Analysis

  • max time kernel
    10s
  • max time network
    112s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    05-03-2021 18:22

General

  • Target

    Build.exe

  • Size

    3.4MB

  • MD5

    74b5bc34a2b3c3dd453560ee4bcb136a

  • SHA1

    c86f8b33e5852b986b41318205e18caf7d0e7f30

  • SHA256

    c3ee35c8830cb3f6083fe15cd7325e14edbf77880b227473b6c3e39999b41493

  • SHA512

    fb68159225c3c518305413ef483765d063be7367f4c43bd08f11ea1d4d50fa1360407050aaf9792788f1391bae1ba389d9ad642a2a2d711af407006e813a9211

Malware Config

Signatures

  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • themida 2 IoCs

    Detects Themida, Advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Build.exe
    "C:\Users\Admin\AppData\Local\Temp\Build.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4640
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 1860
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4204

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4204-9-0x00000000046F0000-0x00000000046F1000-memory.dmp

    Filesize

    4KB

  • memory/4204-10-0x00000000046F0000-0x00000000046F1000-memory.dmp

    Filesize

    4KB

  • memory/4640-3-0x0000000073DA0000-0x000000007448E000-memory.dmp

    Filesize

    6.9MB

  • memory/4640-4-0x0000000000B80000-0x0000000000B81000-memory.dmp

    Filesize

    4KB

  • memory/4640-6-0x0000000077CD4000-0x0000000077CD5000-memory.dmp

    Filesize

    4KB

  • memory/4640-7-0x0000000005570000-0x0000000005571000-memory.dmp

    Filesize

    4KB

  • memory/4640-8-0x00000000056B0000-0x00000000056B1000-memory.dmp

    Filesize

    4KB