Overview

overview

10

Static

static

Mist.Buld.exe

windows7_x64

8

Mist.Buld.exe

windows10_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09-11-2020 20:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Mist.Buld.exe

  • Size

    391KB

  • MD5

    51083ffcc13fc386b68eaa8117f48a55

  • SHA1

    c5a7098f15174be421498cede6c8df8819e98540

  • SHA256

    f440c2cc4fc3168c939310c4e90b80d980a4a0d6a42f0596d2676461b02d11e2

  • SHA512

    81119315b4d36283d283e2e8cc1b2f59f4a72ac921fa32707fc00cc636c73e324554bcbc92847c3d5b1dea3fa6fcca3c093074be4b7f56e6c4213238a7ad2d89

Score
10/10
echelondiscoveryspywarestealer

Malware Config

Signatures

  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    stealerspywareechelon
  • Echelon log file 2 IoCs

    Detects a log file produced by Echelon.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mist.Buld.exe
    "C:\Users\Admin\AppData\Local\Temp\Mist.Buld.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:576
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Services" /tr "C:\Users\Admin\AppData\Roaming\systems32_bit\systems32.exe" /f
      2⤵
      • Creates scheduled task(s)
      PID:4000
  • C:\Users\Admin\AppData\Roaming\systems32_bit\systems32.exe
    C:\Users\Admin\AppData\Roaming\systems32_bit\systems32.exe
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Services" /tr "C:\Users\Admin\AppData\Roaming\systems32_bit\systems32.exe" /f
      2⤵
      • Creates scheduled task(s)
      PID:3596

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\systems32_bit\systems32.exe
    MD5

    51083ffcc13fc386b68eaa8117f48a55

    SHA1

    c5a7098f15174be421498cede6c8df8819e98540

    SHA256

    f440c2cc4fc3168c939310c4e90b80d980a4a0d6a42f0596d2676461b02d11e2

    SHA512

    81119315b4d36283d283e2e8cc1b2f59f4a72ac921fa32707fc00cc636c73e324554bcbc92847c3d5b1dea3fa6fcca3c093074be4b7f56e6c4213238a7ad2d89

    Download Submit
  • C:\Users\Admin\AppData\Roaming\systems32_bit\systems32.exe
    MD5

    51083ffcc13fc386b68eaa8117f48a55

    SHA1

    c5a7098f15174be421498cede6c8df8819e98540

    SHA256

    f440c2cc4fc3168c939310c4e90b80d980a4a0d6a42f0596d2676461b02d11e2

    SHA512

    81119315b4d36283d283e2e8cc1b2f59f4a72ac921fa32707fc00cc636c73e324554bcbc92847c3d5b1dea3fa6fcca3c093074be4b7f56e6c4213238a7ad2d89

    Download Submit
  • memory/576-0-0x00007FFC354A0000-0x00007FFC35E8C000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/576-1-0x00000000002B0000-0x00000000002B1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/576-3-0x0000000002280000-0x0000000002315000-memory.dmp
    Filesize

    596KB

    Download
  • memory/576-4-0x0000000002BE0000-0x0000000002C50000-memory.dmp
    Filesize

    448KB

    Download
  • memory/3596-13-0x0000000000000000-mapping.dmp
    Download
  • memory/3860-8-0x00007FFC354A0000-0x00007FFC35E8C000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/4000-5-0x0000000000000000-mapping.dmp
    Download