eternity | 977dd61f0c716ec7af6dcd079c2db019e1c9eac76f96c09b10e6fbf972e4767e

General

Target

d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe
Size

451KB
MD5

02d145847cb4053180305a7ee1e3ece5
SHA1

75d954af6b2b5cbe0de7a98dff5cc5200cb02542
SHA256

d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6
SHA512

f88dd7a40534e1e9fc8f5f2fae1824af4caa6696b90739c080dba2a3293e5a4430aea27e2a2558f2fae4cb94168a50406f1bcb9bc00aab80fa2c4ff83d282897
SSDEEP

12288:sFavSOXNrtNxp/QTIboxj1JUWUncVlkOBapx39PoxfMDUUUUUmgUUUUUU9UUUUUv:dv79rbxpkI0iRK

Score

10^/10

eternity discovery

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Executes dropped EXE 2 IoCs

pid	Process
1788	TiFileFetcher.exe
560	tmp4E34.tmp.exe

Loads dropped DLL 3 IoCs

pid	Process
1064	d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe
1064	d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe
1064	d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	560	tmp4E34.tmp.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1788	1064	d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe	27
PID 1064 wrote to memory of 1788	1064	d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe	27
PID 1064 wrote to memory of 1788	1064	d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe	27
PID 1064 wrote to memory of 1788	1064	d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe	27
PID 1064 wrote to memory of 560	1064	d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe	28
PID 1064 wrote to memory of 560	1064	d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe	28
PID 1064 wrote to memory of 560	1064	d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe	28
PID 1064 wrote to memory of 560	1064	d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe	28

C:\Users\Admin\AppData\Local\Temp\d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe
"C:\Users\Admin\AppData\Local\Temp\d60fd14ef1d3fa017f3e69529498cfcec9da1a89e9b9529f00f297a2f02a6fa6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe
  "C:\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe"
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Users\Admin\AppData\Local\Temp\tmp4E34.tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp4E34.tmp.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Scanning

1

T1046

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe

Filesize
360KB

MD5
668865f47bccb1c03815bc1c4524fe26

SHA1
8eba5b11f776c00520d0500940c62946af39bee2

SHA256
8693cd5e21fa2b4445e637dbe68763a270401ef2c8ae863de8ccbae9ab8b7f1d

SHA512
75c5c5d1080d9374e3ac871631f4d4eab7324d052428d6883681c0f03b1926bd53e6933174aae0b5402905b732be57b0570a62ce157d3b4b9cc4dcd85553826e

Download Submit
C:\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe

Filesize
360KB

MD5
668865f47bccb1c03815bc1c4524fe26

SHA1
8eba5b11f776c00520d0500940c62946af39bee2

SHA256
8693cd5e21fa2b4445e637dbe68763a270401ef2c8ae863de8ccbae9ab8b7f1d

SHA512
75c5c5d1080d9374e3ac871631f4d4eab7324d052428d6883681c0f03b1926bd53e6933174aae0b5402905b732be57b0570a62ce157d3b4b9cc4dcd85553826e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4E34.tmp.exe

Filesize
76KB

MD5
dbb92d6b3c324f8871bc508830b05c14

SHA1
4507d24c7d78a24fe5d92f916ed972709529ced0

SHA256
376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

SHA512
d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp4E34.tmp.exe

Filesize
76KB

MD5
dbb92d6b3c324f8871bc508830b05c14

SHA1
4507d24c7d78a24fe5d92f916ed972709529ced0

SHA256
376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

SHA512
d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

Download Submit
\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe

Filesize
360KB

MD5
668865f47bccb1c03815bc1c4524fe26

SHA1
8eba5b11f776c00520d0500940c62946af39bee2

SHA256
8693cd5e21fa2b4445e637dbe68763a270401ef2c8ae863de8ccbae9ab8b7f1d

SHA512
75c5c5d1080d9374e3ac871631f4d4eab7324d052428d6883681c0f03b1926bd53e6933174aae0b5402905b732be57b0570a62ce157d3b4b9cc4dcd85553826e

Download Submit
\Users\Admin\AppData\Local\Temp\TiFileFetcher.exe

Filesize
360KB

MD5
668865f47bccb1c03815bc1c4524fe26

SHA1
8eba5b11f776c00520d0500940c62946af39bee2

SHA256
8693cd5e21fa2b4445e637dbe68763a270401ef2c8ae863de8ccbae9ab8b7f1d

SHA512
75c5c5d1080d9374e3ac871631f4d4eab7324d052428d6883681c0f03b1926bd53e6933174aae0b5402905b732be57b0570a62ce157d3b4b9cc4dcd85553826e

Download Submit
\Users\Admin\AppData\Local\Temp\tmp4E34.tmp.exe

Filesize
76KB

MD5
dbb92d6b3c324f8871bc508830b05c14

SHA1
4507d24c7d78a24fe5d92f916ed972709529ced0

SHA256
376294f1dd51cbb9591672655bb2720aeda8dd8004fcc0cb7c333b54ca5746f8

SHA512
d089dc29a1e982b7dd7e50698acdaf138455fb8b3e02b0874bec6734f261bf1a8ea5f10bcc43bb3c557812aeeeeb0410db157bfe341ee67516d6b8c3b758002a

Download Submit
memory/560-72-0x00000000000A0000-0x00000000000BA000-memory.dmp

Filesize
104KB

Download
memory/560-73-0x0000000004320000-0x0000000004360000-memory.dmp

Filesize
256KB

Download
memory/560-74-0x0000000004320000-0x0000000004360000-memory.dmp

Filesize
256KB

Download
memory/1064-54-0x0000000000930000-0x00000000009A6000-memory.dmp

Filesize
472KB

Download
memory/1064-56-0x0000000004A40000-0x0000000004A80000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing