eternity | d56d18b6c61e6b1ada83822cd74aadf86815c7c4320cd98b7c0687a2be388012

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-01-2024 00:10

Target

68fca4f28d420001d12fe8a7f99bc1dd.exe
Size

911KB
MD5

68fca4f28d420001d12fe8a7f99bc1dd
SHA1

0d0432d5c739933ad334a5b9894b13d2d9f8dd2e
SHA256

d56d18b6c61e6b1ada83822cd74aadf86815c7c4320cd98b7c0687a2be388012
SHA512

e9b7081edb0409a6b239e2d51313c575c88a752a3be4cad77f1c2a4608c3aa8de6ca2fe1538d95f583ce9541cb1da29274d7496281d48674561410b9b46c5eb1
SSDEEP

12288:ETEYAsROAsrt/uxduo1jB0Y96q3HCPfh/VLgatG15Hyz+syHx5aUjounR:EwT7rC6qgfUMK5Sz+QUjR

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/2896-0-0x0000000000B70000-0x0000000000C58000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	68fca4f28d420001d12fe8a7f99bc1dd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 3024	2896	68fca4f28d420001d12fe8a7f99bc1dd.exe	28
PID 2896 wrote to memory of 3024	2896	68fca4f28d420001d12fe8a7f99bc1dd.exe	28
PID 2896 wrote to memory of 3024	2896	68fca4f28d420001d12fe8a7f99bc1dd.exe	28

C:\Users\Admin\AppData\Local\Temp\68fca4f28d420001d12fe8a7f99bc1dd.exe
"C:\Users\Admin\AppData\Local\Temp\68fca4f28d420001d12fe8a7f99bc1dd.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2896 -s 764
  2⤵
  PID:3024

memory/2896-0-0x0000000000B70000-0x0000000000C58000-memory.dmp

Filesize
928KB

Download
memory/2896-1-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

Filesize
9.9MB

Download
memory/2896-2-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

Filesize
9.9MB

Download
memory/2896-5-0x000000001B030000-0x000000001B0B0000-memory.dmp

Filesize
512KB

Download
memory/2896-4-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2896-3-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

Filesize
9.9MB

Download
memory/2896-6-0x0000000000250000-0x000000000028E000-memory.dmp

Filesize
248KB

Download
memory/2896-7-0x000000001B030000-0x000000001B0B0000-memory.dmp

Filesize
512KB

Download
memory/2896-8-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

Filesize
9.9MB

Download
memory/2896-9-0x000000001B030000-0x000000001B0B0000-memory.dmp

Filesize
512KB

Download
memory/2896-10-0x000000001B030000-0x000000001B0B0000-memory.dmp

Filesize
512KB

Download
memory/2896-11-0x000000001B030000-0x000000001B0B0000-memory.dmp

Filesize
512KB

Download