eternity | 2ea99244c02351022b99596d4cef769b1ac920b674abd08b268f66a6e171bd8d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 19:03

Target

4433d5485fca17b6fcc0c0e3bd5da5cc.exe
Size

886KB
MD5

4433d5485fca17b6fcc0c0e3bd5da5cc
SHA1

117709a70d73623094d9439e1737a643845f3671
SHA256

2ea99244c02351022b99596d4cef769b1ac920b674abd08b268f66a6e171bd8d
SHA512

6fdb122f5b5f51da4790a844c7f4d78538ca48a69dfa73ea22dd39de5bffecc42148d48a35015a72eac185f309d1044a53db589e5080d719640ab8f43a3e9e5e
SSDEEP

12288:MTEYAsROAsrt/uxduo1jB0Y96qRTJzB4htv8/YgU9D4uUDafWGy8CLrHe3o:MwT7rC6qRTJzyht7ny8fAHgo

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/2332-0-0x0000000000960000-0x0000000000A46000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2332	4433d5485fca17b6fcc0c0e3bd5da5cc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2832	2332	4433d5485fca17b6fcc0c0e3bd5da5cc.exe	28
PID 2332 wrote to memory of 2832	2332	4433d5485fca17b6fcc0c0e3bd5da5cc.exe	28
PID 2332 wrote to memory of 2832	2332	4433d5485fca17b6fcc0c0e3bd5da5cc.exe	28

C:\Users\Admin\AppData\Local\Temp\4433d5485fca17b6fcc0c0e3bd5da5cc.exe
"C:\Users\Admin\AppData\Local\Temp\4433d5485fca17b6fcc0c0e3bd5da5cc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2332 -s 764
  2⤵
  PID:2832

memory/2332-0-0x0000000000960000-0x0000000000A46000-memory.dmp

Filesize
920KB

Download
memory/2332-1-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/2332-2-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/2332-5-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/2332-4-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/2332-7-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/2332-6-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/2332-3-0x0000000002170000-0x00000000021AE000-memory.dmp

Filesize
248KB

Download
memory/2332-8-0x000007FEF5BA0000-0x000007FEF658C000-memory.dmp

Filesize
9.9MB

Download
memory/2332-9-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download
memory/2332-10-0x000000001B200000-0x000000001B280000-memory.dmp

Filesize
512KB

Download