Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 19:46
Behavioral task
behavioral1
Sample
BruteForcer V1/BruteForce.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
BruteForcer V1/BruteForce.exe
-
Size
1.2MB
-
MD5
fa11a8ae74dd3752193ddf503601ffdd
-
SHA1
f34a69973f37dbc0ccd1b9c8325642400b23b6e5
-
SHA256
c109b3abe23923e425df417524dcf7b27773f5acf256e8be5a5587e16843944b
-
SHA512
204918728747d7bb7318b77da55e7e1d15e390fe00bc9bc53062431e746111a19904ed3f8222d7196a1a1b6118c39019f6638cf2e72eb181c34bc436e50e7f9b
-
SSDEEP
24576:SwT7rC6qbvVo15SKjNlYP6r8EsotvVo15S:brC6q7VoLS2y5EVoLS
Malware Config
Signatures
-
Detects Eternity stealer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/364-1-0x0000000000990000-0x0000000000A94000-memory.dmp eternity_stealer -
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
BruteForce.exedescription pid process Token: SeDebugPrivilege 364 BruteForce.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BruteForcer V1\BruteForce.exe"C:\Users\Admin\AppData\Local\Temp\BruteForcer V1\BruteForce.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:364
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3976,i,1999448010053300448,1112699187621658374,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:81⤵PID:2992