Analysis
-
max time kernel
19s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
16-02-2021 19:57
Static task
static1
Behavioral task
behavioral1
Sample
Output.exe
Resource
win7v20201028
General
-
Target
Output.exe
-
Size
1.2MB
-
MD5
3ee3964b6d55f0657fffcf7594f9309f
-
SHA1
7e4cb727fdc895d4497ffd0d83b810fed8a880dc
-
SHA256
b5a96378e32e7b20fd73fe5f634729280684bbb146f183b80751680a0e42191d
-
SHA512
81cdb9d4cf9ba6f3e04e1ec59cf817d0ef54a8d4a135e7018b4045243f7d1d1bb3f3143500a8a5bdf643d879f510450bc14a71715177072eea9a3be833e9d896
Malware Config
Signatures
-
Echelon log file 1 IoCs
Detects a log file produced by Echelon.
Processes:
yara_rule echelon_log_file -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 api.ipify.org 11 api.ipify.org 12 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
Output.exepid process 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
Output.exepid process 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe 640 Output.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Output.exedescription pid process Token: SeDebugPrivilege 640 Output.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/640-2-0x00007FFC354A0000-0x00007FFC35E8C000-memory.dmpFilesize
9.9MB
-
memory/640-3-0x0000000000970000-0x0000000000971000-memory.dmpFilesize
4KB
-
memory/640-6-0x000000001BE24000-0x000000001BE25000-memory.dmpFilesize
4KB
-
memory/640-7-0x000000001BE22000-0x000000001BE24000-memory.dmpFilesize
8KB
-
memory/640-8-0x000000001BE25000-0x000000001BE27000-memory.dmpFilesize
8KB
-
memory/640-5-0x000000001BE20000-0x000000001BE22000-memory.dmpFilesize
8KB
-
memory/640-9-0x000000001BE27000-0x000000001BE29000-memory.dmpFilesize
8KB
-
memory/640-10-0x000000001BD60000-0x000000001BD61000-memory.dmpFilesize
4KB
-
memory/640-11-0x000000001BE29000-0x000000001BE2F000-memory.dmpFilesize
24KB