eternity | 843e84bc446dbe19daa72d91489ea1cb10bf87ae47ab0b7310801cc90081d9e5

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 11:06

Target

721213c1dc804876b85af2be746bdb6c.exe
Size

890KB
MD5

721213c1dc804876b85af2be746bdb6c
SHA1

8fe5b6b7d7ec021ff581a4dcecbe76db6557a9b7
SHA256

843e84bc446dbe19daa72d91489ea1cb10bf87ae47ab0b7310801cc90081d9e5
SHA512

2472488c650bdcf6db8f09847682c51cd51dd1364b0dafe067049519725ecb43f5c3cd4d91f24a331ba980ba26425ac1fe866a5b3fcdd054effbfd094ff6bf9f
SSDEEP

12288:cTEYAsROAsrt/uxduo1jB0Y96qpoWmBCh0jlxa66akUs+52xaO3EnfctmsLY:cwT7rC6q9oieYa52eEhY

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/2144-0-0x0000000000E10000-0x0000000000EF4000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\721213c1dc804876b85af2be746bdb6c.exe	721213c1dc804876b85af2be746bdb6c.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\721213c1dc804876b85af2be746bdb6c.exe	721213c1dc804876b85af2be746bdb6c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	721213c1dc804876b85af2be746bdb6c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1836	2144	721213c1dc804876b85af2be746bdb6c.exe	28
PID 2144 wrote to memory of 1836	2144	721213c1dc804876b85af2be746bdb6c.exe	28
PID 2144 wrote to memory of 1836	2144	721213c1dc804876b85af2be746bdb6c.exe	28

C:\Users\Admin\AppData\Local\Temp\721213c1dc804876b85af2be746bdb6c.exe
"C:\Users\Admin\AppData\Local\Temp\721213c1dc804876b85af2be746bdb6c.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2144 -s 756
  2⤵
  PID:1836

memory/2144-0-0x0000000000E10000-0x0000000000EF4000-memory.dmp

Filesize
912KB

Download
memory/2144-1-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download
memory/2144-2-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download
memory/2144-3-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/2144-7-0x000000001A9D0000-0x000000001AA50000-memory.dmp

Filesize
512KB

Download
memory/2144-6-0x000000001A9D0000-0x000000001AA50000-memory.dmp

Filesize
512KB

Download
memory/2144-5-0x0000000000160000-0x000000000019E000-memory.dmp

Filesize
248KB

Download
memory/2144-4-0x000000001A9D0000-0x000000001AA50000-memory.dmp

Filesize
512KB

Download
memory/2144-10-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download
memory/2144-11-0x000000001A9D0000-0x000000001AA50000-memory.dmp

Filesize
512KB

Download