eternity | d44006982388af1f774550e394ebc9a613bbccd2e0dbedfdac871fee1872ad96

Resubmissions

30-05-2024 08:19

240530-j76t7acf66 10

30-05-2024 08:16

240530-j6cjyscf33 10

30-05-2024 08:10

240530-j244eabe3t 10

30-05-2024 07:54

240530-jrx74scc37 10

Analysis

max time kernel
0s
max time network
5s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
30-05-2024 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Growtoken.exe
Size

1.2MB
MD5

b4fd82d36033b222e24a3bebb36160c2
SHA1

f0834b6a9fe196eff0df953a8054f0cc16d31b5e
SHA256

d44006982388af1f774550e394ebc9a613bbccd2e0dbedfdac871fee1872ad96
SHA512

3bc7a33310105b1a3a882e7e407de49bdb11cf8d8360d4b56d2908fc3b8d075cecb2d198803a78cde132432efd9920ebfd3ebdb3c9dd1d7dd4f3061103240b74
SSDEEP

12288:XTEYAsROAsrt/uxduo1jB0Y96qlBBScaepDkNDFTK/6AHR2MZ/Rev0HMpHqEc:XwT7rC6qpScJpMuSCR1ZevuEqE

Score

10^/10

eternity stealer

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/memory/3068-1-0x0000000000B40000-0x0000000000C4E000-memory.dmp	disable_win_def

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral2/memory/3068-1-0x0000000000B40000-0x0000000000C4E000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	Growtoken.exe

C:\Users\Admin\AppData\Local\Temp\Growtoken.exe
"C:\Users\Admin\AppData\Local\Temp\Growtoken.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3068
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  PID:4696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z1tl12qd.2lq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
memory/3068-4-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp

Filesize
10.8MB

Download
memory/3068-1-0x0000000000B40000-0x0000000000C4E000-memory.dmp

Filesize
1.1MB

Download
memory/3068-0-0x00007FFD2F253000-0x00007FFD2F255000-memory.dmp

Filesize
8KB

Download
memory/3068-5-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp

Filesize
10.8MB

Download
memory/3068-6-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp

Filesize
10.8MB

Download
memory/3068-2-0x000000001B870000-0x000000001B8C0000-memory.dmp

Filesize
320KB

Download
memory/3068-11-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp

Filesize
10.8MB

Download
memory/3068-12-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp

Filesize
10.8MB

Download
memory/3068-13-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp

Filesize
10.8MB

Download
memory/3068-3-0x000000001B820000-0x000000001B85E000-memory.dmp

Filesize
248KB

Download
memory/4696-14-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp

Filesize
10.8MB

Download
memory/4696-24-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp

Filesize
10.8MB

Download
memory/4696-23-0x000001F1295F0000-0x000001F129612000-memory.dmp

Filesize
136KB

Download
memory/4696-25-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp

Filesize
10.8MB

Download
memory/4696-26-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp

Filesize
10.8MB

Download
memory/4696-27-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp

Filesize
10.8MB

Download
memory/4696-30-0x00007FFD2F250000-0x00007FFD2FD12000-memory.dmp

Filesize
10.8MB

Download