eternity | d4e0148bc263ae1265b5c5ba1a1d56661d7afda8c307c52e6f10e47f67921693

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SirWare.exe
Size

4.6MB
MD5

35091354095cf19568ed3174619d1c3e
SHA1

07a1b4569906e04fd6a9832bd4cf999a673f5ce0
SHA256

d4e0148bc263ae1265b5c5ba1a1d56661d7afda8c307c52e6f10e47f67921693
SHA512

fa4365f22291d51ff0fc1c6cd3d29d4fe5d77ff89120c54abece5a6cc42b34e1af124a2a4eca51e97c3ad47d03de3ceb3ccc110818d3b1af911f6b8533921e4f
SSDEEP

98304:brL3/7aNJIxFWP3/7a3/7dkYjLbOlZEfmEvjPVRF/z0A3/7:b3/7aNJCWP3/7a3/7FLb3fhF/zz3/7

Score

10^/10

eternity spyware stealer

Malware Config

Signatures

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/2060-1-0x0000000000D90000-0x00000000011F4000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SirWare.exe	SirWare.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SirWare.exe	SirWare.exe

Executes dropped EXE 3 IoCs

pid	Process
2540	SirWare.exe
2656	dcd.exe
1204	Process not Found

Loads dropped DLL 1 IoCs

pid	Process
2060	SirWare.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe
2540	SirWare.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	SirWare.exe
Token: SeDebugPrivilege	2540	SirWare.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2540	2060	SirWare.exe	28
PID 2060 wrote to memory of 2540	2060	SirWare.exe	28
PID 2060 wrote to memory of 2540	2060	SirWare.exe	28
PID 2060 wrote to memory of 2656	2060	SirWare.exe	29
PID 2060 wrote to memory of 2656	2060	SirWare.exe	29
PID 2060 wrote to memory of 2656	2060	SirWare.exe	29
PID 2060 wrote to memory of 2656	2060	SirWare.exe	29
PID 2060 wrote to memory of 2480	2060	SirWare.exe	30
PID 2060 wrote to memory of 2480	2060	SirWare.exe	30
PID 2060 wrote to memory of 2480	2060	SirWare.exe	30

C:\Users\Admin\AppData\Local\Temp\SirWare.exe
"C:\Users\Admin\AppData\Local\Temp\SirWare.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\ze0j1ima.kpn\SirWare.exe
  "C:\Users\Admin\AppData\Local\Temp\ze0j1ima.kpn\SirWare.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2060 -s 1880
  2⤵
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
\Users\Admin\AppData\Local\Temp\ze0j1ima.kpn\SirWare.exe

Filesize
1.6MB

MD5
5351af53824ae52d130328dd0f7b8617

SHA1
4bcbd7273737a2a5966f03085385d2057d17e911

SHA256
512ed4e003e35087f08c1a7a40b34ea56860cd8fa16ef0e48c5eaa3ebc4fa043

SHA512
e47f4b4bb569b79b8552fdc0de9648f8fb4ada78651d14dae3d296937627fe40400fc9a41834799dd6b2070d473380f6ebe6a5c670893df85e870af82d2c1d93

Download Submit
memory/2060-31-0x000007FEF5CD3000-0x000007FEF5CD4000-memory.dmp

Filesize
4KB

Download
memory/2060-0-0x000007FEF5CD3000-0x000007FEF5CD4000-memory.dmp

Filesize
4KB

Download
memory/2060-4-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-5-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-6-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-2-0x000000001B910000-0x000000001BAF2000-memory.dmp

Filesize
1.9MB

Download
memory/2060-35-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-32-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-27-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-1-0x0000000000D90000-0x00000000011F4000-memory.dmp

Filesize
4.4MB

Download
memory/2060-36-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2060-3-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2540-13-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2540-38-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2540-29-0x000000001D3B0000-0x000000001D460000-memory.dmp

Filesize
704KB

Download
memory/2540-15-0x0000000000970000-0x0000000000982000-memory.dmp

Filesize
72KB

Download
memory/2540-16-0x0000000000980000-0x000000000099A000-memory.dmp

Filesize
104KB

Download
memory/2540-18-0x00000000009D0000-0x00000000009FC000-memory.dmp

Filesize
176KB

Download
memory/2540-14-0x0000000000080000-0x0000000000228000-memory.dmp

Filesize
1.7MB

Download
memory/2540-19-0x0000000000C80000-0x0000000000D2A000-memory.dmp

Filesize
680KB

Download
memory/2540-17-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2540-21-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2540-20-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2540-37-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download
memory/2540-28-0x000000001B8D0000-0x000000001B8EA000-memory.dmp

Filesize
104KB

Download
memory/2540-39-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Filesize
9.9MB

Download