eternity | 971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe
Size

183KB
MD5

3ea066442da47bca9415f300634a5f43
SHA1

63d1f66d5e0df698b2a0a9bce9c6d3847511605d
SHA256

971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6
SHA512

a486a448effc1d60a31aed7d53ca6d23315e22aff3914906b38632f7152b395eebf908fe691b5ab8fe26bbf7a478e9a07b2782558591f53e2b6dc8bf87073d80
SSDEEP

3072:gxOSlfYnjR33O9K5tvgik+/LUHc0JvHNfHIP0TmvSJiwp9fe/UcV9e/RtUGu:uFl6dnO9Kb2uLqvp1Tm4iwKscS/T

Score

10^/10

eternity

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\Control Panel\International\Geo\Nation	971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe

Executes dropped EXE 1 IoCs

pid	Process
744	NSudo_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4088	4388	WerFault.exe	83

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 744	4388	971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe	87
PID 4388 wrote to memory of 744	4388	971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe	87

C:\Users\Admin\AppData\Local\Temp\971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe
"C:\Users\Admin\AppData\Local\Temp\971c99ff95a6299049b863bcec78fea14e528fe85035ae82be6022e52696d3d6.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Users\Admin\AppData\Local\Temp\NSudo_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\NSudo_x64.exe"
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 1228
  2⤵
  - Program crash
  PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4388 -ip 4388
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NSudo_x64.exe

Filesize
156KB

MD5
7aacfd85b8dff0aa6867bede82cfd147

SHA1
e783f6d4b754ea8424699203b8831bdc9cbdd4e6

SHA256
871e4f28fe39bcad8d295ae46e148be458778c0195ed660b7db18eb595d00bd8

SHA512
59cce358c125368dc5735a28960ddb7ee49835ca19f44255a7ae858ddd8a2db68c72c3f6818eca3678d989041043876e339f9fafe1d81d26001286494a8014f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp2B39.tmp.exe

Filesize
5KB

MD5
24c482e9a8094deba0e5d2e85046727c

SHA1
1882cca51c567bc9bd7504a2555e6c366cbe80fa

SHA256
91e823c85cebafefd6ca98759234f1dca7a3585d7d0fbafe4463664197d9d8e5

SHA512
877158427e3fa8a3539d64f0b9994409d3c3a2c6920823827c6b11fa52001f1ef69999bafafbee6a63a0ab38ed94b0a03ae71994f4fdb78e223156fee1ac0cd8

Download Submit
memory/4388-0-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/4388-1-0x0000000000890000-0x00000000008C4000-memory.dmp

Filesize
208KB

Download
memory/4388-3-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/4388-22-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download