eternity | 3ef6482e94e62b0f674c24b66fed5230b07395929f5fc77708fed0cb536c4a2b

Analysis

max time kernel
130s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/03/2025, 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79330.exe
Size

2.4MB
MD5

4c81e4497a420aea61e717fc94e0ad86
SHA1

b8cf42124816876a6f5286af46202705d2e61189
SHA256

069ed36bdd5046201359415dab896f99f2e5adb89eb54c2e652786e0ccd79330
SHA512

f78deb5aec91ea0557a3790e4f9bcd7846b1853264c25d85f28343e7e9e4eb6722fb3f72fcd834d2745f078b4e5ee5ea3c40848f0100f1edaab47e6f8d484b5b
SSDEEP

24576:ybKtGyBB9iuK++moKnfNIGQaK83uHU/uYfo11qis3s4b+6GIAANEN2tXL6Y3TEcZ:My1iuD+moCQZhHUWYfo11q33dRGyRt7

Score

10^/10

eternity discovery worm

Malware Config

Extracted

Family

eternity

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes

payload_urls
http://167.88.170.23/swo/sw.exe

http://167.88.170.23/swo/swo.exe

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Eternity family
eternity

Executes dropped EXE 3 IoCs

pid	Process
996	InstallUtil.exe
1912	InstallUtil.exe
1940	InstallUtil.exe

Loads dropped DLL 1 IoCs

pid	Process
576	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2616 set thread context of 2792	2616	79330.exe	31

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
576	cmd.exe
2632	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2632	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe
2616	79330.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	79330.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2792	2616	79330.exe	31
PID 2616 wrote to memory of 2792	2616	79330.exe	31
PID 2616 wrote to memory of 2792	2616	79330.exe	31
PID 2616 wrote to memory of 2792	2616	79330.exe	31
PID 2616 wrote to memory of 2792	2616	79330.exe	31
PID 2616 wrote to memory of 2792	2616	79330.exe	31
PID 2616 wrote to memory of 2792	2616	79330.exe	31
PID 2616 wrote to memory of 2792	2616	79330.exe	31
PID 2616 wrote to memory of 2792	2616	79330.exe	31
PID 2616 wrote to memory of 2792	2616	79330.exe	31
PID 2616 wrote to memory of 2792	2616	79330.exe	31
PID 2616 wrote to memory of 2792	2616	79330.exe	31
PID 2792 wrote to memory of 576	2792	InstallUtil.exe	33
PID 2792 wrote to memory of 576	2792	InstallUtil.exe	33
PID 2792 wrote to memory of 576	2792	InstallUtil.exe	33
PID 2792 wrote to memory of 576	2792	InstallUtil.exe	33
PID 576 wrote to memory of 1376	576	cmd.exe	35
PID 576 wrote to memory of 1376	576	cmd.exe	35
PID 576 wrote to memory of 1376	576	cmd.exe	35
PID 576 wrote to memory of 1376	576	cmd.exe	35
PID 576 wrote to memory of 2632	576	cmd.exe	36
PID 576 wrote to memory of 2632	576	cmd.exe	36
PID 576 wrote to memory of 2632	576	cmd.exe	36
PID 576 wrote to memory of 2632	576	cmd.exe	36
PID 576 wrote to memory of 1232	576	cmd.exe	37
PID 576 wrote to memory of 1232	576	cmd.exe	37
PID 576 wrote to memory of 1232	576	cmd.exe	37
PID 576 wrote to memory of 1232	576	cmd.exe	37
PID 576 wrote to memory of 996	576	cmd.exe	38
PID 576 wrote to memory of 996	576	cmd.exe	38
PID 576 wrote to memory of 996	576	cmd.exe	38
PID 576 wrote to memory of 996	576	cmd.exe	38
PID 576 wrote to memory of 996	576	cmd.exe	38
PID 576 wrote to memory of 996	576	cmd.exe	38
PID 576 wrote to memory of 996	576	cmd.exe	38
PID 2768 wrote to memory of 1912	2768	taskeng.exe	41
PID 2768 wrote to memory of 1912	2768	taskeng.exe	41
PID 2768 wrote to memory of 1912	2768	taskeng.exe	41
PID 2768 wrote to memory of 1912	2768	taskeng.exe	41
PID 2768 wrote to memory of 1912	2768	taskeng.exe	41
PID 2768 wrote to memory of 1912	2768	taskeng.exe	41
PID 2768 wrote to memory of 1912	2768	taskeng.exe	41
PID 2768 wrote to memory of 1940	2768	taskeng.exe	44
PID 2768 wrote to memory of 1940	2768	taskeng.exe	44
PID 2768 wrote to memory of 1940	2768	taskeng.exe	44
PID 2768 wrote to memory of 1940	2768	taskeng.exe	44
PID 2768 wrote to memory of 1940	2768	taskeng.exe	44
PID 2768 wrote to memory of 1940	2768	taskeng.exe	44
PID 2768 wrote to memory of 1940	2768	taskeng.exe	44

C:\Users\Admin\AppData\Local\Temp\79330.exe
"C:\Users\Admin\AppData\Local\Temp\79330.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "InstallUtil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:1376
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2632
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "InstallUtil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe" /rl HIGHEST /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1232
  - - C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe
      "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:996

C:\Windows\system32\taskeng.exe
taskeng.exe {0CDECD93-ACD3-4107-BE50-E000F793A797} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe
  C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1912
- C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe
  C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe

Filesize
40KB

MD5
91c9ae9c9a17a9db5e08b120e668c74c

SHA1
50770954c1ceb0bb6f1d5d3f2de2a0a065773723

SHA256
e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f

SHA512
ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e

Download Submit
memory/996-33-0x0000000001280000-0x000000000128C000-memory.dmp

Filesize
48KB

Download
memory/1912-35-0x0000000001280000-0x000000000128C000-memory.dmp

Filesize
48KB

Download
memory/1940-37-0x0000000001280000-0x000000000128C000-memory.dmp

Filesize
48KB

Download
memory/2616-8-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2616-11-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2616-6-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2616-7-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/2616-26-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2616-9-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2616-10-0x0000000000670000-0x000000000068A000-memory.dmp

Filesize
104KB

Download
memory/2616-5-0x0000000000300000-0x0000000000318000-memory.dmp

Filesize
96KB

Download
memory/2616-12-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2616-4-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2616-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

Filesize
4KB

Download
memory/2616-3-0x0000000000790000-0x00000000007DA000-memory.dmp

Filesize
296KB

Download
memory/2616-2-0x0000000004AE0000-0x0000000005042000-memory.dmp

Filesize
5.4MB

Download
memory/2616-1-0x0000000000B40000-0x0000000000DA2000-memory.dmp

Filesize
2.4MB

Download
memory/2616-20-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2792-14-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2792-22-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2792-25-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2792-24-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2792-21-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2792-29-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2792-15-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2792-17-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/2792-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2792-13-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download