eternity | 86289f4b9292304715c605f361a568875fd6e1e30d3b698a808a1b6dd4adae05

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 16:23

Target

ce8128d5ce8a1b454081c6758d5d61aa.exe
Size

881KB
MD5

ce8128d5ce8a1b454081c6758d5d61aa
SHA1

c79b30ed9bc368d283721ee8decfa1990d726ffa
SHA256

86289f4b9292304715c605f361a568875fd6e1e30d3b698a808a1b6dd4adae05
SHA512

c38a03cb046efadb1ef950645fe8d4de9c6ca4d8d7c5a1f6d61e3556cf919d8d128cffdb973cbbcc0fe19845a8035bc770d758564d0248aa90ced8a7e8cb6195
SSDEEP

12288:DTEYAsROAsrt/uxduo1jB0Y96qIAzYbG0Btwp1XcIpT++MWUD7PXGaT9/NbB:DwT7rC6qFQ9BoTK7/tPV

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/1988-0-0x0000000000CF0000-0x0000000000DD4000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ce8128d5ce8a1b454081c6758d5d61aa.exe	ce8128d5ce8a1b454081c6758d5d61aa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ce8128d5ce8a1b454081c6758d5d61aa.exe	ce8128d5ce8a1b454081c6758d5d61aa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	ce8128d5ce8a1b454081c6758d5d61aa.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2504	1988	ce8128d5ce8a1b454081c6758d5d61aa.exe	28
PID 1988 wrote to memory of 2504	1988	ce8128d5ce8a1b454081c6758d5d61aa.exe	28
PID 1988 wrote to memory of 2504	1988	ce8128d5ce8a1b454081c6758d5d61aa.exe	28

C:\Users\Admin\AppData\Local\Temp\ce8128d5ce8a1b454081c6758d5d61aa.exe
"C:\Users\Admin\AppData\Local\Temp\ce8128d5ce8a1b454081c6758d5d61aa.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1988 -s 756
  2⤵
  PID:2504

memory/1988-0-0x0000000000CF0000-0x0000000000DD4000-memory.dmp

Filesize
912KB

Download
memory/1988-1-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

Filesize
9.9MB

Download
memory/1988-2-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

Filesize
9.9MB

Download
memory/1988-3-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

Filesize
9.9MB

Download
memory/1988-4-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

Filesize
9.9MB

Download
memory/1988-5-0x000000001AA10000-0x000000001AA90000-memory.dmp

Filesize
512KB

Download
memory/1988-6-0x0000000000490000-0x00000000004CE000-memory.dmp

Filesize
248KB

Download
memory/1988-7-0x000000001AA10000-0x000000001AA90000-memory.dmp

Filesize
512KB

Download
memory/1988-10-0x000007FEF5980000-0x000007FEF636C000-memory.dmp

Filesize
9.9MB

Download
memory/1988-11-0x000000001AA10000-0x000000001AA90000-memory.dmp

Filesize
512KB

Download
memory/1988-12-0x000000001AA10000-0x000000001AA90000-memory.dmp

Filesize
512KB

Download