eternity | 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a

Analysis

max time kernel
66s
max time network
164s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
14/09/2022, 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
Size

3.3MB
MD5

4d05c920040c671e49187a179033c50b
SHA1

387a1318539ff16974c21ed6e78fbcbe8e73e3fa
SHA256

24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a
SHA512

f86f5a2e11ceed5a212ae1c61d1c1f31d125ee09cd007610db0db0720fedc08d874807defa029136e6c063ab1e03f47b67298d25a827ebe45ce7f774e5c79849
SSDEEP

49152:Duvjict75qI24MnFmAhxC5fGQRbZtU4axGtOEdzx5onb5EnWcq3jAvKUYgeGc:Duvjict4nFLxafGQNTUNxNMLoVtcWdP

Score

10^/10

eternity

Malware Config

Extracted

Family

eternity

Attributes

payload_urls
http://178.20.44.214/edgedownload.exe

http://178.20.44.214/a.exe

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Downloads MZ/PE file

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4696 set thread context of 992	4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
Token: SeDebugPrivilege	992	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 992	4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 4696 wrote to memory of 992	4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 4696 wrote to memory of 992	4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 4696 wrote to memory of 992	4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 4696 wrote to memory of 992	4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 4696 wrote to memory of 992	4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 4696 wrote to memory of 992	4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 4696 wrote to memory of 992	4696	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67

C:\Users\Admin\AppData\Local\Temp\24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
"C:\Users\Admin\AppData\Local\Temp\24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/992-253-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/992-284-0x0000000005750000-0x00000000057A0000-memory.dmp

Filesize
320KB

Download
memory/992-290-0x00000000058A0000-0x00000000059EA000-memory.dmp

Filesize
1.3MB

Download
memory/992-291-0x00000000059F0000-0x0000000005B12000-memory.dmp

Filesize
1.1MB

Download
memory/992-293-0x00000000056E0000-0x00000000056FA000-memory.dmp

Filesize
104KB

Download
memory/4696-154-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-160-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-122-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-123-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-124-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-125-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-126-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-127-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-128-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-129-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-130-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-131-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-132-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-133-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-134-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-135-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-136-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-137-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-138-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-139-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-142-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-141-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-140-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-143-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-144-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-145-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-146-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-159-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-148-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-149-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-150-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-151-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-152-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-153-0x00000000013C0000-0x0000000001B8C000-memory.dmp

Filesize
7.8MB

Download
memory/4696-120-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-155-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-121-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-156-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-147-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-161-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-162-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-163-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-164-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-165-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-167-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-169-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-170-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-168-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-171-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-166-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-172-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-173-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-174-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-175-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-176-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-177-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-178-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-179-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-180-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-181-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-182-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-183-0x00000000012D0000-0x000000000136C000-memory.dmp

Filesize
624KB

Download
memory/4696-185-0x0000000005370000-0x0000000005402000-memory.dmp

Filesize
584KB

Download
memory/4696-184-0x00000000057D0000-0x0000000005CCE000-memory.dmp

Filesize
5.0MB

Download
memory/4696-187-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-186-0x0000000005410000-0x0000000005760000-memory.dmp

Filesize
3.3MB

Download
memory/4696-189-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-188-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-207-0x00000000064F0000-0x000000000670E000-memory.dmp

Filesize
2.1MB

Download
memory/4696-119-0x0000000077740000-0x00000000778CE000-memory.dmp

Filesize
1.6MB

Download
memory/4696-208-0x00000000057A0000-0x00000000057D4000-memory.dmp

Filesize
208KB

Download
memory/4696-211-0x0000000006940000-0x000000000694A000-memory.dmp

Filesize
40KB

Download
memory/4696-215-0x0000000009730000-0x0000000009748000-memory.dmp

Filesize
96KB

Download
memory/4696-218-0x0000000007690000-0x00000000076AA000-memory.dmp

Filesize
104KB

Download
memory/4696-219-0x0000000008B70000-0x0000000008B76000-memory.dmp

Filesize
24KB

Download