eternity | 24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a

Analysis

max time kernel
144s
max time network
180s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
15-09-2022 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
Size

3.3MB
MD5

4d05c920040c671e49187a179033c50b
SHA1

387a1318539ff16974c21ed6e78fbcbe8e73e3fa
SHA256

24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a
SHA512

f86f5a2e11ceed5a212ae1c61d1c1f31d125ee09cd007610db0db0720fedc08d874807defa029136e6c063ab1e03f47b67298d25a827ebe45ce7f774e5c79849
SSDEEP

49152:Duvjict75qI24MnFmAhxC5fGQRbZtU4axGtOEdzx5onb5EnWcq3jAvKUYgeGc:Duvjict4nFLxafGQNTUNxNMLoVtcWdP

Score

10^/10

eternity

Malware Config

Extracted

Family

eternity

Attributes

payload_urls
http://178.20.44.214/edgedownload.exe

http://178.20.44.214/a.exe

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Downloads MZ/PE file

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 3680	2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
Token: SeDebugPrivilege	3680	InstallUtil.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 3680	2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 2404 wrote to memory of 3680	2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 2404 wrote to memory of 3680	2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 2404 wrote to memory of 3680	2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 2404 wrote to memory of 3680	2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 2404 wrote to memory of 3680	2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 2404 wrote to memory of 3680	2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67
PID 2404 wrote to memory of 3680	2404	24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe	67

C:\Users\Admin\AppData\Local\Temp\24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe
"C:\Users\Admin\AppData\Local\Temp\24b99a15afb676da6886b5b020d938c82704799876d4fcb4d611c7c7188c1e8a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-116-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-117-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-118-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-119-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-120-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-121-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-122-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-123-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-124-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-125-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-126-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-127-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-128-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-130-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-129-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-131-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-132-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-133-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-134-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-136-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-135-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-138-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-139-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-137-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-140-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-141-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-142-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-144-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-143-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-145-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-146-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-147-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-148-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-149-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-150-0x0000000000080000-0x000000000084C000-memory.dmp

Filesize
7.8MB

Download
memory/2404-151-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-152-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-153-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-156-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-157-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-158-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-160-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-159-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-161-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-162-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-163-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-165-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-167-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-166-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-164-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-169-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-168-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-172-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-171-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-170-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-173-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-174-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-175-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-176-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-178-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-177-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-179-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-180-0x0000000005060000-0x00000000050FC000-memory.dmp

Filesize
624KB

Download
memory/2404-181-0x0000000005620000-0x0000000005B1E000-memory.dmp

Filesize
5.0MB

Download
memory/2404-182-0x00000000051C0000-0x0000000005252000-memory.dmp

Filesize
584KB

Download
memory/2404-183-0x0000000005260000-0x00000000055B0000-memory.dmp

Filesize
3.3MB

Download
memory/2404-186-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-185-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-184-0x0000000076EF0000-0x000000007707E000-memory.dmp

Filesize
1.6MB

Download
memory/2404-204-0x0000000006380000-0x000000000659E000-memory.dmp

Filesize
2.1MB

Download
memory/2404-205-0x00000000065A0000-0x00000000065D4000-memory.dmp

Filesize
208KB

Download
memory/2404-208-0x0000000006800000-0x000000000680A000-memory.dmp

Filesize
40KB

Download
memory/2404-212-0x0000000006A10000-0x0000000006A28000-memory.dmp

Filesize
96KB

Download
memory/2404-215-0x00000000074E0000-0x00000000074FA000-memory.dmp

Filesize
104KB

Download
memory/2404-216-0x00000000089F0000-0x00000000089F6000-memory.dmp

Filesize
24KB

Download
memory/3680-218-0x000000000054C1BE-mapping.dmp

Download
memory/3680-250-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/3680-281-0x00000000060F0000-0x0000000006140000-memory.dmp

Filesize
320KB

Download
memory/3680-287-0x00000000061B0000-0x00000000062FA000-memory.dmp

Filesize
1.3MB

Download
memory/3680-288-0x0000000006300000-0x0000000006422000-memory.dmp

Filesize
1.1MB

Download
memory/3680-290-0x00000000060D0000-0x00000000060EA000-memory.dmp

Filesize
104KB

Download