eternity | f6331114110c5e78fd3c77e7c24c4394ca94ec265a162af242d3f145974011fb

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 17:38

Target

317f0d1e5ae64bb05a486add5bd45dc2.exe
Size

1.3MB
MD5

317f0d1e5ae64bb05a486add5bd45dc2
SHA1

fdc958e3de10fd745022b9b245fafa4696a11953
SHA256

f6331114110c5e78fd3c77e7c24c4394ca94ec265a162af242d3f145974011fb
SHA512

bfc1a80369876c4739ed58f20d8bc5839762caa7c1e97d8286476c22ae6cec6f923c90374bf3e1ea6ed7fcebfb88df07a22e4b6d2394bc3b9a17b46efff44100
SSDEEP

24576:wwT7rC6qsp52Lf6XDGh4kCpXcdwkVoAZaE2Lf:RrC6qG5A+VXcdwkmAoE

Score

10^/10

eternity stealer

Detects Eternity stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/1340-0-0x0000000000E50000-0x0000000000F68000-memory.dmp	eternity_stealer
behavioral1/memory/1340-13-0x000000001B460000-0x000000001B4E0000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\317f0d1e5ae64bb05a486add5bd45dc2.exe	317f0d1e5ae64bb05a486add5bd45dc2.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\317f0d1e5ae64bb05a486add5bd45dc2.exe	317f0d1e5ae64bb05a486add5bd45dc2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	317f0d1e5ae64bb05a486add5bd45dc2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2684	1340	317f0d1e5ae64bb05a486add5bd45dc2.exe	28
PID 1340 wrote to memory of 2684	1340	317f0d1e5ae64bb05a486add5bd45dc2.exe	28
PID 1340 wrote to memory of 2684	1340	317f0d1e5ae64bb05a486add5bd45dc2.exe	28

C:\Users\Admin\AppData\Local\Temp\317f0d1e5ae64bb05a486add5bd45dc2.exe
"C:\Users\Admin\AppData\Local\Temp\317f0d1e5ae64bb05a486add5bd45dc2.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1340 -s 760
  2⤵
  PID:2684

memory/1340-0-0x0000000000E50000-0x0000000000F68000-memory.dmp

Filesize
1.1MB

Download
memory/1340-1-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/1340-2-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/1340-3-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/1340-4-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/1340-5-0x000000001B460000-0x000000001B4E0000-memory.dmp

Filesize
512KB

Download
memory/1340-6-0x00000000003E0000-0x000000000041E000-memory.dmp

Filesize
248KB

Download
memory/1340-8-0x000000001B460000-0x000000001B4E0000-memory.dmp

Filesize
512KB

Download
memory/1340-7-0x000000001B460000-0x000000001B4E0000-memory.dmp

Filesize
512KB

Download
memory/1340-11-0x000007FEF5F70000-0x000007FEF695C000-memory.dmp

Filesize
9.9MB

Download
memory/1340-12-0x000000001B460000-0x000000001B4E0000-memory.dmp

Filesize
512KB

Download
memory/1340-13-0x000000001B460000-0x000000001B4E0000-memory.dmp

Filesize
512KB

Download