eternity | b9dfb3ec5457015f6a52e92a4f23ef0b6cfcf081703c94b4fb8688b9d33cda09

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-01-2024 03:55

Target

5c1207273d347421e01531690820f8ec.exe
Size

1.1MB
MD5

5c1207273d347421e01531690820f8ec
SHA1

6b42901dbe173ba67e4ea7c6a33c681015131677
SHA256

b9dfb3ec5457015f6a52e92a4f23ef0b6cfcf081703c94b4fb8688b9d33cda09
SHA512

3c06298e6b7873f20fcbe18fd5cc46db3234957c347d81c5b8b36e0bf3b33f8948e292503c764b5df656ba9293936c92dc51a5e75e7dcdf362006e8c6c115986
SSDEEP

24576:uwT7rC6qREcZiTYHYnCoLjvv3CgUtcZi:3rC6qB4zLM

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/1932-0-0x0000000001210000-0x0000000001314000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	5c1207273d347421e01531690820f8ec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 3004	1932	5c1207273d347421e01531690820f8ec.exe	28
PID 1932 wrote to memory of 3004	1932	5c1207273d347421e01531690820f8ec.exe	28
PID 1932 wrote to memory of 3004	1932	5c1207273d347421e01531690820f8ec.exe	28

C:\Users\Admin\AppData\Local\Temp\5c1207273d347421e01531690820f8ec.exe
"C:\Users\Admin\AppData\Local\Temp\5c1207273d347421e01531690820f8ec.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1932 -s 756
  2⤵
  PID:3004

memory/1932-0-0x0000000001210000-0x0000000001314000-memory.dmp

Filesize
1.0MB

Download
memory/1932-1-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmp

Filesize
9.9MB

Download
memory/1932-2-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmp

Filesize
9.9MB

Download
memory/1932-3-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/1932-5-0x0000000000410000-0x000000000044E000-memory.dmp

Filesize
248KB

Download
memory/1932-6-0x000000001ADB0000-0x000000001AE30000-memory.dmp

Filesize
512KB

Download
memory/1932-4-0x000000001ADB0000-0x000000001AE30000-memory.dmp

Filesize
512KB

Download
memory/1932-7-0x000007FEF5040000-0x000007FEF5A2C000-memory.dmp

Filesize
9.9MB

Download
memory/1932-8-0x000000001ADB0000-0x000000001AE30000-memory.dmp

Filesize
512KB

Download
memory/1932-9-0x000000001ADB0000-0x000000001AE30000-memory.dmp

Filesize
512KB

Download