eternity | 98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502

Analysis

max time kernel
243s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10-12-2023 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe
Size

279KB
MD5

0de1d0372e15bbfeded7fb418e8c00ae
SHA1

6d0dc8617e5bcdd48dd5b45d8f40b97e4bbce0a1
SHA256

98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502
SHA512

7b3f2d2cc3fce6707be938053fd94a8a5edb48f7dad787847bd362329b6f07657fd7f66ab1f5c5d78db12aa7a41717ea3c7cbe8a1706d2456d1c42e9b1fb4e67
SSDEEP

3072:BbnPeif6LMYrrDGCR0GVnNItCLklvpdq/spPoztzNQ9TWcjOjjFK1CXrhyp+u00:BTFSLtrkuAb2tfVjjFYCFyIcAOen

Score

10^/10

eternity

Malware Config

Extracted

Family

eternity

Wallets

47vk9PbPuHnEnazCn4tLpwPCWRLSMhpX9PD8WqpjchhTXisimD6j8EvRFDbPQHKUmHVq3vAM3DLytXLg8CqcdRXRFdPe92Q

Attributes

payload_urls
https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Executes dropped EXE 6 IoCs

pid	Process
2644	AppLaunch.exe
2564	AppLaunch.exe
852	AppLaunch.exe
1792	AppLaunch.exe
884	AppLaunch.exe
1748	AppLaunch.exe

Loads dropped DLL 1 IoCs

pid	Process
2944	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2524 set thread context of 2628	2524	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	20

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2568	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3056	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2628	2524	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	20
PID 2524 wrote to memory of 2628	2524	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	20
PID 2524 wrote to memory of 2628	2524	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	20
PID 2524 wrote to memory of 2628	2524	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	20
PID 2524 wrote to memory of 2628	2524	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	20
PID 2524 wrote to memory of 2628	2524	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	20
PID 2524 wrote to memory of 2628	2524	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	20
PID 2524 wrote to memory of 2628	2524	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	20
PID 2524 wrote to memory of 2628	2524	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	20
PID 2524 wrote to memory of 2628	2524	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	20
PID 2524 wrote to memory of 2628	2524	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	20
PID 2524 wrote to memory of 2628	2524	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	20
PID 2628 wrote to memory of 2944	2628	AppLaunch.exe	30
PID 2628 wrote to memory of 2944	2628	AppLaunch.exe	30
PID 2628 wrote to memory of 2944	2628	AppLaunch.exe	30
PID 2628 wrote to memory of 2944	2628	AppLaunch.exe	30
PID 2628 wrote to memory of 2944	2628	AppLaunch.exe	30
PID 2628 wrote to memory of 2944	2628	AppLaunch.exe	30
PID 2628 wrote to memory of 2944	2628	AppLaunch.exe	30
PID 2944 wrote to memory of 3012	2944	cmd.exe	31
PID 2944 wrote to memory of 3012	2944	cmd.exe	31
PID 2944 wrote to memory of 3012	2944	cmd.exe	31
PID 2944 wrote to memory of 3012	2944	cmd.exe	31
PID 2944 wrote to memory of 3012	2944	cmd.exe	31
PID 2944 wrote to memory of 3012	2944	cmd.exe	31
PID 2944 wrote to memory of 3012	2944	cmd.exe	31
PID 2944 wrote to memory of 3056	2944	cmd.exe	32
PID 2944 wrote to memory of 3056	2944	cmd.exe	32
PID 2944 wrote to memory of 3056	2944	cmd.exe	32
PID 2944 wrote to memory of 3056	2944	cmd.exe	32
PID 2944 wrote to memory of 3056	2944	cmd.exe	32
PID 2944 wrote to memory of 3056	2944	cmd.exe	32
PID 2944 wrote to memory of 3056	2944	cmd.exe	32
PID 2944 wrote to memory of 2568	2944	cmd.exe	33
PID 2944 wrote to memory of 2568	2944	cmd.exe	33
PID 2944 wrote to memory of 2568	2944	cmd.exe	33
PID 2944 wrote to memory of 2568	2944	cmd.exe	33
PID 2944 wrote to memory of 2568	2944	cmd.exe	33
PID 2944 wrote to memory of 2568	2944	cmd.exe	33
PID 2944 wrote to memory of 2568	2944	cmd.exe	33
PID 2944 wrote to memory of 2644	2944	cmd.exe	34
PID 2944 wrote to memory of 2644	2944	cmd.exe	34
PID 2944 wrote to memory of 2644	2944	cmd.exe	34
PID 2944 wrote to memory of 2644	2944	cmd.exe	34
PID 2944 wrote to memory of 2644	2944	cmd.exe	34
PID 2944 wrote to memory of 2644	2944	cmd.exe	34
PID 2944 wrote to memory of 2644	2944	cmd.exe	34
PID 2688 wrote to memory of 2564	2688	taskeng.exe	36
PID 2688 wrote to memory of 2564	2688	taskeng.exe	36
PID 2688 wrote to memory of 2564	2688	taskeng.exe	36
PID 2688 wrote to memory of 2564	2688	taskeng.exe	36
PID 2688 wrote to memory of 2564	2688	taskeng.exe	36
PID 2688 wrote to memory of 2564	2688	taskeng.exe	36
PID 2688 wrote to memory of 2564	2688	taskeng.exe	36
PID 2688 wrote to memory of 852	2688	taskeng.exe	39
PID 2688 wrote to memory of 852	2688	taskeng.exe	39
PID 2688 wrote to memory of 852	2688	taskeng.exe	39
PID 2688 wrote to memory of 852	2688	taskeng.exe	39
PID 2688 wrote to memory of 852	2688	taskeng.exe	39
PID 2688 wrote to memory of 852	2688	taskeng.exe	39
PID 2688 wrote to memory of 852	2688	taskeng.exe	39
PID 2688 wrote to memory of 1792	2688	taskeng.exe	40
PID 2688 wrote to memory of 1792	2688	taskeng.exe	40
PID 2688 wrote to memory of 1792	2688	taskeng.exe	40

