Analysis
- max time kernel
149s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
10/02/2026, 12:26
General
- Target 2026-02-10_0040df58dec2a37687a885bf1a2ac099_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luc.exe
- Size 821KB
- Sample260210-pl8dsads7d
- SHA256 99dacfaffe443309956d4ffa10b58e5c87de6c73339473712d9ade2cda57c923
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detects Eternity stealer 1 IoCs
- Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
- Eternity family
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
- Disables Task Manager via registry modification
- Executes dropped EXE 1 IoCs
- Windows security modification 2 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-02-10_0040df58dec2a37687a885bf1a2ac099_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luc.exe"C:\Users\Admin\AppData\Local\Temp\2026-02-10_0040df58dec2a37687a885bf1a2ac099_amadey_cobalt-strike_elex_eternity-stealer_glassworm_luc.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Modifies Windows Defender TamperProtection settings
- Windows security modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dcd.exe"C:\Users\Admin\AppData\Local\Temp\dcd.exe" -path=""2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_x5volb1y.4jj.ps1
dcd.exe
memory/832-35-0x000001A2C10B0000-0x000001A2C10CC000-memory.dmp
memory/832-38-0x000001A2C10A0000-0x000001A2C10A8000-memory.dmp
memory/832-44-0x000001A2A86B0000-0x000001A2A86BC000-memory.dmp
memory/832-43-0x000001A2A8590000-0x000001A2A85ED000-memory.dmp
memory/832-45-0x000001A2A8760000-0x000001A2A8772000-memory.dmp
memory/832-32-0x000001A2C1060000-0x000001A2C107C000-memory.dmp
memory/832-39-0x000001A2C10D0000-0x000001A2C10D6000-memory.dmp
memory/832-33-0x000001A2C1110000-0x000001A2C11C3000-memory.dmp
memory/832-37-0x000001A2C1420000-0x000001A2C143A000-memory.dmp
memory/832-17-0x000001A2A8790000-0x000001A2A87A0000-memory.dmp
memory/832-36-0x000001A2C1090000-0x000001A2C109A000-memory.dmp
memory/832-24-0x000001A2C0E00000-0x000001A2C0E22000-memory.dmp
memory/832-34-0x000001A2C1080000-0x000001A2C108A000-memory.dmp
memory/832-40-0x000001A2C10E0000-0x000001A2C10EA000-memory.dmp
memory/832-25-0x00007FF4CA7B0000-0x00007FF4CA7C0000-memory.dmp
memory/5348-3-0x000000001B070000-0x000000001B080000-memory.dmp
memory/5348-0-0x0000000000290000-0x0000000000366000-memory.dmp
memory/5348-2-0x0000000000B80000-0x0000000000B81000-memory.dmp
memory/5348-10-0x000000001B0F0000-0x000000001B1DA000-memory.dmp
memory/5348-12-0x000000001AFE0000-0x000000001AFF2000-memory.dmp
memory/5348-13-0x000000001B070000-0x000000001B080000-memory.dmp
memory/5348-11-0x0000000000B90000-0x0000000000B9C000-memory.dmp
memory/5348-9-0x0000000000B80000-0x0000000000B81000-memory.dmp
memory/5348-4-0x0000000002570000-0x00000000025AE000-memory.dmp
memory/5348-1-0x0000000000B80000-0x0000000000B81000-memory.dmp