Analysis

  • max time kernel
    0s
  • max time network
    27s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-03-2024 22:56

General

  • Target

    Autofarm.exe

  • Size

    902KB

  • MD5

    c83093e96402aaf8c5afe4c12d1d162d

  • SHA1

    6b52e3cb21a3941c31da0dc3f559b7d45c99630c

  • SHA256

    4ef2f891081c62206d7277e2962377b3914da6f3d8912f56f415ec32474069a4

  • SHA512

    57aec652d34f0db9276908facc1faa3647a9464ba362055281fe6f04916d6f579e6f7f506903b4484d076e8d585e3c8cb6dade912e60543a6ddefd707aa3f9dd

  • SSDEEP

    12288:YTEYAsROAsrt/uxduo1jB0Y96qTqQaSMpyYCHopdCln3EWp5XdUHtY5:YwT7rC6q1aTpyYCHyIln3EWp5AY5

Score
10/10

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects Eternity stealer 1 IoCs
  • Eternity

    Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Autofarm.exe
    "C:\Users\Admin\AppData\Local\Temp\Autofarm.exe"
    1⤵
      PID:3752
      • C:\Users\Admin\AppData\Local\Temp\dcd.exe
        "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
        2⤵
          PID:3760
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          2⤵
            PID:3184

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qvakuzqp.5cy.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\dcd.exe

          Filesize

          227KB

          MD5

          b5ac46e446cead89892628f30a253a06

          SHA1

          f4ad1044a7f77a1b02155c3a355a1bb4177076ca

          SHA256

          def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

          SHA512

          bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

        • memory/3184-28-0x00007FFAF7EC0000-0x00007FFAF8981000-memory.dmp

          Filesize

          10.8MB

        • memory/3184-23-0x00007FFAF7EC0000-0x00007FFAF8981000-memory.dmp

          Filesize

          10.8MB

        • memory/3184-24-0x000002291E490000-0x000002291E4A0000-memory.dmp

          Filesize

          64KB

        • memory/3184-25-0x000002291E490000-0x000002291E4A0000-memory.dmp

          Filesize

          64KB

        • memory/3184-18-0x000002291ED80000-0x000002291EDA2000-memory.dmp

          Filesize

          136KB

        • memory/3752-7-0x00000000031E0000-0x00000000031F0000-memory.dmp

          Filesize

          64KB

        • memory/3752-3-0x0000000003140000-0x000000000317E000-memory.dmp

          Filesize

          248KB

        • memory/3752-4-0x00007FFAF7EC0000-0x00007FFAF8981000-memory.dmp

          Filesize

          10.8MB

        • memory/3752-5-0x0000000001870000-0x0000000001871000-memory.dmp

          Filesize

          4KB

        • memory/3752-6-0x00000000031E0000-0x00000000031F0000-memory.dmp

          Filesize

          64KB

        • memory/3752-0-0x0000000000EA0000-0x0000000000F8A000-memory.dmp

          Filesize

          936KB

        • memory/3752-8-0x00000000031E0000-0x00000000031F0000-memory.dmp

          Filesize

          64KB

        • memory/3752-2-0x0000000003190000-0x00000000031E0000-memory.dmp

          Filesize

          320KB

        • memory/3752-1-0x00007FFAF7EC0000-0x00007FFAF8981000-memory.dmp

          Filesize

          10.8MB

        • memory/3752-29-0x00007FFAF7EC0000-0x00007FFAF8981000-memory.dmp

          Filesize

          10.8MB