eternity | 9bca0051537823f2c31bebafa453130a549599f825241423c6bc8d8c6aa49f71

General

Target

P90P_PROXY.exe
Size

905KB
MD5

551cd8e5461c68ec23ec11eab941c262
SHA1

bf16424415ff1562fa442981ed9f84cc167cab07
SHA256

9bca0051537823f2c31bebafa453130a549599f825241423c6bc8d8c6aa49f71
SHA512

52c645bbc7ab74588b3715d181f9412762f071fbc6ba5845b4b1eaf92b530f8835b4ed960f76a4b962fe3d48bd18844a79fa9557a26ae866f038526efcd40de7
SSDEEP

12288:vTEYAsROAsrt/uxduo1jB0Y96q1CCgLbY/0PejVdoXvvGabyl2OswS50LHvbdu+:vwT7rC6q1CZLoLzSylbswS54T1

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2424-1-0x0000000000D60000-0x0000000000E4A000-memory.dmp	disable_win_def

Detects Eternity stealer 1 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2424-1-0x0000000000D60000-0x0000000000E4A000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

P90P_PROXY.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	P90P_PROXY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	P90P_PROXY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	P90P_PROXY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	P90P_PROXY.exe

Disables Task Manager via registry modification
evasion

Drops startup file 2 IoCs

Processes:

P90P_PROXY.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\P90P_PROXY.exe	P90P_PROXY.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\P90P_PROXY.exe	P90P_PROXY.exe

Executes dropped EXE 1 IoCs

Processes:

dcd.exe

pid process

3032 dcd.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

P90P_PROXY.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features P90P_PROXY.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2776 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

P90P_PROXY.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2424 P90P_PROXY.exe
Token: SeDebugPrivilege 2776 powershell.exe

pid	process
3032	dcd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	P90P_PROXY.exe

pid	process
2776	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2424	P90P_PROXY.exe
Token: SeDebugPrivilege	2776	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

P90P_PROXY.exe

description	pid	process	target process
PID 2424 wrote to memory of 3032	2424	P90P_PROXY.exe	dcd.exe
PID 2424 wrote to memory of 3032	2424	P90P_PROXY.exe	dcd.exe
PID 2424 wrote to memory of 3032	2424	P90P_PROXY.exe	dcd.exe
PID 2424 wrote to memory of 3032	2424	P90P_PROXY.exe	dcd.exe
PID 2424 wrote to memory of 2776	2424	P90P_PROXY.exe	powershell.exe
PID 2424 wrote to memory of 2776	2424	P90P_PROXY.exe	powershell.exe
PID 2424 wrote to memory of 2776	2424	P90P_PROXY.exe	powershell.exe
PID 2424 wrote to memory of 1744	2424	P90P_PROXY.exe	WerFault.exe
PID 2424 wrote to memory of 1744	2424	P90P_PROXY.exe	WerFault.exe
PID 2424 wrote to memory of 1744	2424	P90P_PROXY.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\P90P_PROXY.exe
"C:\Users\Admin\AppData\Local\Temp\P90P_PROXY.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Drops startup file
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2424 -s 1552
  2⤵
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
memory/2424-3-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

Filesize
9.9MB

Download
memory/2424-2-0x0000000000520000-0x000000000055E000-memory.dmp

Filesize
248KB

Download
memory/2424-0-0x000007FEF5FE3000-0x000007FEF5FE4000-memory.dmp

Filesize
4KB

Download
memory/2424-4-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

Filesize
9.9MB

Download
memory/2424-5-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

Filesize
9.9MB

Download
memory/2424-1-0x0000000000D60000-0x0000000000E4A000-memory.dmp

Filesize
936KB

Download
memory/2424-11-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

Filesize
9.9MB

Download
memory/2424-21-0x000007FEF5FE3000-0x000007FEF5FE4000-memory.dmp

Filesize
4KB

Download
memory/2424-22-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

Filesize
9.9MB

Download
memory/2424-23-0x000007FEF5FE0000-0x000007FEF69CC000-memory.dmp

Filesize
9.9MB

Download
memory/2776-16-0x0000000002ED0000-0x0000000002F50000-memory.dmp

Filesize
512KB

Download
memory/2776-17-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2776-18-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads