Analysis
- max time kernel
114s - max time network
119s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
28/09/2021, 16:12
General
- Target s.exe
- Size 4.8MB
- Sample210928-tn15pscdep
- SHA256 3b347a4641e8553c4ecbee8e6d86c32311cd9348d61eb55929aae076e82f96c3
Malware Config
Signatures
- Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\s.exe"C:\Users\Admin\AppData\Local\Temp\s.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 25242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2276-115-0x0000000077CD0000-0x0000000077E5E000-memory.dmp
memory/2276-117-0x0000000000130000-0x0000000000131000-memory.dmp
memory/2276-119-0x0000000005740000-0x0000000005741000-memory.dmp
memory/2276-120-0x00000000059A0000-0x00000000059A1000-memory.dmp
memory/2276-121-0x0000000006350000-0x0000000006351000-memory.dmp
memory/2276-122-0x0000000005EC0000-0x0000000005EC1000-memory.dmp
memory/2276-123-0x0000000006850000-0x0000000006851000-memory.dmp
memory/2276-124-0x00000000059A3000-0x00000000059A5000-memory.dmp
memory/2276-125-0x00000000059A5000-0x00000000059A6000-memory.dmp