Analysis

  • max time kernel
    138s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    13-11-2020 15:41

General

  • Target

    526b68a0be26a2bce634d4c37a025eca01d051e4ae0df350fa384541ebbe09c5.exe

  • Size

    2.0MB

  • MD5

    fc91265d814957f8963ca2ff8de8b689

  • SHA1

    18ce51ccfff15e04b958f95fd1ee3c82cdb2784f

  • SHA256

    526b68a0be26a2bce634d4c37a025eca01d051e4ae0df350fa384541ebbe09c5

  • SHA512

    5044b473116881cbf0c74a9758b1dbd88cd273d2a928ebac57a0d3a828ece13bdda8448e33b28c54caa0d44bdd3a5ab2ba2b44c09fd3bf6f6383689caf73286a

Malware Config

Signatures

  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

  • Echelon log file 1 IoCs

    Detects a log file produced by Echelon.

  • ServiceHost packer 26 IoCs

    Detects ServiceHost packer used for .NET malware

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\526b68a0be26a2bce634d4c37a025eca01d051e4ae0df350fa384541ebbe09c5.exe
    "C:\Users\Admin\AppData\Local\Temp\526b68a0be26a2bce634d4c37a025eca01d051e4ae0df350fa384541ebbe09c5.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Users\Public\Downloads\images.exe
      "C:\Users\Public\Downloads\images.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3992
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 1488
        3⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3172

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\Downloads\images.exe

    MD5

    3f7049b2c628eac94f17629f3e7d5830

    SHA1

    61ad825e39e19472d06a3080367a858e18187d05

    SHA256

    af6007d4070af7905884ce20a46aaf674edf8e983912ced713575fdd867d6ab7

    SHA512

    6a1f40a580edc535fdf3a0e0ebe32e18b532d316258a709e59ba7fca96699de58fb42ee20e1098df9f832829bc30acb09f1c8ee6c44231dad3892b2d961644ff

  • \??\c:\users\public\downloads\images.exe

    MD5

    3f7049b2c628eac94f17629f3e7d5830

    SHA1

    61ad825e39e19472d06a3080367a858e18187d05

    SHA256

    af6007d4070af7905884ce20a46aaf674edf8e983912ced713575fdd867d6ab7

    SHA512

    6a1f40a580edc535fdf3a0e0ebe32e18b532d316258a709e59ba7fca96699de58fb42ee20e1098df9f832829bc30acb09f1c8ee6c44231dad3892b2d961644ff

  • memory/3172-21-0x00000000044A0000-0x00000000044A1000-memory.dmp

    Filesize

    4KB

  • memory/3172-152-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

    Filesize

    4KB

  • memory/3172-151-0x0000000005660000-0x0000000005661000-memory.dmp

    Filesize

    4KB

  • memory/3172-50-0x0000000004F40000-0x0000000004F41000-memory.dmp

    Filesize

    4KB

  • memory/3172-22-0x00000000044A0000-0x00000000044A1000-memory.dmp

    Filesize

    4KB

  • memory/3992-40-0x0000000000000000-mapping.dmp

  • memory/3992-25-0x0000000000000000-mapping.dmp

  • memory/3992-12-0x00000000064C0000-0x00000000064C1000-memory.dmp

    Filesize

    4KB

  • memory/3992-13-0x0000000006440000-0x000000000644F000-memory.dmp

    Filesize

    60KB

  • memory/3992-14-0x0000000005FC0000-0x0000000005FC9000-memory.dmp

    Filesize

    36KB

  • memory/3992-15-0x0000000006C60000-0x0000000006C61000-memory.dmp

    Filesize

    4KB

  • memory/3992-16-0x0000000006EA0000-0x0000000006EA1000-memory.dmp

    Filesize

    4KB

  • memory/3992-17-0x0000000008260000-0x0000000008278000-memory.dmp

    Filesize

    96KB

  • memory/3992-18-0x0000000008280000-0x000000000830D000-memory.dmp

    Filesize

    564KB

  • memory/3992-19-0x0000000008360000-0x0000000008361000-memory.dmp

    Filesize

    4KB

  • memory/3992-20-0x00000000083A0000-0x00000000083A1000-memory.dmp

    Filesize

    4KB

  • memory/3992-10-0x0000000005840000-0x0000000005841000-memory.dmp

    Filesize

    4KB

  • memory/3992-8-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

    Filesize

    4KB

  • memory/3992-44-0x0000000000000000-mapping.dmp

  • memory/3992-24-0x0000000000000000-mapping.dmp

  • memory/3992-26-0x0000000000000000-mapping.dmp

  • memory/3992-27-0x0000000000000000-mapping.dmp

  • memory/3992-28-0x0000000000000000-mapping.dmp

  • memory/3992-29-0x0000000000000000-mapping.dmp

  • memory/3992-31-0x0000000000000000-mapping.dmp

  • memory/3992-32-0x0000000000000000-mapping.dmp

  • memory/3992-33-0x0000000000000000-mapping.dmp

  • memory/3992-30-0x0000000000000000-mapping.dmp

  • memory/3992-34-0x0000000000000000-mapping.dmp

  • memory/3992-45-0x0000000000000000-mapping.dmp

  • memory/3992-36-0x0000000000000000-mapping.dmp

  • memory/3992-37-0x0000000000000000-mapping.dmp

  • memory/3992-38-0x0000000000000000-mapping.dmp

  • memory/3992-39-0x0000000000000000-mapping.dmp

  • memory/3992-2-0x0000000000000000-mapping.dmp

  • memory/3992-41-0x0000000000000000-mapping.dmp

  • memory/3992-42-0x0000000000000000-mapping.dmp

  • memory/3992-126-0x0000000000000000-mapping.dmp

  • memory/3992-11-0x0000000005F20000-0x0000000005F5E000-memory.dmp

    Filesize

    248KB

  • memory/3992-35-0x0000000000000000-mapping.dmp

  • memory/3992-46-0x0000000000000000-mapping.dmp

  • memory/3992-47-0x0000000000000000-mapping.dmp

  • memory/3992-48-0x0000000000000000-mapping.dmp

  • memory/3992-49-0x0000000000000000-mapping.dmp

  • memory/3992-7-0x00000000737B0000-0x0000000073E9E000-memory.dmp

    Filesize

    6.9MB

  • memory/3992-43-0x0000000000000000-mapping.dmp

  • memory/3992-127-0x0000000000000000-mapping.dmp

  • memory/3992-128-0x0000000000000000-mapping.dmp

  • memory/3992-129-0x0000000000000000-mapping.dmp

  • memory/3992-125-0x0000000000000000-mapping.dmp

  • memory/3992-130-0x0000000000000000-mapping.dmp

  • memory/3992-131-0x0000000000000000-mapping.dmp

  • memory/3992-132-0x0000000000000000-mapping.dmp

  • memory/3992-133-0x0000000000000000-mapping.dmp

  • memory/3992-134-0x0000000000000000-mapping.dmp

  • memory/3992-135-0x0000000000000000-mapping.dmp

  • memory/3992-136-0x0000000000000000-mapping.dmp

  • memory/3992-137-0x0000000000000000-mapping.dmp

  • memory/3992-138-0x0000000000000000-mapping.dmp

  • memory/3992-139-0x0000000000000000-mapping.dmp

  • memory/3992-140-0x0000000000000000-mapping.dmp

  • memory/3992-141-0x0000000000000000-mapping.dmp

  • memory/3992-142-0x0000000000000000-mapping.dmp

  • memory/3992-143-0x0000000000000000-mapping.dmp

  • memory/3992-144-0x0000000000000000-mapping.dmp

  • memory/3992-146-0x0000000000000000-mapping.dmp

  • memory/3992-147-0x0000000000000000-mapping.dmp

  • memory/3992-148-0x0000000000000000-mapping.dmp

  • memory/3992-149-0x0000000000000000-mapping.dmp

  • memory/3992-150-0x0000000000000000-mapping.dmp

  • memory/3992-145-0x0000000000000000-mapping.dmp

  • memory/3992-6-0x00000000032E0000-0x00000000032E1000-memory.dmp

    Filesize

    4KB

  • memory/3992-5-0x00000000031E0000-0x00000000031E1000-memory.dmp

    Filesize

    4KB