Overview

overview

10

Static

static

Lucky Fixed.exe

windows7_x64

8

Lucky Fixed.exe

windows10_x64

10

Analysis

  • max time kernel
    105s
  • max time network
    111s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    19-05-2021 19:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Lucky Fixed.exe

  • Size

    1.3MB

  • MD5

    1f4f57202ef12656df3582a8adef59d8

  • SHA1

    0f66c9ac00c19dd20827a78ffdfa4e63857abffb

  • SHA256

    6933c5d70f485687742b49b9310074cc4b948a293527ad0c7c78fb60d47efcb1

  • SHA512

    ae67c0aa6a1d87fdedf3ee08c050cb853bef45510383b13033285991ca983985ef1a8329a7782d2e02eb079b6c0246909c0110dfbd22ca921bd209446e1d0fcb

Score
10/10
echelonspywarestealer

Malware Config

Signatures

  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    stealerspywareechelon
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 52 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lucky Fixed.exe
    "C:\Users\Admin\AppData\Local\Temp\Lucky Fixed.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3892

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3892-114-0x0000000000310000-0x0000000000311000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3892-116-0x000000001B520000-0x000000001B591000-memory.dmp
    Filesize

    452KB

    Download
  • memory/3892-117-0x0000000000C50000-0x0000000000C52000-memory.dmp
    Filesize

    8KB

    Download