eternity | 49e96109e5df1bef22a708c73e342315eeaf4c4ada977fa1489dad2174ce21b8

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 08:57

Target

531564d4a966d5f94adb34b02f6feab3.exe
Size

1.1MB
MD5

531564d4a966d5f94adb34b02f6feab3
SHA1

2f0da0d4746837c345ea8312a006a0ed61997962
SHA256

49e96109e5df1bef22a708c73e342315eeaf4c4ada977fa1489dad2174ce21b8
SHA512

1347e64d3088cd99cac7c77974b832d96888c23aef6104c7f1213586f640e8332613082e0e77d838c4823e1dfc2cadcd67a12378358ca4256c39da499ec735d8
SSDEEP

24576:nwT7rC6qP1sEcZiZz91mgZ6br9lTj6bGL6cZi:erC6qP6izxcbr/c+

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/2932-0-0x0000000000DD0000-0x0000000000ED4000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\531564d4a966d5f94adb34b02f6feab3.exe	531564d4a966d5f94adb34b02f6feab3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\531564d4a966d5f94adb34b02f6feab3.exe	531564d4a966d5f94adb34b02f6feab3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2932	531564d4a966d5f94adb34b02f6feab3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 3044	2932	531564d4a966d5f94adb34b02f6feab3.exe	22
PID 2932 wrote to memory of 3044	2932	531564d4a966d5f94adb34b02f6feab3.exe	22
PID 2932 wrote to memory of 3044	2932	531564d4a966d5f94adb34b02f6feab3.exe	22

C:\Users\Admin\AppData\Local\Temp\531564d4a966d5f94adb34b02f6feab3.exe
"C:\Users\Admin\AppData\Local\Temp\531564d4a966d5f94adb34b02f6feab3.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2932 -s 760
  2⤵
  PID:3044

memory/2932-0-0x0000000000DD0000-0x0000000000ED4000-memory.dmp

Filesize
1.0MB

Download
memory/2932-1-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/2932-4-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/2932-5-0x0000000000700000-0x000000000073E000-memory.dmp

Filesize
248KB

Download
memory/2932-7-0x000000001B0B0000-0x000000001B130000-memory.dmp

Filesize
512KB

Download
memory/2932-6-0x000000001B0B0000-0x000000001B130000-memory.dmp

Filesize
512KB

Download
memory/2932-3-0x000000001B0B0000-0x000000001B130000-memory.dmp

Filesize
512KB

Download
memory/2932-2-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/2932-9-0x000007FEF5EE0000-0x000007FEF68CC000-memory.dmp

Filesize
9.9MB

Download
memory/2932-10-0x000000001B0B0000-0x000000001B130000-memory.dmp

Filesize
512KB

Download