size

    2.2MB

  • MD5

    b2ea50bd71262b396ff357dba4cd7e11

  • SHA1

    7a4e027ea10d6a1e9ab3fe54d0c7f8ac85e735b8

  • SHA256

    cdef9022412b98764813da2d8310179897caa8f9de07d3f1bad762b60a95802a

  • SHA512

    844d190834a467339e6134f273b2e21d56b192a178e905a3de6c30798ea834b9aaaf064bef0e6b53419fe25fbdb72ac6b1c5619a6e3617e95b4038377ea8a5a6

  • SSDEEP

    24576:klfzzUFAK8FuRSqEytpJ5oGrHhnlbbHFECMNNPtf/YCrGI74FNlofwms4qpy/:k9zUDeubE8pPo4HhlbqpNbYgAc

Score
10/10

Malware Config

Extracted

Family

eternity

Attributes
  • payload_urls

    http://178.20.44.214/edgedownload.exe

    http://178.20.44.214/a.exe

Signatures

  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cdef9022412b98764813da2d8310179897caa8f9de07d3f1bad762b60a95802a.exe
    "C:\Users\Admin\AppData\Local\Temp\cdef9022412b98764813da2d8310179897caa8f9de07d3f1bad762b60a95802a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3828
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      2⤵
        PID:4192
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4196

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/3828-116-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-117-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-118-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-119-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-120-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-121-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-123-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-122-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-124-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-125-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-126-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-127-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-128-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-129-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-130-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-131-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-132-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-133-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-134-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-135-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-137-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-138-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-139-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-136-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-140-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-141-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-143-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-144-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-145-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-142-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-146-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-147-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-148-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-149-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-150-0x0000000000AC0000-0x0000000000CF8000-memory.dmp

            Filesize

            2.2MB

          • memory/3828-152-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-153-0x00000000053D0000-0x000000000546C000-memory.dmp

            Filesize

            624KB

          • memory/3828-154-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-151-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-155-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-156-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-158-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-157-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-159-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-160-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-163-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-162-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-165-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-164-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-166-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-161-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-167-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-168-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-170-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-171-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-169-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-172-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-173-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-174-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-177-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-176-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-178-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-181-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-180-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-179-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-175-0x00000000778F0000-0x0000000077A7E000-memory.dmp

            Filesize

            1.6MB

          • memory/3828-196-0x00000000055C0000-0x00000000055F4000-memory.dmp

            Filesize

            208KB

          • memory/3828-197-0x0000000006440000-0x000000000693E000-memory.dmp

            Filesize

            5.0MB

          • memory/3828-198-0x0000000006130000-0x00000000061C2000-memory.dmp

            Filesize

            584KB

          • memory/3828-201-0x0000000006120000-0x000000000612A000-memory.dmp

            Filesize

            40KB

          • memory/3828-205-0x0000000008520000-0x0000000008538000-memory.dmp

            Filesize

            96KB

          • memory/3828-208-0x0000000008F00000-0x0000000008F1A000-memory.dmp

            Filesize

            104KB

          • memory/3828-209-0x0000000002E20000-0x0000000002E26000-memory.dmp

            Filesize

            24KB

          • memory/4196-243-0x0000000000400000-0x0000000000552000-memory.dmp

            Filesize

            1.3MB

          • memory/4196-274-0x00000000060E0000-0x0000000006130000-memory.dmp

            Filesize

            320KB

          • memory/4196-280-0x0000000006230000-0x000000000637A000-memory.dmp

            Filesize

            1.3MB