eternity | 5f593ccd7571dd76fa782e24e2466b4c0a46a3d537c4092080d8c4722e89b5e9

Analysis

max time kernel
110s
max time network
124s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
Size

14KB
MD5

f0b3cfdcf9b45fad9316a91ad770e3e1
SHA1

a2e9b01faee6a37ef3a51bbb02f6c5bac4c473a2
SHA256

5f593ccd7571dd76fa782e24e2466b4c0a46a3d537c4092080d8c4722e89b5e9
SHA512

6965d6a85c89a38af082674891e0945b1cffd9cd3b6b402fdcbd93a8e027936f98db37d093dc3694b2c73167e3d54cd79ccc37caea90f4ca1bb664857006811a
SSDEEP

384:wIpm2b9AbbFgUKBdqy32ZM+dfOEambfsyy0wrm9EvLtk5tx+C:732O+fOMb6pcEvLWZ

Score

10^/10

eternity

Malware Config

Extracted

Family

eternity

http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion

Attributes

payload_urls
http://rlcjba7wduej3xcstcjo577eqgjsjvcjfsw4i23fqvf2y27ylylhmhad.onion.pet/shared/xmrig.exe

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Executes dropped EXE 3 IoCs

Processes:

SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exeSecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exeSecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe

pid	process
1500	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
1636	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
1004	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

748 cmd.exe
Loads dropped DLL 6 IoCs

Processes:

cmd.exeWerFault.exe

pid process

748 cmd.exe
1308 WerFault.exe
1308 WerFault.exe
1308 WerFault.exe
1308 WerFault.exe
1308 WerFault.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1308 1500 WerFault.exe SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1612 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1616 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe

description pid process

Token: SeDebugPrivilege 1500 SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe

pid	process
748	cmd.exe

pid	process
748	cmd.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe
1308	WerFault.exe

pid	pid_target	process	target process
1308	1500	WerFault.exe	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe

pid	process
1612	schtasks.exe

pid	process
1616	PING.EXE

description	pid	process
Token: SeDebugPrivilege	1500	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.execmd.exetaskeng.exeSecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe

description	pid	process	target process
PID 836 wrote to memory of 748	836	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe	cmd.exe
PID 836 wrote to memory of 748	836	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe	cmd.exe
PID 836 wrote to memory of 748	836	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe	cmd.exe
PID 836 wrote to memory of 748	836	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe	cmd.exe
PID 748 wrote to memory of 1684	748	cmd.exe	chcp.com
PID 748 wrote to memory of 1684	748	cmd.exe	chcp.com
PID 748 wrote to memory of 1684	748	cmd.exe	chcp.com
PID 748 wrote to memory of 1684	748	cmd.exe	chcp.com
PID 748 wrote to memory of 1616	748	cmd.exe	PING.EXE
PID 748 wrote to memory of 1616	748	cmd.exe	PING.EXE
PID 748 wrote to memory of 1616	748	cmd.exe	PING.EXE
PID 748 wrote to memory of 1616	748	cmd.exe	PING.EXE
PID 748 wrote to memory of 1612	748	cmd.exe	schtasks.exe
PID 748 wrote to memory of 1612	748	cmd.exe	schtasks.exe
PID 748 wrote to memory of 1612	748	cmd.exe	schtasks.exe
PID 748 wrote to memory of 1612	748	cmd.exe	schtasks.exe
PID 748 wrote to memory of 1500	748	cmd.exe	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
PID 748 wrote to memory of 1500	748	cmd.exe	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
PID 748 wrote to memory of 1500	748	cmd.exe	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
PID 748 wrote to memory of 1500	748	cmd.exe	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
PID 680 wrote to memory of 1636	680	taskeng.exe	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
PID 680 wrote to memory of 1636	680	taskeng.exe	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
PID 680 wrote to memory of 1636	680	taskeng.exe	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
PID 680 wrote to memory of 1636	680	taskeng.exe	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
PID 1500 wrote to memory of 1308	1500	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe	WerFault.exe
PID 1500 wrote to memory of 1308	1500	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe	WerFault.exe
PID 1500 wrote to memory of 1308	1500	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe	WerFault.exe
PID 1500 wrote to memory of 1308	1500	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe	WerFault.exe
PID 680 wrote to memory of 1004	680	taskeng.exe	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
PID 680 wrote to memory of 1004	680	taskeng.exe	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
PID 680 wrote to memory of 1004	680	taskeng.exe	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
PID 680 wrote to memory of 1004	680	taskeng.exe	SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe"
2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\SysWOW64\chcp.com
chcp 65001
3⤵
PID:1684

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
3⤵
- Runs ping.exe
PID:1616

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe" /rl HIGHEST /f
3⤵
- Creates scheduled task(s)
PID:1612

C:\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
"C:\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 1396
4⤵
- Loads dropped DLL
- Program crash
PID:1308

C:\Windows\system32\taskeng.exe
taskeng.exe {D7AEA8CE-23B1-4DB6-8237-348A5C995207} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:680

C:\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
C:\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
2⤵
- Executes dropped EXE
PID:1636

C:\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
C:\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
2⤵
- Executes dropped EXE
PID:1004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
Filesize
14KB

MD5
f0b3cfdcf9b45fad9316a91ad770e3e1

SHA1
a2e9b01faee6a37ef3a51bbb02f6c5bac4c473a2

SHA256
5f593ccd7571dd76fa782e24e2466b4c0a46a3d537c4092080d8c4722e89b5e9

SHA512
6965d6a85c89a38af082674891e0945b1cffd9cd3b6b402fdcbd93a8e027936f98db37d093dc3694b2c73167e3d54cd79ccc37caea90f4ca1bb664857006811a

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
Filesize
14KB

MD5
f0b3cfdcf9b45fad9316a91ad770e3e1

SHA1
a2e9b01faee6a37ef3a51bbb02f6c5bac4c473a2

SHA256
5f593ccd7571dd76fa782e24e2466b4c0a46a3d537c4092080d8c4722e89b5e9

SHA512
6965d6a85c89a38af082674891e0945b1cffd9cd3b6b402fdcbd93a8e027936f98db37d093dc3694b2c73167e3d54cd79ccc37caea90f4ca1bb664857006811a

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
Filesize
14KB

MD5
f0b3cfdcf9b45fad9316a91ad770e3e1

SHA1
a2e9b01faee6a37ef3a51bbb02f6c5bac4c473a2

SHA256
5f593ccd7571dd76fa782e24e2466b4c0a46a3d537c4092080d8c4722e89b5e9

SHA512
6965d6a85c89a38af082674891e0945b1cffd9cd3b6b402fdcbd93a8e027936f98db37d093dc3694b2c73167e3d54cd79ccc37caea90f4ca1bb664857006811a

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
Filesize
14KB

MD5
f0b3cfdcf9b45fad9316a91ad770e3e1

SHA1
a2e9b01faee6a37ef3a51bbb02f6c5bac4c473a2

SHA256
5f593ccd7571dd76fa782e24e2466b4c0a46a3d537c4092080d8c4722e89b5e9

SHA512
6965d6a85c89a38af082674891e0945b1cffd9cd3b6b402fdcbd93a8e027936f98db37d093dc3694b2c73167e3d54cd79ccc37caea90f4ca1bb664857006811a

Download Submit
\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
Filesize
14KB

MD5
f0b3cfdcf9b45fad9316a91ad770e3e1

SHA1
a2e9b01faee6a37ef3a51bbb02f6c5bac4c473a2

SHA256
5f593ccd7571dd76fa782e24e2466b4c0a46a3d537c4092080d8c4722e89b5e9

SHA512
6965d6a85c89a38af082674891e0945b1cffd9cd3b6b402fdcbd93a8e027936f98db37d093dc3694b2c73167e3d54cd79ccc37caea90f4ca1bb664857006811a

