Analysis

  • max time kernel
    145s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2023 10:55

General

  • Target

    68fca4f28d420001d12fe8a7f99bc1dd.exe

  • Size

    911KB

  • MD5

    68fca4f28d420001d12fe8a7f99bc1dd

  • SHA1

    0d0432d5c739933ad334a5b9894b13d2d9f8dd2e

  • SHA256

    d56d18b6c61e6b1ada83822cd74aadf86815c7c4320cd98b7c0687a2be388012

  • SHA512

    e9b7081edb0409a6b239e2d51313c575c88a752a3be4cad77f1c2a4608c3aa8de6ca2fe1538d95f583ce9541cb1da29274d7496281d48674561410b9b46c5eb1

  • SSDEEP

    12288:ETEYAsROAsrt/uxduo1jB0Y96q3HCPfh/VLgatG15Hyz+syHx5aUjounR:EwT7rC6qgfUMK5Sz+QUjR

Score
10/10

Malware Config

Signatures

  • Detects Eternity stealer 1 IoCs
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68fca4f28d420001d12fe8a7f99bc1dd.exe
    "C:\Users\Admin\AppData\Local\Temp\68fca4f28d420001d12fe8a7f99bc1dd.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5016-0-0x0000000000700000-0x00000000007E8000-memory.dmp

    Filesize

    928KB

  • memory/5016-1-0x00007FFEC2540000-0x00007FFEC3001000-memory.dmp

    Filesize

    10.8MB

  • memory/5016-2-0x0000000002900000-0x0000000002950000-memory.dmp

    Filesize

    320KB

  • memory/5016-5-0x000000001B610000-0x000000001B620000-memory.dmp

    Filesize

    64KB

  • memory/5016-7-0x000000001B610000-0x000000001B620000-memory.dmp

    Filesize

    64KB

  • memory/5016-8-0x000000001B610000-0x000000001B620000-memory.dmp

    Filesize

    64KB

  • memory/5016-6-0x00000000028B0000-0x00000000028EE000-memory.dmp

    Filesize

    248KB

  • memory/5016-4-0x0000000002880000-0x0000000002881000-memory.dmp

    Filesize

    4KB

  • memory/5016-3-0x0000000002880000-0x0000000002881000-memory.dmp

    Filesize

    4KB

  • memory/5016-9-0x000000001B820000-0x000000001B98A000-memory.dmp

    Filesize

    1.4MB

  • memory/5016-10-0x00007FFEC2540000-0x00007FFEC3001000-memory.dmp

    Filesize

    10.8MB