eternity | 3b9604c120d0b0466510ebb572f7f715670d62dfa4ffecb057b860322a5ecdd1

Analysis

max time kernel
143s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07-05-2024 02:06

Target

4d420967fe786c9439e3cc442f5f0be0_NEAS.exe
Size

885KB
MD5

4d420967fe786c9439e3cc442f5f0be0
SHA1

77c27142d0457d97662fe36982584441993ba441
SHA256

3b9604c120d0b0466510ebb572f7f715670d62dfa4ffecb057b860322a5ecdd1
SHA512

52193c0336b306f65750195fcc5495a70e9285b3ca0a04708b9880f46149ed7072a3d2c3b1bbe830ec37d1d566be5e5c8c82bcf6c5651e57635f1d4aac82c037
SSDEEP

12288:qTEYAsROAsrt/uxduo1jB0Y96qrQH+KQQhcMDSC4E3Q5GSCJQ8KhOj4TgP:qwT7rC6qE1QQhDSC4naQ8o7Tg

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/932-1-0x0000000000BF0000-0x0000000000CD6000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Executes dropped EXE 1 IoCs

pid	Process
2100	dcd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	4d420967fe786c9439e3cc442f5f0be0_NEAS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 2100	932	4d420967fe786c9439e3cc442f5f0be0_NEAS.exe	86
PID 932 wrote to memory of 2100	932	4d420967fe786c9439e3cc442f5f0be0_NEAS.exe	86
PID 932 wrote to memory of 2100	932	4d420967fe786c9439e3cc442f5f0be0_NEAS.exe	86

C:\Users\Admin\AppData\Local\Temp\4d420967fe786c9439e3cc442f5f0be0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\4d420967fe786c9439e3cc442f5f0be0_NEAS.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:2100

C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
memory/932-0-0x00007FF8598C3000-0x00007FF8598C5000-memory.dmp

Filesize
8KB

Download
memory/932-1-0x0000000000BF0000-0x0000000000CD6000-memory.dmp

Filesize
920KB

Download
memory/932-2-0x000000001B800000-0x000000001B850000-memory.dmp

Filesize
320KB

Download
memory/932-3-0x0000000002DC0000-0x0000000002DFE000-memory.dmp

Filesize
248KB

Download
memory/932-4-0x00007FF8598C0000-0x00007FF85A381000-memory.dmp

Filesize
10.8MB

Download
memory/932-5-0x00007FF8598C0000-0x00007FF85A381000-memory.dmp

Filesize
10.8MB

Download
memory/932-6-0x00007FF8598C0000-0x00007FF85A381000-memory.dmp

Filesize
10.8MB

Download
memory/932-11-0x00007FF8598C0000-0x00007FF85A381000-memory.dmp

Filesize
10.8MB

Download
memory/932-12-0x00007FF8598C0000-0x00007FF85A381000-memory.dmp

Filesize
10.8MB

Download