eternity | 8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7

General

Target

8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe
Size

932KB
MD5

515544fb6f33abfff7b83f4c3589c3d9
SHA1

53aa5502a94a12326b3f2799a28b2782c38e6168
SHA256

8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7
SHA512

60b760308b41a2deaac615d78865fa893d6721652044f6b05a950fd9535eabef1e6613ce9b2e1265d83d48121d3c97a051c9e9f4d11d60e0c7cf6e35a3168ca8
SSDEEP

24576:WwT7rC6qb3RhaoHAOk+UFenpumfuiEkZJ8:PrC6qb3NAOUSuMu/d

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/1744-0-0x00000000002B0000-0x000000000039E000-memory.dmp	disable_win_def

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/1744-0-0x00000000002B0000-0x000000000039E000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe

Disables Task Manager via registry modification
evasion

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe	8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe	8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe

Executes dropped EXE 1 IoCs

pid	Process
4032	dcd.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4816	powershell.exe
4816	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe
Token: SeDebugPrivilege	4816	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 4032	1744	8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe	84
PID 1744 wrote to memory of 4032	1744	8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe	84
PID 1744 wrote to memory of 4032	1744	8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe	84
PID 1744 wrote to memory of 4816	1744	8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe	87
PID 1744 wrote to memory of 4816	1744	8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe	87

C:\Users\Admin\AppData\Local\Temp\8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe
"C:\Users\Admin\AppData\Local\Temp\8d611985cb8101c86c2808c5977781287846a2ed0b4f196de61ac632c1f46ed7.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Drops startup file
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xbwojev4.obf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
memory/1744-8-0x0000000000C90000-0x0000000000CA0000-memory.dmp

Filesize
64KB

Download
memory/1744-1-0x00007FFFF8D40000-0x00007FFFF9801000-memory.dmp

Filesize
10.8MB

Download
memory/1744-4-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/1744-5-0x0000000000C90000-0x0000000000CA0000-memory.dmp

Filesize
64KB

Download
memory/1744-6-0x00000000025C0000-0x00000000025FE000-memory.dmp

Filesize
248KB

Download
memory/1744-7-0x0000000000C90000-0x0000000000CA0000-memory.dmp

Filesize
64KB

Download
memory/1744-0-0x00000000002B0000-0x000000000039E000-memory.dmp

Filesize
952KB

Download
memory/1744-2-0x0000000000CA0000-0x0000000000CF0000-memory.dmp

Filesize
320KB

Download
memory/1744-33-0x00007FFFF8D40000-0x00007FFFF9801000-memory.dmp

Filesize
10.8MB

Download
memory/1744-3-0x00007FFFF8D40000-0x00007FFFF9801000-memory.dmp

Filesize
10.8MB

Download
memory/4816-14-0x000001CFBA3D0000-0x000001CFBA3E0000-memory.dmp

Filesize
64KB

Download
memory/4816-16-0x000001CFBA3D0000-0x000001CFBA3E0000-memory.dmp

Filesize
64KB

Download
memory/4816-15-0x000001CFBA3E0000-0x000001CFBA402000-memory.dmp

Filesize
136KB

Download
memory/4816-26-0x000001CFBA3D0000-0x000001CFBA3E0000-memory.dmp

Filesize
64KB

Download
memory/4816-27-0x000001CFBA3D0000-0x000001CFBA3E0000-memory.dmp

Filesize
64KB

Download
memory/4816-30-0x00007FFFF8D40000-0x00007FFFF9801000-memory.dmp

Filesize
10.8MB

Download
memory/4816-13-0x00007FFFF8D40000-0x00007FFFF9801000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads