eternity | 98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502

General

Target

98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe
Size

279KB
MD5

0de1d0372e15bbfeded7fb418e8c00ae
SHA1

6d0dc8617e5bcdd48dd5b45d8f40b97e4bbce0a1
SHA256

98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502
SHA512

7b3f2d2cc3fce6707be938053fd94a8a5edb48f7dad787847bd362329b6f07657fd7f66ab1f5c5d78db12aa7a41717ea3c7cbe8a1706d2456d1c42e9b1fb4e67
SSDEEP

3072:BbnPeif6LMYrrDGCR0GVnNItCLklvpdq/spPoztzNQ9TWcjOjjFK1CXrhyp+u00:BTFSLtrkuAb2tfVjjFYCFyIcAOen

Score

10^/10

eternity

Malware Config

Extracted

Family

eternity

Wallets

47vk9PbPuHnEnazCn4tLpwPCWRLSMhpX9PD8WqpjchhTXisimD6j8EvRFDbPQHKUmHVq3vAM3DLytXLg8CqcdRXRFdPe92Q

Attributes

payload_urls
https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Executes dropped EXE 6 IoCs

pid	Process
4660	AppLaunch.exe
1556	AppLaunch.exe
4708	AppLaunch.exe
3320	AppLaunch.exe
4220	AppLaunch.exe
4420	AppLaunch.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4404 set thread context of 4560	4404	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	73

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4004	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1936	PING.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 4560	4404	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	73
PID 4404 wrote to memory of 4560	4404	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	73
PID 4404 wrote to memory of 4560	4404	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	73
PID 4404 wrote to memory of 4560	4404	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	73
PID 4404 wrote to memory of 4560	4404	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	73
PID 4404 wrote to memory of 4560	4404	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	73
PID 4404 wrote to memory of 4560	4404	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	73
PID 4404 wrote to memory of 4560	4404	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	73
PID 4560 wrote to memory of 3604	4560	AppLaunch.exe	75
PID 4560 wrote to memory of 3604	4560	AppLaunch.exe	75
PID 4560 wrote to memory of 3604	4560	AppLaunch.exe	75
PID 3604 wrote to memory of 4532	3604	cmd.exe	76
PID 3604 wrote to memory of 4532	3604	cmd.exe	76
PID 3604 wrote to memory of 4532	3604	cmd.exe	76
PID 3604 wrote to memory of 1936	3604	cmd.exe	77
PID 3604 wrote to memory of 1936	3604	cmd.exe	77
PID 3604 wrote to memory of 1936	3604	cmd.exe	77
PID 3604 wrote to memory of 4004	3604	cmd.exe	78
PID 3604 wrote to memory of 4004	3604	cmd.exe	78
PID 3604 wrote to memory of 4004	3604	cmd.exe	78
PID 3604 wrote to memory of 4660	3604	cmd.exe	79
PID 3604 wrote to memory of 4660	3604	cmd.exe	79
PID 3604 wrote to memory of 4660	3604	cmd.exe	79

C:\Users\Admin\AppData\Local\Temp\98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe
"C:\Users\Admin\AppData\Local\Temp\98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "AppLaunch" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3604
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:4532
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1936
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "AppLaunch" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:4004
  - - C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
      "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe"
      4⤵
      Executes dropped EXE
      PID:4660

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
1⤵
- Executes dropped EXE
PID:1556

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
1⤵
- Executes dropped EXE
PID:4708

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
1⤵
- Executes dropped EXE
PID:3320

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
1⤵
- Executes dropped EXE
PID:4220

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
1⤵
- Executes dropped EXE
PID:4420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe

Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe

Filesize
26KB

MD5
fb6a9c4db71a342ee61d82d981be451c

SHA1
5b213c294576aed65454b08fa68c6ac095179364

SHA256
d5f5feb12e171c4405b5edae0e9e7ef695e2c23e73bb44a2f1d92deb7499eef6

SHA512
881ce165cb0321907d6bcdb3a0a016ccb69a7a65b7ac9abf260ef5626f821bf439d498f4557a5a314994ae0b91c094c0336cac7ec05031fbb1f85c86ac60a665

Download Submit
memory/4560-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4560-3-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/4560-4-0x0000000009840000-0x0000000009D3E000-memory.dmp

Filesize
5.0MB

Download
memory/4560-13-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads