eternity | 57ac46bbdacb1a13afebc579f14ee71ede947ca2f26c57c91528e8863c337765

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-12-2023 19:51

Target

394af9cb6f116b9b603ba446401135ed.exe
Size

912KB
MD5

394af9cb6f116b9b603ba446401135ed
SHA1

e05f5961bda0b2c5c3ad05d71f0686eb4f3fb591
SHA256

57ac46bbdacb1a13afebc579f14ee71ede947ca2f26c57c91528e8863c337765
SHA512

92aa3353acd6d80d43ec68c847bc690078177dad628eb330bb6cafcb02369560c49f196421c2becd3e106cf4432dfcdd3d158e5d6904c07e51b468b79bae2326
SSDEEP

12288:sTEYAsROAsrt/uxduo1jB0Y96qG20KEFVynRQ9jFg++6SeXXBhTQcmNvQ:swT7rC6qxEFVMRaxgFPehhkH

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/1160-0-0x0000000001130000-0x000000000121A000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1160	394af9cb6f116b9b603ba446401135ed.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 2008	1160	394af9cb6f116b9b603ba446401135ed.exe	22
PID 1160 wrote to memory of 2008	1160	394af9cb6f116b9b603ba446401135ed.exe	22
PID 1160 wrote to memory of 2008	1160	394af9cb6f116b9b603ba446401135ed.exe	22

C:\Users\Admin\AppData\Local\Temp\394af9cb6f116b9b603ba446401135ed.exe
"C:\Users\Admin\AppData\Local\Temp\394af9cb6f116b9b603ba446401135ed.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1160 -s 760
  2⤵
  PID:2008

memory/1160-0-0x0000000001130000-0x000000000121A000-memory.dmp

Filesize
936KB

Download
memory/1160-1-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmp

Filesize
9.9MB

Download
memory/1160-4-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/1160-7-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/1160-6-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/1160-5-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download
memory/1160-3-0x0000000000410000-0x000000000044E000-memory.dmp

Filesize
248KB

Download
memory/1160-2-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmp

Filesize
9.9MB

Download
memory/1160-8-0x000007FEF5410000-0x000007FEF5DFC000-memory.dmp

Filesize
9.9MB

Download
memory/1160-9-0x000000001B060000-0x000000001B0E0000-memory.dmp

Filesize
512KB

Download