echelon | 045ce5f3e750d27127ac6dd5683533b1e42748c7cb47a38a06a42f7f1dfb15d7

General

Target

lagstress.exe
Size

1.3MB
MD5

ded9a9e5aa1f2e772f5d81a984743af6
SHA1

a96333fc84cdd824fb7b4176ee3441c4d9d4f3c6
SHA256

045ce5f3e750d27127ac6dd5683533b1e42748c7cb47a38a06a42f7f1dfb15d7
SHA512

fc8f9dd8a9abf79d81cb792aa8397b58de5f7fae671b7bd742f68d449096b955172419a96d95876c20ab5cb04faadf4bc96852157cc253b292f6e0adf17dde77

Score

10^/10

echelon spyware stealer

Malware Config

Signatures

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
Executes dropped EXE 1 IoCs

Processes:

Decoder.exe

pid process

2792 Decoder.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 api.ipify.org
9 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2540 timeout.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

lagstress.exe

pid process

3116 lagstress.exe
3116 lagstress.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

lagstress.exe

description pid process

Token: SeDebugPrivilege 3116 lagstress.exe

pid	process
2792	Decoder.exe

flow	ioc
8	api.ipify.org
9	api.ipify.org

pid	process
2540	timeout.exe

pid	process
3116	lagstress.exe
3116	lagstress.exe

description	pid	process
Token: SeDebugPrivilege	3116	lagstress.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

lagstress.execmd.exe

description	pid	process	target process
PID 3116 wrote to memory of 2792	3116	lagstress.exe	Decoder.exe
PID 3116 wrote to memory of 2792	3116	lagstress.exe	Decoder.exe
PID 3116 wrote to memory of 2792	3116	lagstress.exe	Decoder.exe
PID 3116 wrote to memory of 1960	3116	lagstress.exe	cmd.exe
PID 3116 wrote to memory of 1960	3116	lagstress.exe	cmd.exe
PID 1960 wrote to memory of 2540	1960	cmd.exe	timeout.exe
PID 1960 wrote to memory of 2540	1960	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\lagstress.exe
"C:\Users\Admin\AppData\Local\Temp\lagstress.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116

C:\ProgramData\Decoder.exe
"C:\ProgramData\Decoder.exe"
2⤵
- Executes dropped EXE
PID:2792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""
2⤵
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\system32\timeout.exe
timeout 4
3⤵
- Delays execution with timeout.exe
PID:2540

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Decoder.exe
MD5
6bd60496fa24ada50ca869be53467c7c

SHA1
5afdeb2dade4a35e6d8feef1ef24e30075302d6c

SHA256
25dfe0485d9e8fc9380bd7fc63cfca88c3b9b8fc23c75349a68ecfea056ba04b

SHA512
bacd106d5f211a1c24ead24ef32266a68550c3be8dde75e7ef509e165590c058b590edb20c060f5a8ecaa3b785b0e9e2edd3e458146f042c1f12821f66735806

Download Submit
C:\ProgramData\Decoder.exe
MD5
6bd60496fa24ada50ca869be53467c7c

SHA1
5afdeb2dade4a35e6d8feef1ef24e30075302d6c

SHA256
25dfe0485d9e8fc9380bd7fc63cfca88c3b9b8fc23c75349a68ecfea056ba04b

SHA512
bacd106d5f211a1c24ead24ef32266a68550c3be8dde75e7ef509e165590c058b590edb20c060f5a8ecaa3b785b0e9e2edd3e458146f042c1f12821f66735806

Download Submit
C:\Users\Admin\AppData\Local\Temp\.cmd
MD5
73712247036b6a24d16502c57a3e5679

SHA1
65ca9edadb0773fc34db7dfefe9e6416f1ac17fa

SHA256
8bd49d7e7e6b2c2dc16a4cb0eebb8f28892775fad56c9e4aaa22d59f01883cd0

SHA512
548eef10b0118f7d907fa19c12de68b47278afffb3eb9460621efb2b711ebcf6b90d0ea1c077fc480e032bf241fb3f8cc995ec1373e301446f89f1a74a6309de

Download Submit
memory/1960-9-0x0000000000000000-mapping.dmp

Download
memory/2540-11-0x0000000000000000-mapping.dmp

Download
memory/2792-7-0x0000000000000000-mapping.dmp

Download
memory/2792-13-0x0000000073840000-0x0000000073F2E000-memory.dmp

Filesize
6.9MB

Download
memory/2792-14-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/3116-2-0x00007FF8207C0000-0x00007FF8211AC000-memory.dmp

Filesize
9.9MB

Download
memory/3116-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/3116-5-0x000000001C0B0000-0x000000001C121000-memory.dmp

Filesize
452KB

Download
memory/3116-6-0x000000001B940000-0x000000001B942000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing