eternity | 74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 00:51

Target

74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956.exe
Size

85KB
MD5

fdb770a6834e45dcdf3dec3d75fcb010
SHA1

44e017fc0b947ccae09eab062ab1db21863a8d7a
SHA256

74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956
SHA512

ba6ae780f6c7a8fdc7a08b4d6319f409a80bb85cea81c78a5ebb73649979943e76abad3d840c1594a42747070bf98eceb7012487a00f9198588846b4af6263ab
SSDEEP

768:pNztCnTDleI2ySsXm8XVMdOcdRHCB74gEpM86j3ArR5s1s9naW+9SLf:p9tCXUj8X2dRiqKwdy1s9a3SLf

Score

10^/10

eternity

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
2708	1848	WerFault.exe	27

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956.exe

description	pid	Process	procid_target
PID 1848 wrote to memory of 1276	1848	74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956.exe	28
PID 1848 wrote to memory of 1276	1848	74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956.exe	28
PID 1848 wrote to memory of 1276	1848	74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956.exe	28
PID 1848 wrote to memory of 1276	1848	74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956.exe	28
PID 1848 wrote to memory of 2708	1848	74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956.exe	29
PID 1848 wrote to memory of 2708	1848	74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956.exe	29
PID 1848 wrote to memory of 2708	1848	74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956.exe	29
PID 1848 wrote to memory of 2708	1848	74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956.exe	29

C:\Users\Admin\AppData\Local\Temp\74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956.exe
"C:\Users\Admin\AppData\Local\Temp\74be0d76b6d5bb13fd23b45da5410903f38fb4810db8446fc60d5ad7f66a8956.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Columns-Win8.txt
  2⤵
  PID:1276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 916
  2⤵
  - Program crash
  PID:2708

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\Columns-Win8.txt

Filesize
19KB

MD5
fa81a1f4fc2a2a09450de6f03afdd94c

SHA1
167fc7cbb3ff100138159016048bcf602698e2cd

SHA256
469ef7a936b812f6460d9ed5568d43aa6d6ad7586981f3902da00155d86d25ff

SHA512
193ca512bac3b456d348c6e793fd37170e534c2f5c4c0bc24d94d3431d0cdeaf52262d1f78b77bf0911fb75fcf2f4202753c6a37e4f7fe9d7d87e640e9e12ca9

Download Submit
memory/1848-0-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

Filesize
4KB

Download
memory/1848-1-0x0000000000EE0000-0x0000000000EFA000-memory.dmp

Filesize
104KB

Download
memory/1848-4-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download
memory/1848-8-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

Filesize
4KB

Download
memory/1848-9-0x0000000074BF0000-0x00000000752DE000-memory.dmp

Filesize
6.9MB

Download