eternity | c4ee664c29db860f125053f80652823902b108931a7359af95308fd4d55f4f84

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06-02-2024 03:07

Target

93aa999dd6d7651750eaaca67637f97d.exe
Size

1.3MB
MD5

93aa999dd6d7651750eaaca67637f97d
SHA1

f812748e4aa94934d3444b95ddbd6f843bea8703
SHA256

c4ee664c29db860f125053f80652823902b108931a7359af95308fd4d55f4f84
SHA512

4da4ebc09d38990fd82125b41c54ff691c9ce082fd99d2c86825109fc34da065045fe7d8539b90a96a564648a373e7a4bf8d3e488129d58009cfd2913f7a76cd
SSDEEP

24576:pwT7rC6qmG4Dfr5AVKqh4mfb2iGvNStnxz/jG4Dfr5AVKqh4:orC6qmG4Dfr5AVKqam1kS7z/jG4Dfr5h

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/2912-0-0x0000000000040000-0x0000000000156000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93aa999dd6d7651750eaaca67637f97d.exe	93aa999dd6d7651750eaaca67637f97d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\93aa999dd6d7651750eaaca67637f97d.exe	93aa999dd6d7651750eaaca67637f97d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	93aa999dd6d7651750eaaca67637f97d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2756	2912	93aa999dd6d7651750eaaca67637f97d.exe	28
PID 2912 wrote to memory of 2756	2912	93aa999dd6d7651750eaaca67637f97d.exe	28
PID 2912 wrote to memory of 2756	2912	93aa999dd6d7651750eaaca67637f97d.exe	28

C:\Users\Admin\AppData\Local\Temp\93aa999dd6d7651750eaaca67637f97d.exe
"C:\Users\Admin\AppData\Local\Temp\93aa999dd6d7651750eaaca67637f97d.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2912 -s 756
  2⤵
  PID:2756

memory/2912-0-0x0000000000040000-0x0000000000156000-memory.dmp

Filesize
1.1MB

Download
memory/2912-1-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2912-2-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/2912-3-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/2912-4-0x000000001B2E0000-0x000000001B360000-memory.dmp

Filesize
512KB

Download
memory/2912-5-0x00000000005F0000-0x000000000062E000-memory.dmp

Filesize
248KB

Download
memory/2912-6-0x000000001B2E0000-0x000000001B360000-memory.dmp

Filesize
512KB

Download
memory/2912-7-0x000000001B2E0000-0x000000001B360000-memory.dmp

Filesize
512KB

Download
memory/2912-10-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/2912-11-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/2912-12-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/2912-13-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/2912-14-0x000000001B2E0000-0x000000001B360000-memory.dmp

Filesize
512KB

Download
memory/2912-15-0x000000001B2E0000-0x000000001B360000-memory.dmp

Filesize
512KB

Download