eternity | 5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de

Analysis

max time kernel
83s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 09:35

Target

5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe
Size

887KB
MD5

1679545bca2ccdf9eb9cdb5f1eec614a
SHA1

38ab76636e01272ade490a5de1b0eca54a42f6ba
SHA256

5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de
SHA512

655f5c03f411603c6806590f8569d2f1b3093c321430be644d95ec8d41dd1cd908250a1de39748a5970ffc8b0f213c398c7885e383cf3fb41fe81c1b369a4488
SSDEEP

24576:DwT7rC6qJfn+1RChT+BHubaRo6Mh/2aUUdt41:KrC6q5Go6Ma0W1

Score

10^/10

eternity stealer

Detects Eternity stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/memory/1548-1-0x0000000000860000-0x0000000000946000-memory.dmp	eternity_stealer

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Eternity family
eternity

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe	5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe	5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe

Executes dropped EXE 1 IoCs

pid	Process
3048	dcd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 3048	1548	5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe	31
PID 1548 wrote to memory of 3048	1548	5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe	31
PID 1548 wrote to memory of 3048	1548	5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe	31
PID 1548 wrote to memory of 3048	1548	5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe	31
PID 1548 wrote to memory of 1808	1548	5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe	32
PID 1548 wrote to memory of 1808	1548	5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe	32
PID 1548 wrote to memory of 1808	1548	5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe	32

C:\Users\Admin\AppData\Local\Temp\5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe
"C:\Users\Admin\AppData\Local\Temp\5dd3592481998f26375a49e823caad1e59db5d65fd44e3630948fee88126f5de.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\dcd.exe
  "C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1548 -s 1520
  2⤵
  PID:1808

C:\Users\Admin\AppData\Local\Temp\dcd.exe

Filesize
227KB

MD5
b5ac46e446cead89892628f30a253a06

SHA1
f4ad1044a7f77a1b02155c3a355a1bb4177076ca

SHA256
def7afcb65126c4b04a7cbf08c693f357a707aa99858cac09a8d5e65f3177669

SHA512
bcabbac6f75c1d41364406db457c62f5135a78f763f6db08c1626f485c64db4d9ba3b3c8bc0b5508d917e445fd220ffa66ebc35221bd06560446c109818e8e87

Download Submit
memory/1548-0-0x000007FEF5D23000-0x000007FEF5D24000-memory.dmp

Filesize
4KB

Download
memory/1548-1-0x0000000000860000-0x0000000000946000-memory.dmp

Filesize
920KB

Download
memory/1548-2-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/1548-3-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/1548-4-0x0000000000460000-0x000000000049E000-memory.dmp

Filesize
248KB

Download
memory/1548-6-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/1548-5-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/1548-13-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download
memory/1548-14-0x000007FEF5D20000-0x000007FEF670C000-memory.dmp

Filesize
9.9MB

Download