Analysis
-
max time kernel
141s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30-12-2023 12:53
Behavioral task
behavioral1
Sample
191f2987a50aa28ada610e057d27bca1.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
191f2987a50aa28ada610e057d27bca1.exe
-
Size
880KB
-
MD5
191f2987a50aa28ada610e057d27bca1
-
SHA1
58165ed967f4b638dcfc6ad84c72d751f48d7a88
-
SHA256
de6a42e8a3ec2020839117b2dabe1a63ec1504deb3b518c29a642c0bb09bfee8
-
SHA512
f595069848c59e364d21b9d0c21b21451e38e500509db966bd7ad20417eef7d6f604ce28072cdc697adfc5e2550eaec35987c6b78480b5050b1174da6d60bd2d
-
SSDEEP
12288:aTEYAsROAsrt/uxduo1jB0Y96qOLr3/SAeyiyeF/LMWBTZCXwSkTb2KqHIIgYur3:awT7rC6qOPN8F/LMaCjk32VHur3
Malware Config
Signatures
-
Detects Eternity stealer 1 IoCs
resource yara_rule behavioral2/memory/1636-0-0x0000000000580000-0x0000000000664000-memory.dmp eternity_stealer -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\191f2987a50aa28ada610e057d27bca1.exe 191f2987a50aa28ada610e057d27bca1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\191f2987a50aa28ada610e057d27bca1.exe 191f2987a50aa28ada610e057d27bca1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1636 191f2987a50aa28ada610e057d27bca1.exe