Analysis

  • max time kernel
    150s
  • max time network
    197s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    24-06-2021 02:02

General

  • Target

    d091285362e6cfcf60690c8a4dcd695e.exe

  • Size

    97KB

  • MD5

    d091285362e6cfcf60690c8a4dcd695e

  • SHA1

    0ad0bcc57498a5c2d1251f6fef81806be70aec04

  • SHA256

    a8f36e203ba22b243837f95a371fbad43ef4162e2cf6f01ab78714fed88e7bb3

  • SHA512

    4844a9844f302fa81d17ae1229574905eec70203a9708cc36434f75a2791c7905c76824da89e2c10e55aef72207341340fddc500b80575fb2fe1873308e22400

Malware Config

Signatures

  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops autorun.inf file 1 TTPs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d091285362e6cfcf60690c8a4dcd695e.exe
    "C:\Users\Admin\AppData\Local\Temp\d091285362e6cfcf60690c8a4dcd695e.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Users\Admin\AppData\Local\Temp\pbdtnrkk.cav.exe
      "C:\Users\Admin\AppData\Local\Temp\pbdtnrkk.cav.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:772
    • C:\Users\Admin\AppData\Local\Temp\h1uqkhud.0py.exe
      "C:\Users\Admin\AppData\Local\Temp\h1uqkhud.0py.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1488
      • C:\Users\Admin\AppData\Roaming\Microsoft.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1636
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft.exe" "Microsoft.exe" ENABLE
          4⤵
            PID:1084

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\h1uqkhud.0py.exe

      MD5

      4679d9734f3c814016da3e5300705979

      SHA1

      73d0709085f74c84d188131df65911931bc94c01

      SHA256

      e2c3166cb076362c126a82167baf21c10b61d87b9a08d4e8db734b64c8b474df

      SHA512

      31eca954a704e50e97aa3297ac5ae17e492319230c4d9c45cd71d9c4e53d4bcbc50f3c67387f38aaa8fc600cb289029a96b1fead7dbde1cd79d4c916abcd62fb

    • C:\Users\Admin\AppData\Local\Temp\h1uqkhud.0py.exe

      MD5

      4679d9734f3c814016da3e5300705979

      SHA1

      73d0709085f74c84d188131df65911931bc94c01

      SHA256

      e2c3166cb076362c126a82167baf21c10b61d87b9a08d4e8db734b64c8b474df

      SHA512

      31eca954a704e50e97aa3297ac5ae17e492319230c4d9c45cd71d9c4e53d4bcbc50f3c67387f38aaa8fc600cb289029a96b1fead7dbde1cd79d4c916abcd62fb

    • C:\Users\Admin\AppData\Local\Temp\pbdtnrkk.cav.exe

      MD5

      eb2efc889c96765d41bcac7ae5586f93

      SHA1

      f6129e5533d751f33bea71d2f114b2e217ecbb5c

      SHA256

      b12603344325e60166c40764c52866e4cdc556f0176017f2cb71b5e7f0f591f0

      SHA512

      5003c8d36343fe8c2761f6c73d73b9c2f99da59d9b7d80dd29dc7eb754e52ef25285b65b50119fa09d02f8ab354d8d0fd7dd59bb09f372b0347d0c2ef87be3f9

    • C:\Users\Admin\AppData\Local\Temp\pbdtnrkk.cav.exe

      MD5

      eb2efc889c96765d41bcac7ae5586f93

      SHA1

      f6129e5533d751f33bea71d2f114b2e217ecbb5c

      SHA256

      b12603344325e60166c40764c52866e4cdc556f0176017f2cb71b5e7f0f591f0

      SHA512

      5003c8d36343fe8c2761f6c73d73b9c2f99da59d9b7d80dd29dc7eb754e52ef25285b65b50119fa09d02f8ab354d8d0fd7dd59bb09f372b0347d0c2ef87be3f9

