eternity | 98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502

General

Target

98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe
Size

279KB
MD5

0de1d0372e15bbfeded7fb418e8c00ae
SHA1

6d0dc8617e5bcdd48dd5b45d8f40b97e4bbce0a1
SHA256

98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502
SHA512

7b3f2d2cc3fce6707be938053fd94a8a5edb48f7dad787847bd362329b6f07657fd7f66ab1f5c5d78db12aa7a41717ea3c7cbe8a1706d2456d1c42e9b1fb4e67
SSDEEP

3072:BbnPeif6LMYrrDGCR0GVnNItCLklvpdq/spPoztzNQ9TWcjOjjFK1CXrhyp+u00:BTFSLtrkuAb2tfVjjFYCFyIcAOen

Score

10^/10

eternity

Malware Config

Extracted

Family

eternity

Wallets

47vk9PbPuHnEnazCn4tLpwPCWRLSMhpX9PD8WqpjchhTXisimD6j8EvRFDbPQHKUmHVq3vAM3DLytXLg8CqcdRXRFdPe92Q

Attributes

payload_urls
https://raw.githubusercontent.com/VolVeRFM/SilentMiner-VolVeR/main/VolVeRBuilder/Resources/xmrig.exe

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Executes dropped EXE 6 IoCs

pid	Process
2416	AppLaunch.exe
1444	AppLaunch.exe
3968	AppLaunch.exe
2984	AppLaunch.exe
5068	AppLaunch.exe
1956	AppLaunch.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2308 set thread context of 756	2308	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	19

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4128	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4884	PING.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 756	2308	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	19
PID 2308 wrote to memory of 756	2308	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	19
PID 2308 wrote to memory of 756	2308	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	19
PID 2308 wrote to memory of 756	2308	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	19
PID 2308 wrote to memory of 756	2308	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	19
PID 2308 wrote to memory of 756	2308	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	19
PID 2308 wrote to memory of 756	2308	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	19
PID 2308 wrote to memory of 756	2308	98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe	19
PID 756 wrote to memory of 1264	756	AppLaunch.exe	15
PID 756 wrote to memory of 1264	756	AppLaunch.exe	15
PID 756 wrote to memory of 1264	756	AppLaunch.exe	15
PID 1264 wrote to memory of 5092	1264	cmd.exe	17
PID 1264 wrote to memory of 5092	1264	cmd.exe	17
PID 1264 wrote to memory of 5092	1264	cmd.exe	17
PID 1264 wrote to memory of 4884	1264	cmd.exe	16
PID 1264 wrote to memory of 4884	1264	cmd.exe	16
PID 1264 wrote to memory of 4884	1264	cmd.exe	16
PID 1264 wrote to memory of 4128	1264	cmd.exe	80
PID 1264 wrote to memory of 4128	1264	cmd.exe	80
PID 1264 wrote to memory of 4128	1264	cmd.exe	80
PID 1264 wrote to memory of 2416	1264	cmd.exe	79
PID 1264 wrote to memory of 2416	1264	cmd.exe	79
PID 1264 wrote to memory of 2416	1264	cmd.exe	79

C:\Users\Admin\AppData\Local\Temp\98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe
"C:\Users\Admin\AppData\Local\Temp\98df5d41ea0e8ba3846de781c30543be8777d1bd11241bc76bc903a4be81c502.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "AppLaunch" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Windows\SysWOW64\PING.EXE
  ping 127.0.0.1
  2⤵
  - Runs ping.exe
  PID:4884
- C:\Windows\SysWOW64\chcp.com
  chcp 65001
  2⤵
  PID:5092
- C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
  "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe"
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn "AppLaunch" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:4128

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
1⤵
- Executes dropped EXE
PID:1444

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
1⤵
- Executes dropped EXE
PID:3968

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
1⤵
- Executes dropped EXE
PID:2984

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
1⤵
- Executes dropped EXE
PID:5068

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe
1⤵
- Executes dropped EXE
PID:1956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe

Filesize
15KB

MD5
ed16817fec0f4d0be6e124524cf23147

SHA1
7922d0f21680a0ab51c87c0a9ed9082badccbb30

SHA256
048fa9794227c010cf6d685a834963409e3853e6a3d51356d8ea8df6ccdc2976

SHA512
e51e9168ae787a2698ceed22334b7e5e8965ef830273eca32bf72473f6365e89c52f17da03f38692edb13b83b6cf46ffdfa0ad63039c20780039b3356d41cae6

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe

Filesize
92KB

MD5
8671e933e69cd86f974b94b4b509e843

SHA1
5ee42b668c9d8bcc03e1e62be37e5e19537a1f4c

SHA256
a79c48734b00c4288867d6ace73696ab84212242eca79c45ac449a3d2e9d980c

SHA512
5d7bd38a93aabb36d2b424ceadb0c68ff22eefac53881fde5c0b642a75d52c7af47faaab4f616b0deaf5ec3ab8fe88941c9dc1311b85fc2ae8845d6b05d854b4

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\AppLaunch.exe

Filesize
96KB

MD5
7825cad99621dd288da81d8d8ae13cf5

SHA1
f3e1ab0c8e4f22e718cdeb6fa5faa87b0e61e73c

SHA256
529088553fe9cb3e497ef704ce9bc7bc07630f6ddfad44afb92acfe639789ec5

SHA512
2e81251a2c140a96f681fa95d82eee531b391e2654daa90da08d1dd00f13cba949136d465a2dc37507d40b4a708b6fc695baa716f19737591b1a89bd2a4b60b4

Download Submit
memory/756-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/756-4-0x0000000009DD0000-0x000000000A2CE000-memory.dmp

Filesize
5.0MB

Download
memory/756-3-0x0000000073830000-0x0000000073F1E000-memory.dmp

Filesize
6.9MB

Download
memory/756-13-0x0000000073830000-0x0000000073F1E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads