Analysis
-
max time kernel
0s -
max time network
27s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-03-2024 22:56
Behavioral task
behavioral1
Sample
Autofarm.exe
Resource
win7-20240221-en
General
-
Target
Autofarm.exe
-
Size
902KB
-
MD5
c83093e96402aaf8c5afe4c12d1d162d
-
SHA1
6b52e3cb21a3941c31da0dc3f559b7d45c99630c
-
SHA256
4ef2f891081c62206d7277e2962377b3914da6f3d8912f56f415ec32474069a4
-
SHA512
57aec652d34f0db9276908facc1faa3647a9464ba362055281fe6f04916d6f579e6f7f506903b4484d076e8d585e3c8cb6dade912e60543a6ddefd707aa3f9dd
-
SSDEEP
12288:YTEYAsROAsrt/uxduo1jB0Y96qTqQaSMpyYCHopdCln3EWp5XdUHtY5:YwT7rC6q1aTpyYCHyIln3EWp5AY5
Malware Config
Signatures
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/3752-0-0x0000000000EA0000-0x0000000000F8A000-memory.dmp disable_win_def -
Detects Eternity stealer 1 IoCs
resource yara_rule behavioral2/memory/3752-0-0x0000000000EA0000-0x0000000000F8A000-memory.dmp eternity_stealer -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Autofarm.exe"C:\Users\Admin\AppData\Local\Temp\Autofarm.exe"1⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\dcd.exe"C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""2⤵PID:3760
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵PID:3184
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
227KB
MD5b5ac46e446cead89892628f30a253a06
SHA1f4ad1044a7f77a1b02155c3a355a1bb4177076ca
SHA256def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669
SHA512bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87