    • C:\Users\Admin\AppData\Roaming\Microsoft.exe

      MD5

      4679d9734f3c814016da3e5300705979

      SHA1

      73d0709085f74c84d188131df65911931bc94c01

      SHA256

      e2c3166cb076362c126a82167baf21c10b61d87b9a08d4e8db734b64c8b474df

      SHA512

      31eca954a704e50e97aa3297ac5ae17e492319230c4d9c45cd71d9c4e53d4bcbc50f3c67387f38aaa8fc600cb289029a96b1fead7dbde1cd79d4c916abcd62fb

    • C:\Users\Admin\AppData\Roaming\Microsoft.exe

      MD5

      4679d9734f3c814016da3e5300705979

      SHA1

      73d0709085f74c84d188131df65911931bc94c01

      SHA256

      e2c3166cb076362c126a82167baf21c10b61d87b9a08d4e8db734b64c8b474df

      SHA512

      31eca954a704e50e97aa3297ac5ae17e492319230c4d9c45cd71d9c4e53d4bcbc50f3c67387f38aaa8fc600cb289029a96b1fead7dbde1cd79d4c916abcd62fb

    • \Users\Admin\AppData\Local\Temp\h1uqkhud.0py.exe

      MD5

      4679d9734f3c814016da3e5300705979

      SHA1

      73d0709085f74c84d188131df65911931bc94c01

      SHA256

      e2c3166cb076362c126a82167baf21c10b61d87b9a08d4e8db734b64c8b474df

      SHA512

      31eca954a704e50e97aa3297ac5ae17e492319230c4d9c45cd71d9c4e53d4bcbc50f3c67387f38aaa8fc600cb289029a96b1fead7dbde1cd79d4c916abcd62fb

    • \Users\Admin\AppData\Local\Temp\pbdtnrkk.cav.exe

      MD5

      eb2efc889c96765d41bcac7ae5586f93

      SHA1

      f6129e5533d751f33bea71d2f114b2e217ecbb5c

      SHA256

      b12603344325e60166c40764c52866e4cdc556f0176017f2cb71b5e7f0f591f0

      SHA512

      5003c8d36343fe8c2761f6c73d73b9c2f99da59d9b7d80dd29dc7eb754e52ef25285b65b50119fa09d02f8ab354d8d0fd7dd59bb09f372b0347d0c2ef87be3f9

    • \Users\Admin\AppData\Roaming\Microsoft.exe

      MD5

      4679d9734f3c814016da3e5300705979

      SHA1

      73d0709085f74c84d188131df65911931bc94c01

      SHA256

      e2c3166cb076362c126a82167baf21c10b61d87b9a08d4e8db734b64c8b474df

      SHA512

      31eca954a704e50e97aa3297ac5ae17e492319230c4d9c45cd71d9c4e53d4bcbc50f3c67387f38aaa8fc600cb289029a96b1fead7dbde1cd79d4c916abcd62fb

    • memory/772-74-0x00000000022C0000-0x0000000002331000-memory.dmp

      Filesize

      452KB

    • memory/772-76-0x000000001B110000-0x000000001B112000-memory.dmp

      Filesize

      8KB

    • memory/772-68-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

      Filesize

      4KB

    • memory/772-64-0x0000000000000000-mapping.dmp

    • memory/1084-83-0x0000000000000000-mapping.dmp

    • memory/1488-69-0x0000000000000000-mapping.dmp

    • memory/1488-75-0x0000000000970000-0x0000000000971000-memory.dmp

      Filesize

      4KB

    • memory/1636-78-0x0000000000000000-mapping.dmp

    • memory/1636-82-0x00000000004F0000-0x00000000004F1000-memory.dmp

      Filesize

      4KB

    • memory/2024-62-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

      Filesize

      4KB

    • memory/2024-61-0x0000000076A81000-0x0000000076A83000-memory.dmp

      Filesize

      8KB

    • memory/2024-59-0x0000000000950000-0x0000000000951000-memory.dmp

      Filesize

      4KB