C:\Users\Admin\AppData\Local\Temp\98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe
"C:\Users\Admin\AppData\Local\Temp\98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "AppLaunch" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:3012
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3056
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "AppLaunch" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:2568
  - - C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
      "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe"
      4⤵
      Executes dropped EXE
      PID:2644

C:\Windows\system32\taskeng.exe
taskeng.exe {62926DAA-01DC-4A59-9C2A-1D87233AFF6A} S-1-5-21-3470981204-343661084-3367201002-1000:GLTGRJAG\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  2⤵
  - Executes dropped EXE
  PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe

Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe

Filesize
20KB

MD5
cf0af6776f005fefc03543b45c20d2cf

SHA1
4d4d5bfe429e1a0bda676e8759f63e367e86244b

SHA256
53da032626885b565cda43ad77a7b6e4e442b17dc52a21e9e6dc6db2c8da6d43

SHA512
917732af096a431fca502816bc747a8a13c9f033b72f0cc4e340b1c119e48a64b53c2c04afac09db4190382561b97a07817136ffb72473a5bc95f3e993e8eb50

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe

Filesize
33KB

MD5
d9f95836e6c6485898f5f223dba82fb0

SHA1
7b5a7fbe835b17389dd3f5399b30434b12891bbf

SHA256
1e39af1f1b7af0eb42925a270fef6b7ebea89302b55c04155ce0ac5435b82c02

SHA512
c84ac62987649ed6f6ecec30f57aa73367a472be649ecb3333b91204e09cab423eae5e1818cab8c4ec7233d50054d19da7214a69c75180ca0530fa54bacbc1fe

Download Submit
memory/2628-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2628-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2628-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2628-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2628-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2628-10-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/2628-13-0x0000000074A10000-0x00000000750FE000-memory.dmp

Filesize
6.9MB

Download
memory/2628-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2628-5-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2628-9-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads