eternity | 971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 02:12

Target

971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe
Size

183KB
MD5

3ea066442da47bca9415f300634a5f43
SHA1

63d1f66d5e0df698b2a0a9bce9c6d3847511605d
SHA256

971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6
SHA512

a486a448effc1d60a31aed7d53ca6d23315e22aff3914906b38632f7152b395eebf908fe691b5ab8fe26bbf7a478e9a07b2782558591f53e2b6dc8bf87073d80
SSDEEP

3072:gxOSlfYnjR33O9K5tvgik+/LUHc0JvHNfHIP0TmvSJiwp9fe/UcV9e/RtUGu:uFl6dnO9Kb2uLqvp1Tm4iwKscS/T

Score

10^/10

eternity

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Executes dropped EXE 2 IoCs

Processes:

NSudo_x64.exe

pid process

2916 NSudo_x64.exe
1196
Loads dropped DLL 2 IoCs

Processes:

971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe

pid process

2152 971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe
1196
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2580 2152 WerFault.exe 971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe

pid	process
2916	NSudo_x64.exe
1196

pid	process
2152	971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe
1196

pid	pid_target	process	target process
2580	2152	WerFault.exe	971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe

description	pid	process	target process
PID 2152 wrote to memory of 2916	2152	971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe	NSudo_x64.exe
PID 2152 wrote to memory of 2916	2152	971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe	NSudo_x64.exe
PID 2152 wrote to memory of 2916	2152	971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe	NSudo_x64.exe
PID 2152 wrote to memory of 2916	2152	971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe	NSudo_x64.exe
PID 2152 wrote to memory of 2580	2152	971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe	WerFault.exe
PID 2152 wrote to memory of 2580	2152	971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe	WerFault.exe
PID 2152 wrote to memory of 2580	2152	971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe	WerFault.exe
PID 2152 wrote to memory of 2580	2152	971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe
"C:\Users\Admin\AppData\Local\Temp\971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\NSudo_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\NSudo_x64.exe"
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 924
  2⤵
  - Program crash
  PID:2580

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\NSudo_x64.exe

Filesize
156KB

MD5
7aacfd85b8dff0aa6867bede82cfd147

SHA1
e783f6d4b754ea8424699203b8831bdc9cbdd4e6

SHA256
871e4f28fe39bcad8d295ae46e148be458778c0195ed660b7db18eb595d00bd8

SHA512
59cce358c125368dc5735a28960ddb7ee49835ca19f44255a7ae858ddd8a2db68c72c3f6818eca3678d989041043876e339f9fafe1d81d26001286494a8014f0

Download Submit
memory/2152-0-0x000000007493E000-0x000000007493F000-memory.dmp

Filesize
4KB

Download
memory/2152-1-0x0000000001240000-0x0000000001274000-memory.dmp

Filesize
208KB

Download
memory/2152-3-0x0000000074930000-0x000000007501E000-memory.dmp

Filesize
6.9MB

Download
memory/2152-14-0x000000007493E000-0x000000007493F000-memory.dmp

Filesize
4KB

Download
memory/2152-15-0x0000000074930000-0x000000007501E000-memory.dmp

Filesize
6.9MB

Download
memory/2916-9-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download