eternity | 6f58b413b2d7d36f56b46f4fa119806b9f3f335c90bdb5fb2a7313bb15c61748

General

Target

0b2226a16d3c7e938cbe1e1c3133fddc.exe
Size

328KB
MD5

0b2226a16d3c7e938cbe1e1c3133fddc
SHA1

a0073232ca2d4495735ef74d899701ba8f7d139b
SHA256

6f58b413b2d7d36f56b46f4fa119806b9f3f335c90bdb5fb2a7313bb15c61748
SHA512

47f30dc7dee949fb63f3e6b378fd27d7eaf64e3702a310d5d04295e653447f56c4ace70b6dca4d275ea7cb1953aea6085956092ac5676bf12ac5e45386a6f1ef
SSDEEP

6144:xcOCqSMGopjWOcF6s6vgWEUMmyUKD5uYiTwQwcZyY2rw:xcO+SjoFmgWVyUKRgy9rw

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Executes dropped EXE 2 IoCs

Processes:

Microsoft.AAD.BrokerPlugin.exetmp1351.tmp.exe

pid process

1416 Microsoft.AAD.BrokerPlugin.exe
1152 tmp1351.tmp.exe
Loads dropped DLL 3 IoCs

Processes:

0b2226a16d3c7e938cbe1e1c3133fddc.exe

pid process

1704 0b2226a16d3c7e938cbe1e1c3133fddc.exe
1704 0b2226a16d3c7e938cbe1e1c3133fddc.exe
1704 0b2226a16d3c7e938cbe1e1c3133fddc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

tmp1351.tmp.exe

description pid process

Token: SeDebugPrivilege 1152 tmp1351.tmp.exe

pid	process
1416	Microsoft.AAD.BrokerPlugin.exe
1152	tmp1351.tmp.exe

pid	process
1704	0b2226a16d3c7e938cbe1e1c3133fddc.exe
1704	0b2226a16d3c7e938cbe1e1c3133fddc.exe
1704	0b2226a16d3c7e938cbe1e1c3133fddc.exe

description	pid	process
Token: SeDebugPrivilege	1152	tmp1351.tmp.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

0b2226a16d3c7e938cbe1e1c3133fddc.exe

description	pid	process	target process
PID 1704 wrote to memory of 1416	1704	0b2226a16d3c7e938cbe1e1c3133fddc.exe	Microsoft.AAD.BrokerPlugin.exe
PID 1704 wrote to memory of 1416	1704	0b2226a16d3c7e938cbe1e1c3133fddc.exe	Microsoft.AAD.BrokerPlugin.exe
PID 1704 wrote to memory of 1416	1704	0b2226a16d3c7e938cbe1e1c3133fddc.exe	Microsoft.AAD.BrokerPlugin.exe
PID 1704 wrote to memory of 1416	1704	0b2226a16d3c7e938cbe1e1c3133fddc.exe	Microsoft.AAD.BrokerPlugin.exe
PID 1704 wrote to memory of 1152	1704	0b2226a16d3c7e938cbe1e1c3133fddc.exe	tmp1351.tmp.exe
PID 1704 wrote to memory of 1152	1704	0b2226a16d3c7e938cbe1e1c3133fddc.exe	tmp1351.tmp.exe
PID 1704 wrote to memory of 1152	1704	0b2226a16d3c7e938cbe1e1c3133fddc.exe	tmp1351.tmp.exe
PID 1704 wrote to memory of 1152	1704	0b2226a16d3c7e938cbe1e1c3133fddc.exe	tmp1351.tmp.exe

C:\Users\Admin\AppData\Local\Temp\0b2226a16d3c7e938cbe1e1c3133fddc.exe
"C:\Users\Admin\AppData\Local\Temp\0b2226a16d3c7e938cbe1e1c3133fddc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe"
2⤵
- Executes dropped EXE
PID:1416

C:\Users\Admin\AppData\Local\Temp\tmp1351.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp1351.tmp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1152

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe
Filesize
232KB

MD5
c0f5ba80cf39ba6cd88707fbb81d7153

SHA1
4b3bd8624477dab4836806d21de5982421654bec

SHA256
f3bc209067ba31bac2084524af85e575439c265cb7a42ebc8ef28ccecb7ec85d

SHA512
e3c2cb1c031760d36ea491875e010fbd231f73c273214aa1b27ced0bc4a574df2517ce3fe178acbaca0458de73ba0b371e2174f6a1a854432d9ed79c89159102

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe
Filesize
232KB

MD5
c0f5ba80cf39ba6cd88707fbb81d7153

SHA1
4b3bd8624477dab4836806d21de5982421654bec

SHA256
f3bc209067ba31bac2084524af85e575439c265cb7a42ebc8ef28ccecb7ec85d

SHA512
e3c2cb1c031760d36ea491875e010fbd231f73c273214aa1b27ced0bc4a574df2517ce3fe178acbaca0458de73ba0b371e2174f6a1a854432d9ed79c89159102

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1351.tmp.exe
Filesize
76KB

MD5
dbb92d6b3c324f8871bc508830b05c14

SHA1
4507d24c7d78a24fe5d92f916ed972709529ced0

SHA256
376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

SHA512
d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1351.tmp.exe
Filesize
76KB

MD5
dbb92d6b3c324f8871bc508830b05c14

SHA1
4507d24c7d78a24fe5d92f916ed972709529ced0

SHA256
376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

SHA512
d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe
Filesize
232KB

MD5
c0f5ba80cf39ba6cd88707fbb81d7153

SHA1
4b3bd8624477dab4836806d21de5982421654bec

SHA256
f3bc209067ba31bac2084524af85e575439c265cb7a42ebc8ef28ccecb7ec85d

SHA512
e3c2cb1c031760d36ea491875e010fbd231f73c273214aa1b27ced0bc4a574df2517ce3fe178acbaca0458de73ba0b371e2174f6a1a854432d9ed79c89159102

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft.AAD.BrokerPlugin.exe
Filesize
232KB

MD5
c0f5ba80cf39ba6cd88707fbb81d7153

SHA1
4b3bd8624477dab4836806d21de5982421654bec

SHA256
f3bc209067ba31bac2084524af85e575439c265cb7a42ebc8ef28ccecb7ec85d

SHA512
e3c2cb1c031760d36ea491875e010fbd231f73c273214aa1b27ced0bc4a574df2517ce3fe178acbaca0458de73ba0b371e2174f6a1a854432d9ed79c89159102

Download Submit
\Users\Admin\AppData\Local\Temp\tmp1351.tmp.exe
Filesize
76KB

MD5
dbb92d6b3c324f8871bc508830b05c14

SHA1
4507d24c7d78a24fe5d92f916ed972709529ced0

SHA256
376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

SHA512
d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

Download Submit
memory/1152-71-0x0000000000CC0000-0x0000000000CDA000-memory.dmp

Filesize
104KB

Download
memory/1152-72-0x0000000004D30000-0x0000000004D70000-memory.dmp

Filesize
256KB

Download
memory/1152-73-0x0000000004D30000-0x0000000004D70000-memory.dmp

Filesize
256KB

Download
memory/1704-54-0x0000000000B90000-0x0000000000BE8000-memory.dmp

Filesize
352KB

Download
memory/1704-56-0x00000000047A0000-0x00000000047E0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing