Analysis

  • max time kernel
    123s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    13-11-2020 15:41

General

  • Target

    526b68a0be26a2bce634d4c37a025eca01d051e4ae0df350fa384541ebbe09c5.exe

  • Size

    2.0MB

  • MD5

    fc91265d814957f8963ca2ff8de8b689

  • SHA1

    18ce51ccfff15e04b958f95fd1ee3c82cdb2784f

  • SHA256

    526b68a0be26a2bce634d4c37a025eca01d051e4ae0df350fa384541ebbe09c5

  • SHA512

    5044b473116881cbf0c74a9758b1dbd88cd273d2a928ebac57a0d3a828ece13bdda8448e33b28c54caa0d44bdd3a5ab2ba2b44c09fd3bf6f6383689caf73286a

Malware Config

Signatures

  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

  • Echelon log file 1 IoCs

    Detects a log file produced by Echelon.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\526b68a0be26a2bce634d4c37a025eca01d051e4ae0df350fa384541ebbe09c5.exe
    "C:\Users\Admin\AppData\Local\Temp\526b68a0be26a2bce634d4c37a025eca01d051e4ae0df350fa384541ebbe09c5.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Users\Public\Downloads\images.exe
      "C:\Users\Public\Downloads\images.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:836
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 836 -s 2744
        3⤵
        • Loads dropped DLL
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1164

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Downloads\images.exe

    MD5

    3f7049b2c628eac94f17629f3e7d5830

    SHA1

    61ad825e39e19472d06a3080367a858e18187d05

    SHA256

    af6007d4070af7905884ce20a46aaf674edf8e983912ced713575fdd867d6ab7

    SHA512

    6a1f40a580edc535fdf3a0e0ebe32e18b532d316258a709e59ba7fca96699de58fb42ee20e1098df9f832829bc30acb09f1c8ee6c44231dad3892b2d961644ff

  • \??\c:\users\public\downloads\images.exe

    MD5

    3f7049b2c628eac94f17629f3e7d5830

    SHA1

    61ad825e39e19472d06a3080367a858e18187d05

    SHA256

    af6007d4070af7905884ce20a46aaf674edf8e983912ced713575fdd867d6ab7

    SHA512

    6a1f40a580edc535fdf3a0e0ebe32e18b532d316258a709e59ba7fca96699de58fb42ee20e1098df9f832829bc30acb09f1c8ee6c44231dad3892b2d961644ff

  • \Users\Public\Downloads\images.exe

    MD5

    3f7049b2c628eac94f17629f3e7d5830

    SHA1

    61ad825e39e19472d06a3080367a858e18187d05

    SHA256

    af6007d4070af7905884ce20a46aaf674edf8e983912ced713575fdd867d6ab7

    SHA512

    6a1f40a580edc535fdf3a0e0ebe32e18b532d316258a709e59ba7fca96699de58fb42ee20e1098df9f832829bc30acb09f1c8ee6c44231dad3892b2d961644ff

  • \Users\Public\Downloads\images.exe

    MD5

    e3b510207cfbc23a75704583319cc980

    SHA1

    3490fded2f970c1e9d3241121000f06202b6f414

    SHA256

    77468a2fce1954c7d99742b680da74a026187e0301af7261171b07701f4c01f6

    SHA512

    2f88c8b7ae5de1f1e866194d15727bad5e23173ee106c3193065a4052619513e78e142361f871a7edfae2b4e96b072bbb8f3e2be87505a0b56d5a7e0b4c7785a

  • \Users\Public\Downloads\images.exe

    MD5

    a4a3d46d0733f76de3d4abb95bf5d496

    SHA1

    014108422c33b0dd17cf67dd14b74a6b745ba3c6

    SHA256

    9957960796e3e31b666c7acd747fd96ef3079a2df47b02b1c8633e769c8c9e76

    SHA512

    bca0ba1d54ebc96dba29218d400aab692d01c282a43e91caa3d90c99baebfb99f8d270ffa02b20cf6864a5673200bfb07860a3478fec867c11ab6edc471a4b32

  • \Users\Public\Downloads\images.exe

    MD5

    0384ed14314d3f1df8431d6d10ff5c17

    SHA1

    63000ec68ab6e2b3a5e2ec0c5cdd07ec0f534d5c

    SHA256

    218972e8a8f6fb7cca70d87d07877fe0cb7b479bd57b933b6e346a8bfeb554e6

    SHA512

    d0722281fb46e387d6a68a9c1827e3b4bc169ed9303be60fb8ce847c66f02fbbc1f1e2a1e8b860c42ef13cbc988ecc01b97defadaa0e9827c56174f5256c518b

  • \Users\Public\Downloads\images.exe

    MD5

    2baff503cb680fb75c2ae0822388d43a

    SHA1

    42bf3698fd2a080703ac6aee601866f1c2ceb020

    SHA256

    84c33fc4cf3fc70c8a3c27ea00dd39fc0fa8d611a1c36cbb01a2a0cc616c59ff

    SHA512

    645ef8fb1fe69ef7304fb54693e323c291151e25245f61140548d23a501292e29b0302073d5e22920f1dce97a8bca03422a10116c29591a10230c8b25bd897b2

  • \Users\Public\Downloads\images.exe

    MD5

    3f7049b2c628eac94f17629f3e7d5830

    SHA1

    61ad825e39e19472d06a3080367a858e18187d05

    SHA256

    af6007d4070af7905884ce20a46aaf674edf8e983912ced713575fdd867d6ab7

    SHA512

    6a1f40a580edc535fdf3a0e0ebe32e18b532d316258a709e59ba7fca96699de58fb42ee20e1098df9f832829bc30acb09f1c8ee6c44231dad3892b2d961644ff

  • \Users\Public\Downloads\images.exe

    MD5

    3f7049b2c628eac94f17629f3e7d5830

    SHA1

    61ad825e39e19472d06a3080367a858e18187d05

    SHA256

    af6007d4070af7905884ce20a46aaf674edf8e983912ced713575fdd867d6ab7

    SHA512

    6a1f40a580edc535fdf3a0e0ebe32e18b532d316258a709e59ba7fca96699de58fb42ee20e1098df9f832829bc30acb09f1c8ee6c44231dad3892b2d961644ff

  • \Users\Public\Downloads\images.exe

    MD5

    3f7049b2c628eac94f17629f3e7d5830

    SHA1

    61ad825e39e19472d06a3080367a858e18187d05

    SHA256

    af6007d4070af7905884ce20a46aaf674edf8e983912ced713575fdd867d6ab7

    SHA512

    6a1f40a580edc535fdf3a0e0ebe32e18b532d316258a709e59ba7fca96699de58fb42ee20e1098df9f832829bc30acb09f1c8ee6c44231dad3892b2d961644ff

  • \Users\Public\Downloads\images.exe

    MD5

    2c2bff1a2d86553d21a7b05ceabfa2bc

    SHA1

    660e695634437c34d4d36ed966b32933ff7836fe

    SHA256

    b9a6c2dbbd96b351fcf3ff2a1a86bd9b626990110ef4ac2013be2cb215d022d4

    SHA512

    236361ee16030e8f788cbac06140f0a9e094f9a88a24313ae63325e536b9105bd3b6f4d9a4d1a4596cf909e4870df0e23c38c06042d3c7b4dd2d694366b22b1f

  • memory/836-30-0x0000000000000000-mapping.dmp

  • memory/836-37-0x0000000000000000-mapping.dmp

  • memory/836-15-0x0000000000410000-0x000000000041F000-memory.dmp

    Filesize

    60KB

  • memory/836-16-0x0000000000490000-0x0000000000499000-memory.dmp

    Filesize

    36KB

  • memory/836-17-0x0000000002D40000-0x0000000002D58000-memory.dmp

    Filesize

    96KB

  • memory/836-18-0x0000000006D30000-0x0000000006DBD000-memory.dmp

    Filesize

    564KB

  • memory/836-6-0x0000000000000000-mapping.dmp

  • memory/836-49-0x0000000000000000-mapping.dmp

  • memory/836-12-0x0000000000E90000-0x0000000000E91000-memory.dmp

    Filesize

    4KB

  • memory/836-11-0x0000000074BE0000-0x00000000752CE000-memory.dmp

    Filesize

    6.9MB

  • memory/836-10-0x0000000003110000-0x0000000003121000-memory.dmp

    Filesize

    68KB

  • memory/836-9-0x0000000003110000-0x0000000003121000-memory.dmp

    Filesize

    68KB

  • memory/836-28-0x0000000000000000-mapping.dmp

  • memory/836-48-0x0000000000000000-mapping.dmp

  • memory/836-31-0x0000000000000000-mapping.dmp

  • memory/836-34-0x0000000000000000-mapping.dmp

  • memory/836-33-0x0000000000000000-mapping.dmp

  • memory/836-35-0x0000000000000000-mapping.dmp

  • memory/836-36-0x0000000000000000-mapping.dmp

  • memory/836-14-0x0000000000690000-0x00000000006CE000-memory.dmp

    Filesize

    248KB

  • memory/836-40-0x0000000000000000-mapping.dmp

  • memory/836-38-0x0000000000000000-mapping.dmp

  • memory/836-32-0x0000000000000000-mapping.dmp

  • memory/836-29-0x0000000000000000-mapping.dmp

  • memory/836-27-0x0000000000000000-mapping.dmp

  • memory/836-39-0x0000000000000000-mapping.dmp

  • memory/836-41-0x0000000000000000-mapping.dmp

  • memory/836-42-0x0000000000000000-mapping.dmp

  • memory/836-43-0x0000000000000000-mapping.dmp

  • memory/836-44-0x0000000000000000-mapping.dmp

  • memory/836-45-0x0000000000000000-mapping.dmp

  • memory/836-46-0x0000000000000000-mapping.dmp

  • memory/836-47-0x0000000000000000-mapping.dmp

  • memory/1056-0-0x00000000025C0000-0x00000000026C1000-memory.dmp

    Filesize

    1.0MB

  • memory/1164-20-0x0000000001F20000-0x0000000001F31000-memory.dmp

    Filesize

    68KB

  • memory/1164-50-0x0000000002690000-0x00000000026A1000-memory.dmp

    Filesize

    68KB

  • memory/1164-19-0x0000000000000000-mapping.dmp