eternity | a22b363a7dce6163c6338ece398265d8d166bc232466619c9a3e45f4530600b8

General

Target

Eternity.zip
Size

35.0MB
MD5

087e21b251a1567c10526376837a4bbc
SHA1

802ca49bfb4fa037608cc210344479e26c92a9fe
SHA256

a22b363a7dce6163c6338ece398265d8d166bc232466619c9a3e45f4530600b8
SHA512

733b9ba11aeb8d089665dc018bba0b6f9723b5a215a8fc77ac748bbf3af3dd77d114f984d821824d16d28a8be014bc781146e43d05e84fb23c9c1a033cb54424
SSDEEP

786432:yhUT6NDYZyaFEPdjHmHkxDrXDxgqiJ4B56ww6aGfk4:kUTqIydpmMDxgqiJ471w6aGfx

Score

10^/10

eternity growtopia discovery stealer

Malware Config

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
Executes dropped EXE 1 IoCs

Processes:

Eternity.exe

pid process

4868 Eternity.exe

Loads dropped DLL 9 IoCs

Processes:

Eternity.exe

pid	process
4868	Eternity.exe
4868	Eternity.exe
4868	Eternity.exe
4868	Eternity.exe
4868	Eternity.exe
4868	Eternity.exe
4868	Eternity.exe
4868	Eternity.exe
4868	Eternity.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

Eternity.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eternity.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

7zFM.exe

pid process

4464 7zFM.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Eternity.exe

pid	process
4464	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

7zFM.exeEternity.exe

description	pid	process
Token: SeRestorePrivilege	4464	7zFM.exe
Token: 35	4464	7zFM.exe
Token: SeSecurityPrivilege	4464	7zFM.exe
Token: SeDebugPrivilege	4868	Eternity.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

7zFM.exe

pid process

4464 7zFM.exe
4464 7zFM.exe

pid	process
4464	7zFM.exe
4464	7zFM.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Eternity.zip
1⤵
PID:5080

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5000

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Eternity.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4464

C:\Users\Admin\Desktop\Eternity.exe
"C:\Users\Admin\Desktop\Eternity.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\enet_managed_resource\enet-win32-x86.dll

Filesize
39KB

MD5
e13ef136485a33c8a5b719d75b0312df

SHA1
fb692915b0a73e796c5904e05d37f963baef88dd

SHA256
9d2d83667ab5c391fbb60a1249078d0e2b031573a72dc07b67b610178ee94e78

SHA512
b3d58a11fc17925316f437e67d4b394bb9b5749e92064fe87eda3e12962f3970416e180cd40c61419651ec611eae0ee9f91a795199689cdd4743678bb6d3dca2

Download Submit
C:\Users\Admin\Desktop\Bunifu.dll

Filesize
232KB

MD5
a956773892ea3bb538c4656475c35126

SHA1
e2cc84075cd18b96623fd29d529873f379e398c2

SHA256
d95d7cdb4a549a7f9a06c9059027bd90e926a15b21f118a59536ee9b5febb768

SHA512
d376b8700d2461e63c4da6fc0dedcc33aa44dca4766fa50fa2cc4475d8bb00fc919568967a2f3b250b8f40a3e45bf48421f3b7f35e081a55805683f3092645e7

Download Submit
C:\Users\Admin\Desktop\DiscordRPC.dll

Filesize
82KB

MD5
3956130e36754f184a0443c850f708f8

SHA1
4874cd51b0fa5652ed84e3b0c123bee05dcdffc8

SHA256
25c39f91f737d80040c72c9e3f95db0fece1c9653f501828adc16cfb1ec59d26

SHA512
157143dd69378e9914ddbb934229cfbc99ae7d80f4f787b7799fc254054d2c7b1e6f4551cddea30470e28b61309f858fcdb2d009b1c32953dfe5ea7fe78e9e48

Download Submit
C:\Users\Admin\Desktop\ENet.Managed.dll

Filesize
827KB

MD5
816a81ac833687f237182ad574a4d6b2

SHA1
53f1ab89e3ceccf0293eeb0b86679e1cc0cc85aa

SHA256
8b75146db5dc7240ab1c3369aa424568a83bb73ae74eb8e8a79b7f440242daa7

SHA512
859f84b4fa1291fd094f31843ebb39f41c926d766d770b07df845c6c08686766166a9b15817f24cd160e659904d4d3865b4daf584400e77c72af3e815bd16378

Download Submit
C:\Users\Admin\Desktop\Eternity.exe

Filesize
40.8MB

MD5
40f0212fa97e2fe44ee0fbffae0c96b5

SHA1
e11664504e7b3ab905de8069e6fb5b1159aec002

SHA256
32d38e1eae86466254658d5a91a8bca983706b3aec35148012cb0a50f550a74f

SHA512
2eeebc345f202033762cfa1e5ae4a2b2f477dad7e7019e5aff7b3aff98d0a9ee7c2223a94dfb6cc1a6fd66eb0290adee3baa1fda8d99658253c005ca11f425f5

Download Submit
C:\Users\Admin\Desktop\Newtonsoft.Json.dll

Filesize
695KB

MD5
195ffb7167db3219b217c4fd439eedd6

SHA1
1e76e6099570ede620b76ed47cf8d03a936d49f8

SHA256
e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

SHA512
56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

Download Submit
memory/4868-23-0x000000000AB10000-0x000000000ABA2000-memory.dmp

Filesize
584KB

Download
memory/4868-28-0x000000000AAD0000-0x000000000AAD8000-memory.dmp

Filesize
32KB

Download
memory/4868-27-0x000000000AC90000-0x000000000AD66000-memory.dmp

Filesize
856KB

Download
memory/4868-36-0x0000000003300000-0x000000000331A000-memory.dmp

Filesize
104KB

Download
memory/4868-22-0x000000000AFB0000-0x000000000B554000-memory.dmp

Filesize
5.6MB

Download
memory/4868-21-0x0000000009660000-0x000000000AA00000-memory.dmp

Filesize
19.6MB

Download
memory/4868-40-0x000000000B720000-0x000000000B7D2000-memory.dmp

Filesize
712KB

Download
memory/4868-41-0x000000000AF90000-0x000000000AF9A000-memory.dmp

Filesize
40KB

Download
memory/4868-20-0x00000000000C0000-0x0000000002950000-memory.dmp

Filesize
40.6MB

Download
memory/4868-45-0x000000000B6A0000-0x000000000B6E0000-memory.dmp

Filesize
256KB

Download
memory/4868-46-0x000000006EFC0000-0x000000006EFD2000-memory.dmp

Filesize
72KB

Download
memory/4868-53-0x0000000003000000-0x0000000003022000-memory.dmp

Filesize
136KB

Download
memory/4868-54-0x0000000008060000-0x00000000083B4000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing