eternity | 49baccb39da78001cb693dc0c9a8d88aa7f5e03f201bef690f8be3177b0e3238

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2023, 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ceba6add1d1561f25fb3755098b4340e218ec091a3be5b2d60ab76ebb33672c.exe
Size

455KB
MD5

018d19a12466283c16f7aaea7b2b7812
SHA1

b38b014298d82317fe5fa9ebfde8fc104d37f314
SHA256

2ceba6add1d1561f25fb3755098b4340e218ec091a3be5b2d60ab76ebb33672c
SHA512

93906134a3705340fee3702a21e93ff3d86d0bdec5c408ffbbd836c7a939cddb6a9e570779f92c4b890d91f884d6f0c63c3453a2545eb20ecfaea3b90e744473
SSDEEP

12288:643VLt7DJqNbDtgKcPzqIQNVVtgyqk2deoP14Do:6qVZ3WbDtiedgyqk2dj9L

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	2ceba6add1d1561f25fb3755098b4340e218ec091a3be5b2d60ab76ebb33672c.exe

Executes dropped EXE 2 IoCs

pid	Process
3924	TiFileFetcher.exe
1560	tmp4FE9.tmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1560	tmp4FE9.tmp.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 3924	4988	2ceba6add1d1561f25fb3755098b4340e218ec091a3be5b2d60ab76ebb33672c.exe	86
PID 4988 wrote to memory of 3924	4988	2ceba6add1d1561f25fb3755098b4340e218ec091a3be5b2d60ab76ebb33672c.exe	86
PID 4988 wrote to memory of 3924	4988	2ceba6add1d1561f25fb3755098b4340e218ec091a3be5b2d60ab76ebb33672c.exe	86
PID 4988 wrote to memory of 1560	4988	2ceba6add1d1561f25fb3755098b4340e218ec091a3be5b2d60ab76ebb33672c.exe	87
PID 4988 wrote to memory of 1560	4988	2ceba6add1d1561f25fb3755098b4340e218ec091a3be5b2d60ab76ebb33672c.exe	87
PID 4988 wrote to memory of 1560	4988	2ceba6add1d1561f25fb3755098b4340e218ec091a3be5b2d60ab76ebb33672c.exe	87

C:\Users\Admin\AppData\Local\Temp\2ceba6add1d1561f25fb3755098b4340e218ec091a3be5b2d60ab76ebb33672c.exe
"C:\Users\Admin\AppData\Local\Temp\2ceba6add1d1561f25fb3755098b4340e218ec091a3be5b2d60ab76ebb33672c.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe
  "C:\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe"
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Users\Admin\AppData\Local\Temp\tmp4FE9.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4FE9.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe

Filesize
360KB

MD5
668865f47bccb1c03815bc1c4524fe26

SHA1
8eba5b11f776c00520d0500940c62946af39bee2

SHA256
8693cd5e21fa2b4445e637dbe68763a270401ef2c8ae863de8ccbae9ab8b7f1d

SHA512
75c5c5d1080d9374e3ac871631f4d4eab7324d052428d6883681c0f03b1926bd53e6933174aae0b5402905b732be57b0570a62ce157d3b4b9cc4dcd85553826e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe

Filesize
360KB

MD5
668865f47bccb1c03815bc1c4524fe26

SHA1
8eba5b11f776c00520d0500940c62946af39bee2

SHA256
8693cd5e21fa2b4445e637dbe68763a270401ef2c8ae863de8ccbae9ab8b7f1d

SHA512
75c5c5d1080d9374e3ac871631f4d4eab7324d052428d6883681c0f03b1926bd53e6933174aae0b5402905b732be57b0570a62ce157d3b4b9cc4dcd85553826e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4FE9.tmp.exe

Filesize
76KB

MD5
dbb92d6b3c324f8871bc508830b05c14

SHA1
4507d24c7d78a24fe5d92f916ed972709529ced0

SHA256
376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

SHA512
d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4FE9.tmp.exe

Filesize
76KB

MD5
dbb92d6b3c324f8871bc508830b05c14

SHA1
4507d24c7d78a24fe5d92f916ed972709529ced0

SHA256
376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

SHA512
d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4FE9.tmp.exe

Filesize
76KB

MD5
dbb92d6b3c324f8871bc508830b05c14

SHA1
4507d24c7d78a24fe5d92f916ed972709529ced0

SHA256
376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

SHA512
d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

Download Submit
memory/1560-159-0x00000000002E0000-0x00000000002FA000-memory.dmp

Filesize
104KB

Download
memory/1560-160-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/1560-161-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/4988-133-0x00000000009F0000-0x0000000000A66000-memory.dmp

Filesize
472KB

Download
memory/4988-135-0x0000000005410000-0x0000000005420000-memory.dmp

Filesize
64KB

Download