Analysis
- max time kernel
15s - max time network
120s - platform
windows10_x64 - resource
win10v20210410 - submitted
06/06/2021, 19:46
General
- Target supremacy/.vs/supremacy_csgo/v16/Browse.VC-wal.db.exe
- Size 531KB
- Sample210606-8xe3xkelt2
- SHA256 dbf5add59cbb4c99672f0213347c5392b36b9da91c27d5307ea561f298277945
Malware Config
Signatures
- Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
- Echelon log file 1 IoCs
Detects a log file produced by Echelon.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\supremacy\.vs\supremacy_csgo\v16\Browse.VC-wal.db.exe"C:\Users\Admin\AppData\Local\Temp\supremacy\.vs\supremacy_csgo\v16\Browse.VC-wal.db.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3196-114-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
memory/3196-116-0x0000000001390000-0x00000000013CE000-memory.dmp
memory/3196-117-0x0000000002C10000-0x0000000002C1F000-memory.dmp
memory/3196-118-0x0000000002C20000-0x0000000002C29000-memory.dmp
memory/3196-119-0x000000001B800000-0x000000001B802000-memory.dmp
memory/3196-120-0x000000001B810000-0x000000001B828000-memory.dmp
memory/3196-121-0x000000001BDE0000-0x000000001BE6D000-memory.dmp
memory/3196-122-0x000000001B880000-0x000000001B881000-memory.dmp