eternity | 4aef1bb0ec145faaa33f717c50a412fe8af594f0bf1c203750b850535ae4dd11

General

Target

09f063a7da6000faca88ed9b7299ee79.exe
Size

455KB
MD5

09f063a7da6000faca88ed9b7299ee79
SHA1

31dc81a128400ee37e82fe9cef6831a6cc1f9109
SHA256

4aef1bb0ec145faaa33f717c50a412fe8af594f0bf1c203750b850535ae4dd11
SHA512

14b78151fbbf21f40d9e7b9a23c678d7b9482f002d04851d2efdc7a9a44858594c70376f68ba6744271a05e3c7402109c1b3a2c40dbd1711733de40dc9fba148
SSDEEP

12288:8dtTYK3JyOf55vMtQEVp88TNmTAWQ3rG/VtQ0:ITYKzf8tZnTNUAd+/Q0

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Executes dropped EXE 2 IoCs

Processes:

TiFileFetcher.exetmp4F25.tmp.exe

pid process

808 TiFileFetcher.exe
588 tmp4F25.tmp.exe
Loads dropped DLL 3 IoCs

Processes:

09f063a7da6000faca88ed9b7299ee79.exe

pid process

1304 09f063a7da6000faca88ed9b7299ee79.exe
1304 09f063a7da6000faca88ed9b7299ee79.exe
1304 09f063a7da6000faca88ed9b7299ee79.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tmp4F25.tmp.exe

description pid process

Token: SeDebugPrivilege 588 tmp4F25.tmp.exe

pid	process
808	TiFileFetcher.exe
588	tmp4F25.tmp.exe

pid	process
1304	09f063a7da6000faca88ed9b7299ee79.exe
1304	09f063a7da6000faca88ed9b7299ee79.exe
1304	09f063a7da6000faca88ed9b7299ee79.exe

description	pid	process
Token: SeDebugPrivilege	588	tmp4F25.tmp.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

09f063a7da6000faca88ed9b7299ee79.exe

description	pid	process	target process
PID 1304 wrote to memory of 808	1304	09f063a7da6000faca88ed9b7299ee79.exe	TiFileFetcher.exe
PID 1304 wrote to memory of 808	1304	09f063a7da6000faca88ed9b7299ee79.exe	TiFileFetcher.exe
PID 1304 wrote to memory of 808	1304	09f063a7da6000faca88ed9b7299ee79.exe	TiFileFetcher.exe
PID 1304 wrote to memory of 808	1304	09f063a7da6000faca88ed9b7299ee79.exe	TiFileFetcher.exe
PID 1304 wrote to memory of 588	1304	09f063a7da6000faca88ed9b7299ee79.exe	tmp4F25.tmp.exe
PID 1304 wrote to memory of 588	1304	09f063a7da6000faca88ed9b7299ee79.exe	tmp4F25.tmp.exe
PID 1304 wrote to memory of 588	1304	09f063a7da6000faca88ed9b7299ee79.exe	tmp4F25.tmp.exe
PID 1304 wrote to memory of 588	1304	09f063a7da6000faca88ed9b7299ee79.exe	tmp4F25.tmp.exe

C:\Users\Admin\AppData\Local\Temp\09f063a7da6000faca88ed9b7299ee79.exe
"C:\Users\Admin\AppData\Local\Temp\09f063a7da6000faca88ed9b7299ee79.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304

C:\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe
"C:\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe"
2⤵
- Executes dropped EXE
PID:808

C:\Users\Admin\AppData\Local\Temp\tmp4F25.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp4F25.tmp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe
Filesize
360KB

MD5
668865f47bccb1c03815bc1c4524fe26

SHA1
8eba5b11f776c00520d0500940c62946af39bee2

SHA256
8693cd5e21fa2b4445e637dbe68763a270401ef2c8ae863de8ccbae9ab8b7f1d

SHA512
75c5c5d1080d9374e3ac871631f4d4eab7324d052428d6883681c0f03b1926bd53e6933174aae0b5402905b732be57b0570a62ce157d3b4b9cc4dcd85553826e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe
Filesize
360KB

MD5
668865f47bccb1c03815bc1c4524fe26

SHA1
8eba5b11f776c00520d0500940c62946af39bee2

SHA256
8693cd5e21fa2b4445e637dbe68763a270401ef2c8ae863de8ccbae9ab8b7f1d

SHA512
75c5c5d1080d9374e3ac871631f4d4eab7324d052428d6883681c0f03b1926bd53e6933174aae0b5402905b732be57b0570a62ce157d3b4b9cc4dcd85553826e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4F25.tmp.exe
Filesize
76KB

MD5
dbb92d6b3c324f8871bc508830b05c14

SHA1
4507d24c7d78a24fe5d92f916ed972709529ced0

SHA256
376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

SHA512
d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4F25.tmp.exe
Filesize
76KB

MD5
dbb92d6b3c324f8871bc508830b05c14

SHA1
4507d24c7d78a24fe5d92f916ed972709529ced0

SHA256
376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

SHA512
d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

Download Submit
\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe
Filesize
360KB

MD5
668865f47bccb1c03815bc1c4524fe26

SHA1
8eba5b11f776c00520d0500940c62946af39bee2

SHA256
8693cd5e21fa2b4445e637dbe68763a270401ef2c8ae863de8ccbae9ab8b7f1d

SHA512
75c5c5d1080d9374e3ac871631f4d4eab7324d052428d6883681c0f03b1926bd53e6933174aae0b5402905b732be57b0570a62ce157d3b4b9cc4dcd85553826e

Download Submit
\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe
Filesize
360KB

MD5
668865f47bccb1c03815bc1c4524fe26

SHA1
8eba5b11f776c00520d0500940c62946af39bee2

SHA256
8693cd5e21fa2b4445e637dbe68763a270401ef2c8ae863de8ccbae9ab8b7f1d

SHA512
75c5c5d1080d9374e3ac871631f4d4eab7324d052428d6883681c0f03b1926bd53e6933174aae0b5402905b732be57b0570a62ce157d3b4b9cc4dcd85553826e

Download Submit
\Users\Admin\AppData\Local\Temp\tmp4F25.tmp.exe
Filesize
76KB

MD5
dbb92d6b3c324f8871bc508830b05c14

SHA1
4507d24c7d78a24fe5d92f916ed972709529ced0

SHA256
376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

SHA512
d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

Download Submit
memory/588-72-0x00000000002A0000-0x00000000002BA000-memory.dmp

Filesize
104KB

Download
memory/588-73-0x0000000004B30000-0x0000000004B70000-memory.dmp

Filesize
256KB

Download
memory/588-74-0x0000000004B30000-0x0000000004B70000-memory.dmp

Filesize
256KB

Download
memory/1304-54-0x0000000000910000-0x0000000000986000-memory.dmp

Filesize
472KB

Download
memory/1304-56-0x00000000049B0000-0x00000000049F0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing