eternity | 98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502

Analysis

max time kernel
267s
max time network
119s
platform
windows7_x64
resource
win7-20231130-en
resource tags

arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system
submitted
11-12-2023 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe
Size

279KB
MD5

0de1d0372e15bbfeded7fb418e8c00ae
SHA1

6d0dc8617e5bcdd48dd5b45d8f40b97e4bbce0a1
SHA256

98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502
SHA512

7b3f2d2cc3fce6707be938053fd94a8a5edb48f7dad787847bd362329b6f07657fd7f66ab1f5c5d78db12aa7a41717ea3c7cbe8a1706d2456d1c42e9b1fb4e67
SSDEEP

3072:BbnPeif6LMYrrDGCR0GVnNItCLklvpdq/spPoztzNQ9TWcjOjjFK1CXrhyp+u00:BTFSLtrkuAb2tfVjjFYCFyIcAOen

Score

10^/10

eternity

Malware Config

Extracted

Family

eternity

Wallets

47vk9PbPuHnEnazCn4tLpwPCWRLSMhpX9PD8WqpjchhTXisimD6j8EvRFDbPQHKUmHVq3vAM3DLytXLg8CqcdRXRFdPe92Q

Attributes

payload_urls
https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Executes dropped EXE 6 IoCs

pid	Process
2596	AppLaunch.exe
2556	AppLaunch.exe
1924	AppLaunch.exe
2128	AppLaunch.exe
2324	AppLaunch.exe
1988	AppLaunch.exe

Loads dropped DLL 1 IoCs

pid	Process
2932	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1592 set thread context of 2856	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	21

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2716	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2536	PING.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2188	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	16
PID 1592 wrote to memory of 2188	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	16
PID 1592 wrote to memory of 2188	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	16
PID 1592 wrote to memory of 2188	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	16
PID 1592 wrote to memory of 2188	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	16
PID 1592 wrote to memory of 2188	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	16
PID 1592 wrote to memory of 2188	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	16
PID 1592 wrote to memory of 2856	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	21
PID 1592 wrote to memory of 2856	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	21
PID 1592 wrote to memory of 2856	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	21
PID 1592 wrote to memory of 2856	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	21
PID 1592 wrote to memory of 2856	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	21
PID 1592 wrote to memory of 2856	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	21
PID 1592 wrote to memory of 2856	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	21
PID 1592 wrote to memory of 2856	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	21
PID 1592 wrote to memory of 2856	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	21
PID 1592 wrote to memory of 2856	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	21
PID 1592 wrote to memory of 2856	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	21
PID 1592 wrote to memory of 2856	1592	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	21
PID 2856 wrote to memory of 2932	2856	AppLaunch.exe	20
PID 2856 wrote to memory of 2932	2856	AppLaunch.exe	20
PID 2856 wrote to memory of 2932	2856	AppLaunch.exe	20
PID 2856 wrote to memory of 2932	2856	AppLaunch.exe	20
PID 2856 wrote to memory of 2932	2856	AppLaunch.exe	20
PID 2856 wrote to memory of 2932	2856	AppLaunch.exe	20
PID 2856 wrote to memory of 2932	2856	AppLaunch.exe	20
PID 2932 wrote to memory of 2936	2932	cmd.exe	18
PID 2932 wrote to memory of 2936	2932	cmd.exe	18
PID 2932 wrote to memory of 2936	2932	cmd.exe	18
PID 2932 wrote to memory of 2936	2932	cmd.exe	18
PID 2932 wrote to memory of 2936	2932	cmd.exe	18
PID 2932 wrote to memory of 2936	2932	cmd.exe	18
PID 2932 wrote to memory of 2936	2932	cmd.exe	18
PID 2932 wrote to memory of 2536	2932	cmd.exe	17
PID 2932 wrote to memory of 2536	2932	cmd.exe	17
PID 2932 wrote to memory of 2536	2932	cmd.exe	17
PID 2932 wrote to memory of 2536	2932	cmd.exe	17
PID 2932 wrote to memory of 2536	2932	cmd.exe	17
PID 2932 wrote to memory of 2536	2932	cmd.exe	17
PID 2932 wrote to memory of 2536	2932	cmd.exe	17
PID 2932 wrote to memory of 2716	2932	cmd.exe	34
PID 2932 wrote to memory of 2716	2932	cmd.exe	34
PID 2932 wrote to memory of 2716	2932	cmd.exe	34
PID 2932 wrote to memory of 2716	2932	cmd.exe	34
PID 2932 wrote to memory of 2716	2932	cmd.exe	34
PID 2932 wrote to memory of 2716	2932	cmd.exe	34
PID 2932 wrote to memory of 2716	2932	cmd.exe	34
PID 2932 wrote to memory of 2596	2932	cmd.exe	35
PID 2932 wrote to memory of 2596	2932	cmd.exe	35
PID 2932 wrote to memory of 2596	2932	cmd.exe	35
PID 2932 wrote to memory of 2596	2932	cmd.exe	35
PID 2932 wrote to memory of 2596	2932	cmd.exe	35
PID 2932 wrote to memory of 2596	2932	cmd.exe	35
PID 2932 wrote to memory of 2596	2932	cmd.exe	35
PID 2580 wrote to memory of 2556	2580	taskeng.exe	37
PID 2580 wrote to memory of 2556	2580	taskeng.exe	37
PID 2580 wrote to memory of 2556	2580	taskeng.exe	37
PID 2580 wrote to memory of 2556	2580	taskeng.exe	37
PID 2580 wrote to memory of 2556	2580	taskeng.exe	37
PID 2580 wrote to memory of 2556	2580	taskeng.exe	37
PID 2580 wrote to memory of 2556	2580	taskeng.exe	37
PID 2580 wrote to memory of 1924	2580	taskeng.exe	40
PID 2580 wrote to memory of 1924	2580	taskeng.exe	40
PID 2580 wrote to memory of 1924	2580	taskeng.exe	40

C:\Users\Admin\AppData\Local\Temp\98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe
"C:\Users\Admin\AppData\Local\Temp\98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2856

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
1⤵
- Runs ping.exe
PID:2536

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:2936

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "AppLaunch" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "AppLaunch" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:2716
- C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe"
  2⤵
  - Executes dropped EXE
  PID:2596

C:\Windows\system32\taskeng.exe
taskeng.exe {6E3F2B18-516D-47AA-9ACE-49314C8732E6} S-1-5-21-2185821622-4133679102-1697169727-1000:QHCIVBOB\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  2⤵
  - Executes dropped EXE
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe

Filesize
92KB

MD5
8671e933e69cd86f974b94b4b509e843

SHA1
5ee42b668c9d8bcc03e1e62be37e5e19537a1f4c

SHA256
a79c48734b00c4288867d6ace73696ab84212242eca79c45ac449a3d2e9d980c

SHA512
5d7bd38a93aabb36d2b424ceadb0c68ff22eefac53881fde5c0b642a75d52c7af47faaab4f616b0deaf5ec3ab8fe88941c9dc1311b85fc2ae8845d6b05d854b4

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe

Filesize
86KB

MD5
e2f9a535272624448b55d22e2b72807c

SHA1
315c8f99b76ef56516c7103911e41cc20cd3ea8c

SHA256
6b52dbed28ab00086be6e3689bd25707c51ce9db321b74936880a73d1d508262

SHA512
768c3091d5bf0aa36d98a61979a6f11a37556572aed136cff01b1afc54ccf9296105f2d223009d115394c95ef1d0fdc88adb1f4fe555627c0466d274e50ee4e6

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe

Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
memory/2856-3-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2856-13-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2856-4-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2856-9-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2856-2-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2856-1-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2856-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2856-5-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2856-10-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2856-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads