Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 09:14
Behavioral task
behavioral1
Sample
306e8bc6fa766dabc445f17ca4c242a5.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
306e8bc6fa766dabc445f17ca4c242a5.exe
-
Size
879KB
-
MD5
306e8bc6fa766dabc445f17ca4c242a5
-
SHA1
fd36f3dc65eebffc6e6c0abd1c969be918c24628
-
SHA256
1474ad29b0eadeacbfdd1c2f3982f7a377054dae747a95170c4f999c1fbb6069
-
SHA512
df77aaa6b2b2f1fee0686b3e3d61e0ad734bc6b95ea55b1256ca074bac904adbc8abfba722422f007073aa7ed1dd416eb8f695f1e5b8644cb95f75c1ec83b902
-
SSDEEP
12288:aTEYAsROAsrt/uxduo1jB0Y96qE5XddPRSy4ddAWdI1K2QZqcAnrxgGWFOH29q:awT7rC6q+d9RWnyhrxgGWFT9q
Malware Config
Signatures
-
Detects Eternity stealer 1 IoCs
resource yara_rule behavioral1/memory/1956-0-0x0000000000E00000-0x0000000000EE4000-memory.dmp eternity_stealer -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\306e8bc6fa766dabc445f17ca4c242a5.exe 306e8bc6fa766dabc445f17ca4c242a5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\306e8bc6fa766dabc445f17ca4c242a5.exe 306e8bc6fa766dabc445f17ca4c242a5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1956 306e8bc6fa766dabc445f17ca4c242a5.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2800 1956 306e8bc6fa766dabc445f17ca4c242a5.exe 28 PID 1956 wrote to memory of 2800 1956 306e8bc6fa766dabc445f17ca4c242a5.exe 28 PID 1956 wrote to memory of 2800 1956 306e8bc6fa766dabc445f17ca4c242a5.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\306e8bc6fa766dabc445f17ca4c242a5.exe"C:\Users\Admin\AppData\Local\Temp\306e8bc6fa766dabc445f17ca4c242a5.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1956 -s 7562⤵PID:2800
-