Download Submit
\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
Filesize
14KB

MD5
f0b3cfdcf9b45fad9316a91ad770e3e1

SHA1
a2e9b01faee6a37ef3a51bbb02f6c5bac4c473a2

SHA256
5f593ccd7571dd76fa782e24e2466b4c0a46a3d537c4092080d8c4722e89b5e9

SHA512
6965d6a85c89a38af082674891e0945b1cffd9cd3b6b402fdcbd93a8e027936f98db37d093dc3694b2c73167e3d54cd79ccc37caea90f4ca1bb664857006811a

Download Submit
\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
Filesize
14KB

MD5
f0b3cfdcf9b45fad9316a91ad770e3e1

SHA1
a2e9b01faee6a37ef3a51bbb02f6c5bac4c473a2

SHA256
5f593ccd7571dd76fa782e24e2466b4c0a46a3d537c4092080d8c4722e89b5e9

SHA512
6965d6a85c89a38af082674891e0945b1cffd9cd3b6b402fdcbd93a8e027936f98db37d093dc3694b2c73167e3d54cd79ccc37caea90f4ca1bb664857006811a

Download Submit
\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
Filesize
14KB

MD5
f0b3cfdcf9b45fad9316a91ad770e3e1

SHA1
a2e9b01faee6a37ef3a51bbb02f6c5bac4c473a2

SHA256
5f593ccd7571dd76fa782e24e2466b4c0a46a3d537c4092080d8c4722e89b5e9

SHA512
6965d6a85c89a38af082674891e0945b1cffd9cd3b6b402fdcbd93a8e027936f98db37d093dc3694b2c73167e3d54cd79ccc37caea90f4ca1bb664857006811a

Download Submit
\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
Filesize
14KB

MD5
f0b3cfdcf9b45fad9316a91ad770e3e1

SHA1
a2e9b01faee6a37ef3a51bbb02f6c5bac4c473a2

SHA256
5f593ccd7571dd76fa782e24e2466b4c0a46a3d537c4092080d8c4722e89b5e9

SHA512
6965d6a85c89a38af082674891e0945b1cffd9cd3b6b402fdcbd93a8e027936f98db37d093dc3694b2c73167e3d54cd79ccc37caea90f4ca1bb664857006811a

Download Submit
\Users\Admin\AppData\Local\ServiceHub\SecuriteInfo.com.Trojan.Siggen19.4846.9932.10970.exe
Filesize
14KB

MD5
f0b3cfdcf9b45fad9316a91ad770e3e1

SHA1
a2e9b01faee6a37ef3a51bbb02f6c5bac4c473a2

SHA256
5f593ccd7571dd76fa782e24e2466b4c0a46a3d537c4092080d8c4722e89b5e9

SHA512
6965d6a85c89a38af082674891e0945b1cffd9cd3b6b402fdcbd93a8e027936f98db37d093dc3694b2c73167e3d54cd79ccc37caea90f4ca1bb664857006811a

Download Submit
memory/748-56-0x0000000000000000-mapping.dmp

Download
memory/836-54-0x0000000001300000-0x000000000130A000-memory.dmp

Filesize
40KB

Download
memory/836-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1004-74-0x0000000000000000-mapping.dmp

Download
memory/1308-68-0x0000000000000000-mapping.dmp

Download
memory/1500-64-0x0000000000950000-0x000000000095A000-memory.dmp

Filesize
40KB

Download
memory/1500-62-0x0000000000000000-mapping.dmp

Download
memory/1612-59-0x0000000000000000-mapping.dmp

Download
memory/1616-58-0x0000000000000000-mapping.dmp

Download
memory/1636-66-0x0000000000000000-mapping.dmp

Download
memory/1684-57-0x0000000000000000-mapping.dmp

Download