eternity | 64e5cdc2db9de2fbf02af5e9ca503e91aef4e42bc595b5c0e551becb5128c7ed

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 18:30

Target

4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe
Size

887KB
MD5

4244fe804871d1b2f6f78a3003b74f00
SHA1

153c55ee132e64c31d71032d26febd7cc78b6676
SHA256

64e5cdc2db9de2fbf02af5e9ca503e91aef4e42bc595b5c0e551becb5128c7ed
SHA512

e8507c6ecddec6f9fbafaf9f27fbdcf38350730fe692d72491bf049765c062b10a4f29935c59150d15a41bc6b37e01ff64567ac54e5ad08948db214ee5be78fd
SSDEEP

24576:YwT7rC6qea7TlUg217ODWbR3KlE39jeP:prC6qeaVU17AWN3KlGo

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/2032-1-0x0000000000940000-0x0000000000A26000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Executes dropped EXE 1 IoCs

pid	Process
1100	dcd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1100	2032	4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe	28
PID 2032 wrote to memory of 1100	2032	4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe	28
PID 2032 wrote to memory of 1100	2032	4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe	28
PID 2032 wrote to memory of 1100	2032	4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe	28
PID 2032 wrote to memory of 2656	2032	4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe	29
PID 2032 wrote to memory of 2656	2032	4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe	29
PID 2032 wrote to memory of 2656	2032	4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe	29

C:\Users\Admin\AppData\Local\Temp\4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2032 -s 1528
  2⤵
  PID:2656

C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
memory/2032-0-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download
memory/2032-1-0x0000000000940000-0x0000000000A26000-memory.dmp

Filesize
920KB

Download
memory/2032-2-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2032-3-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2032-4-0x0000000000260000-0x000000000029E000-memory.dmp

Filesize
248KB

Download
memory/2032-5-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2032-6-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2032-7-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2032-13-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download
memory/2032-14-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download