Analysis
-
max time kernel
891s -
max time network
446s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-01-2025 14:26
Behavioral task
behavioral1
Sample
Eternity.exe
Resource
win10ltsc2021-20241211-en
General
-
Target
Eternity.exe
-
Size
40.8MB
-
MD5
40f0212fa97e2fe44ee0fbffae0c96b5
-
SHA1
e11664504e7b3ab905de8069e6fb5b1159aec002
-
SHA256
32d38e1eae86466254658d5a91a8bca983706b3aec35148012cb0a50f550a74f
-
SHA512
2eeebc345f202033762cfa1e5ae4a2b2f477dad7e7019e5aff7b3aff98d0a9ee7c2223a94dfb6cc1a6fd66eb0290adee3baa1fda8d99658253c005ca11f425f5
-
SSDEEP
786432:gHvsyBy7Mu30RSVRAaAeQc98NmhJQ8mZoJRWUmx2qmE:gUyCMrUVKa/bhJQ8mZorV+
Malware Config
Signatures
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Eternity family
-
Growtopia family
-
Loads dropped DLL 1 IoCs
pid Process 3124 Eternity.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Eternity.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3124 Eternity.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5e13ef136485a33c8a5b719d75b0312df
SHA1fb692915b0a73e796c5904e05d37f963baef88dd
SHA2569d2d83667ab5c391fbb60a1249078d0e2b031573a72dc07b67b610178ee94e78
SHA512b3d58a11fc17925316f437e67d4b394bb9b5749e92064fe87eda3e12962f3970416e180cd40c61419651ec611eae0ee9f91a795199689cdd4743678bb6d3dca2