Analysis
-
max time kernel
135s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
25-04-2024 12:29
General
-
Target
Project_Eternity.exe
-
Size
950KB
-
MD5
1dc77ddaa75048f165dde554875287ca
-
SHA1
0368ce19a51729f7845edbf3f5d2f548da725b91
-
SHA256
5bc85998297268f204aa20f24036cc966069ba9540513ecc8b28555bd3f68e35
-
SHA512
58f06c1f38919715e5207d4bda5c8a05af41b06246e1cbb29cc417d5a568e12bf7f322207f3de4e2aaf5fb8c2ff9bc1d864287f81a93d87c307c4241728a59ff
-
SSDEEP
24576:DwT7rC6q3GRUSNeuCOJd6GN2LhKyA4hU:KrC6qW0uRdDN2L3u
Malware Config
Signatures
-
Detects Eternity stealer 1 IoCs
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 29 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Project_Eternity.exe"C:\Users\Admin\AppData\Local\Temp\Project_Eternity.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dcd.exe"C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD5b5ac46e446cead89892628f30a253a06
SHA1f4ad1044a7f77a1b02155c3a355a1bb4177076ca
SHA256def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669
SHA512bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87
-
Filesize
952KB
-
Filesize
9.9MB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB