Analysis
- max time kernel
0s - max time network
27s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/03/2024, 22:56
General
- Target Autofarm.exe
- Size 902KB
- Sample240309-2wtdtsdb77
- SHA256 4ef2f891081c62206d7277e2962377b3914da6f3d8912f56f415ec32474069a4
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detects Eternity stealer 1 IoCs
- Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Autofarm.exe"C:\Users\Admin\AppData\Local\Temp\Autofarm.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\dcd.exe"C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_qvakuzqp.5cy.ps1
dcd.exe
memory/3184-28-0x00007FFAF7EC0000-0x00007FFAF8981000-memory.dmp
memory/3184-23-0x00007FFAF7EC0000-0x00007FFAF8981000-memory.dmp
memory/3184-24-0x000002291E490000-0x000002291E4A0000-memory.dmp
memory/3184-25-0x000002291E490000-0x000002291E4A0000-memory.dmp
memory/3184-18-0x000002291ED80000-0x000002291EDA2000-memory.dmp
memory/3752-7-0x00000000031E0000-0x00000000031F0000-memory.dmp
memory/3752-3-0x0000000003140000-0x000000000317E000-memory.dmp
memory/3752-4-0x00007FFAF7EC0000-0x00007FFAF8981000-memory.dmp
memory/3752-5-0x0000000001870000-0x0000000001871000-memory.dmp
memory/3752-6-0x00000000031E0000-0x00000000031F0000-memory.dmp
memory/3752-0-0x0000000000EA0000-0x0000000000F8A000-memory.dmp
memory/3752-8-0x00000000031E0000-0x00000000031F0000-memory.dmp
memory/3752-2-0x0000000003190000-0x00000000031E0000-memory.dmp
memory/3752-1-0x00007FFAF7EC0000-0x00007FFAF8981000-memory.dmp
memory/3752-29-0x00007FFAF7EC0000-0x00007FFAF8981000-memory.dmp