eternity | 2e9eb411b41ca953845b0d29c208b1f01ad9b1aaca8e4013b65709d0c53a6034

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 02:31

Target

249044da311886a46b7e93c1586c2c7a.exe
Size

880KB
MD5

249044da311886a46b7e93c1586c2c7a
SHA1

4a70832767f7e9a89e7a22ae75c68b7004d01818
SHA256

2e9eb411b41ca953845b0d29c208b1f01ad9b1aaca8e4013b65709d0c53a6034
SHA512

23dfcfaab4037da3589b96000211f82b831cfc1b9b8122e8edfd2a1cd7de0a2151768d3c851359791701adf4c9fcad2f07f142675adf9b750087622626ce4a83
SSDEEP

12288:hTEYAsROAsrt/uxduo1jB0Y96qPjVCA+QzDPBgVtom53YI1AF4RztwqpQtB36nwn:hwT7rC6qPjVCA+Qzyr53DO4RdpQRn

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/2884-0-0x0000000000870000-0x0000000000954000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\249044da311886a46b7e93c1586c2c7a.exe	249044da311886a46b7e93c1586c2c7a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\249044da311886a46b7e93c1586c2c7a.exe	249044da311886a46b7e93c1586c2c7a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2884	249044da311886a46b7e93c1586c2c7a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2788	2884	249044da311886a46b7e93c1586c2c7a.exe	28
PID 2884 wrote to memory of 2788	2884	249044da311886a46b7e93c1586c2c7a.exe	28
PID 2884 wrote to memory of 2788	2884	249044da311886a46b7e93c1586c2c7a.exe	28

C:\Users\Admin\AppData\Local\Temp\249044da311886a46b7e93c1586c2c7a.exe
"C:\Users\Admin\AppData\Local\Temp\249044da311886a46b7e93c1586c2c7a.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2884 -s 760
  2⤵
  PID:2788

memory/2884-0-0x0000000000870000-0x0000000000954000-memory.dmp

Filesize
912KB

Download
memory/2884-1-0x000007FEF5740000-0x000007FEF612C000-memory.dmp

Filesize
9.9MB

Download
memory/2884-2-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/2884-3-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/2884-4-0x000000001B130000-0x000000001B1B0000-memory.dmp

Filesize
512KB

Download
memory/2884-5-0x0000000000270000-0x00000000002AE000-memory.dmp

Filesize
248KB

Download
memory/2884-6-0x000000001B130000-0x000000001B1B0000-memory.dmp

Filesize
512KB

Download
memory/2884-9-0x000007FEF5740000-0x000007FEF612C000-memory.dmp

Filesize
9.9MB

Download
memory/2884-10-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/2884-11-0x0000000000140000-0x0000000000150000-memory.dmp

Filesize
64KB

Download
memory/2884-12-0x000000001B130000-0x000000001B1B0000-memory.dmp

Filesize
512KB

Download