Analysis
-
max time kernel
132s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 17:38
Behavioral task
behavioral1
Sample
317f0d1e5ae64bb05a486add5bd45dc2.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
317f0d1e5ae64bb05a486add5bd45dc2.exe
-
Size
1.3MB
-
MD5
317f0d1e5ae64bb05a486add5bd45dc2
-
SHA1
fdc958e3de10fd745022b9b245fafa4696a11953
-
SHA256
f6331114110c5e78fd3c77e7c24c4394ca94ec265a162af242d3f145974011fb
-
SHA512
bfc1a80369876c4739ed58f20d8bc5839762caa7c1e97d8286476c22ae6cec6f923c90374bf3e1ea6ed7fcebfb88df07a22e4b6d2394bc3b9a17b46efff44100
-
SSDEEP
24576:wwT7rC6qsp52Lf6XDGh4kCpXcdwkVoAZaE2Lf:RrC6qG5A+VXcdwkmAoE
Malware Config
Signatures
-
Detects Eternity stealer 1 IoCs
resource yara_rule behavioral2/memory/3716-0-0x00000000003C0000-0x00000000004D8000-memory.dmp eternity_stealer -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\317f0d1e5ae64bb05a486add5bd45dc2.exe 317f0d1e5ae64bb05a486add5bd45dc2.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\317f0d1e5ae64bb05a486add5bd45dc2.exe 317f0d1e5ae64bb05a486add5bd45dc2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3716 317f0d1e5ae64bb05a486add5bd45dc2.exe