Analysis
-
max time kernel
15s -
max time network
115s -
platform
windows10_x64 -
resource
win10 -
submitted
25-10-2020 18:08
Static task
static1
Behavioral task
behavioral1
Sample
70c80253c09aacccddce335b5f3513b4.exe
Resource
win7
General
-
Target
70c80253c09aacccddce335b5f3513b4.exe
-
Size
2.3MB
-
MD5
70c80253c09aacccddce335b5f3513b4
-
SHA1
f0a87849b3e2306ce3688cb65fcab8ae74e1bba4
-
SHA256
6be2502f47fd78cdabd91d5d2aa199112cf22a4cb9302e3fca67c34ab0ff9d48
-
SHA512
85697ac775ed1d923413dacd57b35dcfb5ddf0ad391733c6972f5106dd3502a3537ee1591764003af1364da0863daff4742c1aadbecf988a7b30eb9784e4ec2c
Malware Config
Signatures
-
Echelon log file 1 IoCs
Detects a log file produced by Echelon.
Processes:
yara_rule echelon_log_file -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 api.ipify.org 9 api.ipify.org 10 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
Processes:
70c80253c09aacccddce335b5f3513b4.exepid process 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3480 3840 WerFault.exe 70c80253c09aacccddce335b5f3513b4.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
70c80253c09aacccddce335b5f3513b4.exeWerFault.exepid process 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3840 70c80253c09aacccddce335b5f3513b4.exe 3480 WerFault.exe 3480 WerFault.exe 3480 WerFault.exe 3480 WerFault.exe 3480 WerFault.exe 3480 WerFault.exe 3480 WerFault.exe 3480 WerFault.exe 3480 WerFault.exe 3480 WerFault.exe 3480 WerFault.exe 3480 WerFault.exe 3480 WerFault.exe 3480 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
70c80253c09aacccddce335b5f3513b4.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3840 70c80253c09aacccddce335b5f3513b4.exe Token: SeDebugPrivilege 3480 WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70c80253c09aacccddce335b5f3513b4.exe"C:\Users\Admin\AppData\Local\Temp\70c80253c09aacccddce335b5f3513b4.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3840 -s 22682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3480-5-0x000001597F4B0000-0x000001597F4B1000-memory.dmpFilesize
4KB
-
memory/3480-4-0x000001597F4B0000-0x000001597F4B1000-memory.dmpFilesize
4KB
-
memory/3480-6-0x000001597F4B0000-0x000001597F4B1000-memory.dmpFilesize
4KB
-
memory/3480-8-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-10-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-12-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-11-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-13-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-14-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-16-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-15-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-17-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-18-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-19-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-21-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-23-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-22-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-24-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-25-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-26-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-20-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-27-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-29-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-28-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-31-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-32-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-33-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-34-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-36-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-37-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-38-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-40-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-41-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-42-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-43-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-44-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-45-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-46-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-47-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-48-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-39-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-49-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-35-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-30-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-50-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-51-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-52-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-53-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-54-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-56-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-57-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-58-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-55-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-59-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-60-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-61-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-62-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-63-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-64-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-65-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-66-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-67-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-68-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-69-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-70-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-71-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-72-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-73-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-74-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-75-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-76-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-77-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-78-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-79-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-80-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-81-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-82-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-84-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-85-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-86-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-87-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-88-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-89-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-90-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-91-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-92-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-83-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-93-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-95-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-94-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-96-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-97-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-98-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-99-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-100-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-102-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3480-101-0x0000015900A70000-0x0000015900A71000-memory.dmpFilesize
4KB
-
memory/3840-0-0x00007FFC3B8A0000-0x00007FFC3C28C000-memory.dmpFilesize
9.9MB
-
memory/3840-1-0x00000000004B0000-0x00000000004B1000-memory.dmpFilesize
4KB
-
memory/3840-3-0x000000001BB00000-0x000000001BB01000-memory.dmpFilesize
4KB