eternity | 3ef6482e94e62b0f674c24b66fed5230b07395929f5fc77708fed0cb536c4a2b

Analysis

max time kernel
129s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2025, 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79330.exe
Size

2.4MB
MD5

4c81e4497a420aea61e717fc94e0ad86
SHA1

b8cf42124816876a6f5286af46202705d2e61189
SHA256

069ed36bdd5046201359415dab896f99f2e5adb89eb54c2e652786e0ccd79330
SHA512

f78deb5aec91ea0557a3790e4f9bcd7846b1853264c25d85f28343e7e9e4eb6722fb3f72fcd834d2745f078b4e5ee5ea3c40848f0100f1edaab47e6f8d484b5b
SSDEEP

24576:ybKtGyBB9iuK++moKnfNIGQaK83uHU/uYfo11qis3s4b+6GIAANEN2tXL6Y3TEcZ:My1iuD+moCQZhHUWYfo11q33dRGyRt7

Score

10^/10

eternity discovery worm

Malware Config

Extracted

Family

eternity

http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion

Attributes

payload_urls
http://167.88.170.23/swo/sw.exe

http://167.88.170.23/swo/swo.exe

Signatures

Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
eternity
Eternity family
eternity

Executes dropped EXE 3 IoCs

pid	Process
1848	InstallUtil.exe
3664	InstallUtil.exe
3124	InstallUtil.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 916 set thread context of 3144	916	79330.exe	97

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	79330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4988	PING.EXE
5112	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4988	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe
916	79330.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	916	79330.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 3144	916	79330.exe	97
PID 916 wrote to memory of 3144	916	79330.exe	97
PID 916 wrote to memory of 3144	916	79330.exe	97
PID 916 wrote to memory of 3144	916	79330.exe	97
PID 916 wrote to memory of 3144	916	79330.exe	97
PID 916 wrote to memory of 3144	916	79330.exe	97
PID 916 wrote to memory of 3144	916	79330.exe	97
PID 916 wrote to memory of 3144	916	79330.exe	97
PID 3144 wrote to memory of 5112	3144	InstallUtil.exe	106
PID 3144 wrote to memory of 5112	3144	InstallUtil.exe	106
PID 3144 wrote to memory of 5112	3144	InstallUtil.exe	106
PID 5112 wrote to memory of 4848	5112	cmd.exe	108
PID 5112 wrote to memory of 4848	5112	cmd.exe	108
PID 5112 wrote to memory of 4848	5112	cmd.exe	108
PID 5112 wrote to memory of 4988	5112	cmd.exe	109
PID 5112 wrote to memory of 4988	5112	cmd.exe	109
PID 5112 wrote to memory of 4988	5112	cmd.exe	109
PID 5112 wrote to memory of 2668	5112	cmd.exe	110
PID 5112 wrote to memory of 2668	5112	cmd.exe	110
PID 5112 wrote to memory of 2668	5112	cmd.exe	110
PID 5112 wrote to memory of 1848	5112	cmd.exe	111
PID 5112 wrote to memory of 1848	5112	cmd.exe	111
PID 5112 wrote to memory of 1848	5112	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\79330.exe
"C:\Users\Admin\AppData\Local\Temp\79330.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "InstallUtil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" &&START "" "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      System Location Discovery: System Language Discovery
      PID:4848
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4988
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "InstallUtil" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe" /rl HIGHEST /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2668
  - - C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe
      "C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1848

C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3664

C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.log

Filesize
612B

MD5
b0b901060543d0efec067274ded58720

SHA1
465326ae8fdcf666143b15cac899a45cb4162d5d

SHA256
67f27af8f63738bb9b3fe701f5acf66813992ed3041d775c63ef383b5c32f328

SHA512
d15719db2fbaec30387c7a6222a3ff1b14017e7b36166850f6911e086ab881b157d15903f8a858034ced23b8628ca97d7533ba0120e5d0bb22da8c58bf13c9d8

Download Submit
C:\Users\Admin\AppData\Local\ServiceHub\InstallUtil.exe

Filesize
41KB

MD5
5d4073b2eb6d217c19f2b22f21bf8d57

SHA1
f0209900fbf08d004b886a0b3ba33ea2b0bf9da8

SHA256
ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3

SHA512
9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159

Download Submit
memory/916-12-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

Filesize
4KB

Download
memory/916-2-0x00000000053C0000-0x0000000005964000-memory.dmp

Filesize
5.6MB

Download
memory/916-4-0x0000000005970000-0x0000000005EDC000-memory.dmp

Filesize
5.4MB

Download
memory/916-5-0x0000000005A70000-0x0000000005B0C000-memory.dmp

Filesize
624KB

Download
memory/916-6-0x0000000005340000-0x000000000538A000-memory.dmp

Filesize
296KB

Download
memory/916-7-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/916-8-0x0000000005390000-0x00000000053A8000-memory.dmp

Filesize
96KB

Download
memory/916-9-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/916-10-0x0000000005BD0000-0x0000000005BDA000-memory.dmp

Filesize
40KB

Download
memory/916-11-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/916-0-0x0000000074BFE000-0x0000000074BFF000-memory.dmp

Filesize
4KB

Download
memory/916-13-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/916-3-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Filesize
584KB

Download
memory/916-16-0x00000000047E0000-0x00000000047FA000-memory.dmp

Filesize
104KB

Download
memory/916-14-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/916-17-0x0000000004810000-0x0000000004816000-memory.dmp

Filesize
24KB

Download
memory/916-1-0x00000000005D0000-0x0000000000832000-memory.dmp

Filesize
2.4MB

Download
memory/916-15-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/916-20-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/1848-32-0x00000000052E0000-0x00000000052FA000-memory.dmp

Filesize
104KB

Download
memory/1848-31-0x0000000000B30000-0x0000000000B3C000-memory.dmp

Filesize
48KB

Download
memory/3144-22-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/3144-26-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Filesize
7.7MB

Download
memory/3144-21-0x0000000004F60000-0x0000000004FC6000-memory.dmp

Filesize
408KB

Download
memory/3144-18-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download