Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-02-2024 03:07

General

  • Target

    93aa999dd6d7651750eaaca67637f97d.exe

  • Size

    1.3MB

  • MD5

    93aa999dd6d7651750eaaca67637f97d

  • SHA1

    f812748e4aa94934d3444b95ddbd6f843bea8703

  • SHA256

    c4ee664c29db860f125053f80652823902b108931a7359af95308fd4d55f4f84

  • SHA512

    4da4ebc09d38990fd82125b41c54ff691c9ce082fd99d2c86825109fc34da065045fe7d8539b90a96a564648a373e7a4bf8d3e488129d58009cfd2913f7a76cd

  • SSDEEP

    24576:pwT7rC6qmG4Dfr5AVKqh4mfb2iGvNStnxz/jG4Dfr5AVKqh4:orC6qmG4Dfr5AVKqam1kS7z/jG4Dfr5h

Score
10/10

Malware Config

Signatures

  • Detects Eternity stealer 1 IoCs
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

  • Drops startup file 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\93aa999dd6d7651750eaaca67637f97d.exe
    "C:\Users\Admin\AppData\Local\Temp\93aa999dd6d7651750eaaca67637f97d.exe"
    1⤵
    • Drops startup file
    • Suspicious use of AdjustPrivilegeToken
    PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1160-0-0x0000000000D40000-0x0000000000E56000-memory.dmp

    Filesize

    1.1MB

  • memory/1160-1-0x00007FF9C4E90000-0x00007FF9C5951000-memory.dmp

    Filesize

    10.8MB

  • memory/1160-3-0x0000000001710000-0x0000000001711000-memory.dmp

    Filesize

    4KB

  • memory/1160-2-0x0000000003080000-0x00000000030D0000-memory.dmp

    Filesize

    320KB

  • memory/1160-5-0x0000000001700000-0x0000000001710000-memory.dmp

    Filesize

    64KB

  • memory/1160-4-0x0000000001710000-0x0000000001711000-memory.dmp

    Filesize

    4KB

  • memory/1160-6-0x0000000003030000-0x000000000306E000-memory.dmp

    Filesize

    248KB

  • memory/1160-8-0x0000000001700000-0x0000000001710000-memory.dmp

    Filesize

    64KB

  • memory/1160-7-0x0000000001700000-0x0000000001710000-memory.dmp

    Filesize

    64KB

  • memory/1160-11-0x00007FF9C4E90000-0x00007FF9C5951000-memory.dmp

    Filesize

    10.8MB