eternity | 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a

General

Target

24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
Size

3.3MB
MD5

4d05c920040c671e49187a179033c50b
SHA1

387a1318539ff16974c21ed6e78fbcbe8e73e3fa
SHA256

24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a
SHA512

f86f5a2e11ceed5a212ae1c61d1c1f31d125ee09cd007610db0db0720fedc08d874807defa029136e6c063ab1e03f47b67298d25a827ebe45ce7f774e5c79849
SSDEEP

49152:Duvjict75qI24MnFmAhxC5fGQRbZtU4axGtOEdzx5onb5EnWcq3jAvKUYgeGc:Duvjict4nFLxafGQNTUNxNMLoVtcWdP

Score

10^/10

eternity

Malware Config

Extracted

Family

eternity

Attributes

payload_urls
http://178.20.44.214/edgedownload.exe

http://178.20.44.214/a.exe

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Downloads MZ/PE file

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1492 set thread context of 1752	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
Token: SeDebugPrivilege	1752	InstallUtil.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1752	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 1492 wrote to memory of 1752	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 1492 wrote to memory of 1752	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 1492 wrote to memory of 1752	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 1492 wrote to memory of 1752	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 1492 wrote to memory of 1752	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 1492 wrote to memory of 1752	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 1492 wrote to memory of 1752	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 1492 wrote to memory of 1752	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 1492 wrote to memory of 1752	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 1492 wrote to memory of 1752	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 1492 wrote to memory of 1752	1492	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27

C:\Users\Admin\AppData\Local\Temp\24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
"C:\Users\Admin\AppData\Local\Temp\24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1492-54-0x00000000003C0000-0x0000000000B8C000-memory.dmp

Filesize
7.8MB

Download
memory/1492-57-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1492-58-0x00000000063D0000-0x00000000065EE000-memory.dmp

Filesize
2.1MB

Download
memory/1492-59-0x0000000002640000-0x0000000002674000-memory.dmp

Filesize
208KB

Download
memory/1492-60-0x0000000000E00000-0x0000000000E18000-memory.dmp

Filesize
96KB

Download
memory/1492-61-0x0000000002710000-0x000000000272A000-memory.dmp

Filesize
104KB

Download
memory/1492-62-0x0000000002670000-0x0000000002676000-memory.dmp

Filesize
24KB

Download
memory/1752-63-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1752-64-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1752-66-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1752-67-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1752-68-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1752-71-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1752-73-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1752-75-0x0000000005A70000-0x0000000005BBA000-memory.dmp

Filesize
1.3MB

Download
memory/1752-76-0x0000000005D80000-0x0000000005EA2000-memory.dmp

Filesize
1.1MB

Download
memory/1752-77-0x0000000000AC0000-0x0000000000ADA000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing