eternity | 223214577757ae30b9fd24cb9f8f2e750ecfc309d77e52bfd56b520f77632093

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 05:21

Target

29cf8f8e0cbfb9d2efcc4eb33746d2bc.exe
Size

881KB
MD5

29cf8f8e0cbfb9d2efcc4eb33746d2bc
SHA1

eff4f7b2e9a8e330c56f7c997f06c35fa5534da8
SHA256

223214577757ae30b9fd24cb9f8f2e750ecfc309d77e52bfd56b520f77632093
SHA512

6c05ddaa9d881068cc9a8f5255c901d2d7b47a48307a01ec2743f3dc8b6b2d618984355da4595f31325361ab33659e3b20b09e116e859a9791b2b6c6552ddf9e
SSDEEP

12288:UTEYAsROAsrt/uxduo1jB0Y96qZunGv+fkajssuESw7JqzQCabepSLuIa9:UwT7rC6qZuGv+usuESwVqcmpG6

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/2376-0-0x0000000001010000-0x00000000010F4000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\29cf8f8e0cbfb9d2efcc4eb33746d2bc.exe	29cf8f8e0cbfb9d2efcc4eb33746d2bc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\29cf8f8e0cbfb9d2efcc4eb33746d2bc.exe	29cf8f8e0cbfb9d2efcc4eb33746d2bc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2376	29cf8f8e0cbfb9d2efcc4eb33746d2bc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 1828	2376	29cf8f8e0cbfb9d2efcc4eb33746d2bc.exe	28
PID 2376 wrote to memory of 1828	2376	29cf8f8e0cbfb9d2efcc4eb33746d2bc.exe	28
PID 2376 wrote to memory of 1828	2376	29cf8f8e0cbfb9d2efcc4eb33746d2bc.exe	28

C:\Users\Admin\AppData\Local\Temp\29cf8f8e0cbfb9d2efcc4eb33746d2bc.exe
"C:\Users\Admin\AppData\Local\Temp\29cf8f8e0cbfb9d2efcc4eb33746d2bc.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2376 -s 760
  2⤵
  PID:1828

memory/2376-0-0x0000000001010000-0x00000000010F4000-memory.dmp

Filesize
912KB

Download
memory/2376-1-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download
memory/2376-4-0x0000000000A90000-0x0000000000B10000-memory.dmp

Filesize
512KB

Download
memory/2376-7-0x0000000000A90000-0x0000000000B10000-memory.dmp

Filesize
512KB

Download
memory/2376-6-0x0000000000A90000-0x0000000000B10000-memory.dmp

Filesize
512KB

Download
memory/2376-5-0x00000000002D0000-0x000000000030E000-memory.dmp

Filesize
248KB

Download
memory/2376-3-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2376-2-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download
memory/2376-9-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download
memory/2376-10-0x0000000000A90000-0x0000000000B10000-memory.dmp

Filesize
512KB

Download