echelon | 045ce5f3e750d27127ac6dd5683533b1e42748c7cb47a38a06a42f7f1dfb15d7

Analysis

max time kernel
17s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
06/03/2021, 18:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
lagstress.exe
Size 1.3MB
Sample210306-13cfyd3pex
SHA256 045ce5f3e750d27127ac6dd5683533b1e42748c7cb47a38a06a42f7f1dfb15d7
MD5 ded9a9e5aa1f2e772f5d81a984743af6
SHA1 a96333fc84cdd824fb7b4176ee3441c4d9d4f3c6
SHA512 fc8f9dd8a9abf79d81cb792aa8397b58de5f7fae671b7bd742f68d449096b955172419a96d95876c20ab5cb04faadf4bc96852157cc253b292f6e0adf17dde77
MD5 SHA1 SHA512

Score

10^/10

echelon spyware stealer

Malware Config

Signatures

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

Executes dropped EXE 1 IoCs

pid	Process
2792	Decoder.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.ipify.org
9	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2540	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3116	lagstress.exe
3116	lagstress.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3116	lagstress.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 2792	3116	lagstress.exe	77
PID 3116 wrote to memory of 2792	3116	lagstress.exe	77
PID 3116 wrote to memory of 2792	3116	lagstress.exe	77
PID 3116 wrote to memory of 1960	3116	lagstress.exe	78
PID 3116 wrote to memory of 1960	3116	lagstress.exe	78
PID 1960 wrote to memory of 2540	1960	cmd.exe	80
PID 1960 wrote to memory of 2540	1960	cmd.exe	80

C:\Users\Admin\AppData\Local\Temp\lagstress.exe
"C:\Users\Admin\AppData\Local\Temp\lagstress.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\ProgramData\Decoder.exe
  "C:\ProgramData\Decoder.exe"
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\system32\timeout.exe
    timeout 4
    3⤵
    - Delays execution with timeout.exe
    PID:2540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2792-13-0x0000000073840000-0x0000000073F2E000-memory.dmp

Download

memory/2792-14-0x0000000000210000-0x0000000000211000-memory.dmp

Download

memory/3116-2-0x00007FF8207C0000-0x00007FF8211AC000-memory.dmp

Download

memory/3116-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/3116-5-0x000000001C0B0000-0x000000001C121000-memory.dmp

Download

memory/3116-6-0x000000001B940000-0x000000001B942000-memory.dmp

Download