eternity | 64e5cdc2db9de2fbf02af5e9ca503e91aef4e42bc595b5c0e551becb5128c7ed

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 18:30

Target

4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe
Size

887KB
MD5

4244fe804871d1b2f6f78a3003b74f00
SHA1

153c55ee132e64c31d71032d26febd7cc78b6676
SHA256

64e5cdc2db9de2fbf02af5e9ca503e91aef4e42bc595b5c0e551becb5128c7ed
SHA512

e8507c6ecddec6f9fbafaf9f27fbdcf38350730fe692d72491bf049765c062b10a4f29935c59150d15a41bc6b37e01ff64567ac54e5ad08948db214ee5be78fd
SSDEEP

24576:YwT7rC6qea7TlUg217ODWbR3KlE39jeP:prC6qeaVU17AWN3KlGo

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/1228-1-0x0000000000EB0000-0x0000000000F96000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Executes dropped EXE 1 IoCs

pid	Process
3204	dcd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1228	4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 3204	1228	4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe	85
PID 1228 wrote to memory of 3204	1228	4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe	85
PID 1228 wrote to memory of 3204	1228	4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe	85

C:\Users\Admin\AppData\Local\Temp\4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4244fe804871d1b2f6f78a3003b74f00_NeikiAnalytics.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:3204

C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
memory/1228-0-0x00007FFB95F03000-0x00007FFB95F05000-memory.dmp

Filesize
8KB

Download
memory/1228-1-0x0000000000EB0000-0x0000000000F96000-memory.dmp

Filesize
920KB

Download
memory/1228-2-0x0000000001C90000-0x0000000001CE0000-memory.dmp

Filesize
320KB

Download
memory/1228-3-0x000000001BE20000-0x000000001BE5E000-memory.dmp

Filesize
248KB

Download
memory/1228-4-0x00007FFB95F00000-0x00007FFB969C1000-memory.dmp

Filesize
10.8MB

Download
memory/1228-5-0x00007FFB95F00000-0x00007FFB969C1000-memory.dmp

Filesize
10.8MB

Download
memory/1228-10-0x00007FFB95F00000-0x00007FFB969C1000-memory.dmp

Filesize
10.8MB

Download