eternity | 76a355959101e990b1b35b6f6ec6f28db30314af212b1c3c8e6e10db8bfc6183

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/01/2024, 06:40

Target

69bef5d41bf14465072f69169f3b090d.exe
Size

945KB
MD5

69bef5d41bf14465072f69169f3b090d
SHA1

08ae8e6e5d09959300f64f255e74f4997351c897
SHA256

76a355959101e990b1b35b6f6ec6f28db30314af212b1c3c8e6e10db8bfc6183
SHA512

48b3ecc660e0af2c83be62a3b317d24dc6e5346ee679f41fa1fade683b8b712900b7498118e354783ea2397873e9c7f358b44abe6646641809b94bee5026eb76
SSDEEP

12288:CTEYAsROAsrt/uxduo1jB0Y96qxuH2ojpvEZNGSOLHjfuwkfhsTjcrC7K6VtRXff:CwT7rC6qY2EpvSNWDtkYOwDXn

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/2496-0-0x0000000000E60000-0x0000000000F4C000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\69bef5d41bf14465072f69169f3b090d.exe	69bef5d41bf14465072f69169f3b090d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\69bef5d41bf14465072f69169f3b090d.exe	69bef5d41bf14465072f69169f3b090d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2496	69bef5d41bf14465072f69169f3b090d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2700	2496	69bef5d41bf14465072f69169f3b090d.exe	28
PID 2496 wrote to memory of 2700	2496	69bef5d41bf14465072f69169f3b090d.exe	28
PID 2496 wrote to memory of 2700	2496	69bef5d41bf14465072f69169f3b090d.exe	28

C:\Users\Admin\AppData\Local\Temp\69bef5d41bf14465072f69169f3b090d.exe
"C:\Users\Admin\AppData\Local\Temp\69bef5d41bf14465072f69169f3b090d.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2496 -s 756
  2⤵
  PID:2700

memory/2496-0-0x0000000000E60000-0x0000000000F4C000-memory.dmp

Filesize
944KB

Download
memory/2496-1-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/2496-3-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/2496-2-0x0000000000700000-0x000000000073E000-memory.dmp

Filesize
248KB

Download
memory/2496-4-0x00000000004D0000-0x00000000004D1000-memory.dmp

Filesize
4KB

Download
memory/2496-5-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download
memory/2496-6-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download
memory/2496-7-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download
memory/2496-10-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Filesize
9.9MB

Download
memory/2496-11-0x000000001B1E0000-0x000000001B260000-memory.dmp

Filesize
512KB

Download