Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    28-09-2021 12:02

General

  • Target

    3b347a4641e8553c4ecbee8e6d86c32311cd9348d61eb55929aae076e82f96c3.exe

  • Size

    4.8MB

  • MD5

    c04496520501bc6a3b3f0b7f5f875a32

  • SHA1

    49e280e408a6df27295abf3d504003cbceeb00d8

  • SHA256

    3b347a4641e8553c4ecbee8e6d86c32311cd9348d61eb55929aae076e82f96c3

  • SHA512

    de333be3cd173a96579e95410fe92b8a4e5976b80451601bcf300eb2f3405be91983edb83881dd7f1d02aef6c0a5cadc00850c0536b2254ad710808d5cf183eb

Malware Config

Signatures

  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b347a4641e8553c4ecbee8e6d86c32311cd9348d61eb55929aae076e82f96c3.exe
    "C:\Users\Admin\AppData\Local\Temp\3b347a4641e8553c4ecbee8e6d86c32311cd9348d61eb55929aae076e82f96c3.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:440
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 1124
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4440

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/440-115-0x0000000077700000-0x000000007788E000-memory.dmp

    Filesize

    1.6MB

  • memory/440-117-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

    Filesize

    4KB

  • memory/440-119-0x0000000006050000-0x0000000006051000-memory.dmp

    Filesize

    4KB

  • memory/440-120-0x0000000006C30000-0x0000000006C31000-memory.dmp

    Filesize

    4KB

  • memory/440-121-0x00000000067C0000-0x00000000067C1000-memory.dmp

    Filesize

    4KB

  • memory/440-122-0x0000000005FE0000-0x0000000006046000-memory.dmp

    Filesize

    408KB

  • memory/440-123-0x0000000005FE0000-0x0000000006046000-memory.dmp

    Filesize

    408KB

  • memory/440-124-0x0000000007130000-0x0000000007131000-memory.dmp

    Filesize

    4KB

  • memory/440-125-0x0000000005FE0000-0x0000000006046000-memory.dmp

    Filesize

    408KB

  • memory/440-126-0x0000000007C30000-0x0000000007C31000-memory.dmp

    Filesize

    4KB