eternity | 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a

General

Target

24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
Size

3.3MB
MD5

4d05c920040c671e49187a179033c50b
SHA1

387a1318539ff16974c21ed6e78fbcbe8e73e3fa
SHA256

24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a
SHA512

f86f5a2e11ceed5a212ae1c61d1c1f31d125ee09cd007610db0db0720fedc08d874807defa029136e6c063ab1e03f47b67298d25a827ebe45ce7f774e5c79849
SSDEEP

49152:Duvjict75qI24MnFmAhxC5fGQRbZtU4axGtOEdzx5onb5EnWcq3jAvKUYgeGc:Duvjict4nFLxafGQNTUNxNMLoVtcWdP

Score

10^/10

eternity

Malware Config

Extracted

Family

eternity

Attributes

payload_urls
http://178.20.44.214/edgedownload.exe

http://178.20.44.214/a.exe

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Downloads MZ/PE file

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 624	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	28

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
Token: SeDebugPrivilege	624	InstallUtil.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1276	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 2032 wrote to memory of 1276	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 2032 wrote to memory of 1276	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 2032 wrote to memory of 1276	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 2032 wrote to memory of 1276	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 2032 wrote to memory of 1276	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 2032 wrote to memory of 1276	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 2032 wrote to memory of 1276	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 2032 wrote to memory of 1276	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 2032 wrote to memory of 1276	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 2032 wrote to memory of 1276	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 2032 wrote to memory of 1276	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	27
PID 2032 wrote to memory of 624	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	28
PID 2032 wrote to memory of 624	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	28
PID 2032 wrote to memory of 624	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	28
PID 2032 wrote to memory of 624	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	28
PID 2032 wrote to memory of 624	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	28
PID 2032 wrote to memory of 624	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	28
PID 2032 wrote to memory of 624	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	28
PID 2032 wrote to memory of 624	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	28
PID 2032 wrote to memory of 624	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	28
PID 2032 wrote to memory of 624	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	28
PID 2032 wrote to memory of 624	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	28
PID 2032 wrote to memory of 624	2032	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	28

C:\Users\Admin\AppData\Local\Temp\24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
"C:\Users\Admin\AppData\Local\Temp\24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:1276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/624-73-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/624-82-0x00000000007A0000-0x00000000007BA000-memory.dmp

Filesize
104KB

Download
memory/624-81-0x0000000005EA0000-0x0000000005FC2000-memory.dmp

Filesize
1.1MB

Download
memory/624-80-0x0000000005770000-0x00000000058BA000-memory.dmp

Filesize
1.3MB

Download
memory/624-78-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/624-76-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/624-74-0x000000000054C1BE-mapping.dmp

Download
memory/1276-64-0x0000000000090000-0x00000000001E2000-memory.dmp

Filesize
1.3MB

Download
memory/1276-67-0x0000000000090000-0x00000000001E2000-memory.dmp

Filesize
1.3MB

Download
memory/1276-66-0x0000000000090000-0x00000000001E2000-memory.dmp

Filesize
1.3MB

Download
memory/1276-63-0x0000000000090000-0x00000000001E2000-memory.dmp

Filesize
1.3MB

Download
memory/2032-54-0x0000000000120000-0x00000000008EC000-memory.dmp

Filesize
7.8MB

Download
memory/2032-62-0x0000000002850000-0x0000000002856000-memory.dmp

Filesize
24KB

Download
memory/2032-61-0x00000000028A0000-0x00000000028BA000-memory.dmp

Filesize
104KB

Download
memory/2032-60-0x0000000000DF0000-0x0000000000E08000-memory.dmp

Filesize
96KB

Download
memory/2032-59-0x0000000002800000-0x0000000002834000-memory.dmp

Filesize
208KB

Download
memory/2032-58-0x0000000006080000-0x000000000629E000-memory.dmp

Filesize
2.1MB

Download
memory/2032-57-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing