echelon | a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2

General

Target

a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe
Size

1.8MB
MD5

07f3f1699ca50451845d7704456f85bd
SHA1

e6f4fb512f3dfe5f53181d9b38f12b75b454dba7
SHA256

a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2
SHA512

547feed44c7529de9f22967ee2942a0bcec03faaa75853cb336d7fc8564fd1d77fc7800dcf5a508546819413aca58c8b826857ae02835b9a432d655adbff31e2

Score

10^/10

echelon spyware stealer

Malware Config

Signatures

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe

description	pid	process	target process
PID 2388 set thread context of 1664	2388	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2252 1664 WerFault.exe a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe

pid	pid_target	process	target process
2252	1664	WerFault.exe	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe

description	pid	process	target process
PID 2388 wrote to memory of 1664	2388	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe
PID 2388 wrote to memory of 1664	2388	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe
PID 2388 wrote to memory of 1664	2388	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe
PID 2388 wrote to memory of 1664	2388	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe
PID 2388 wrote to memory of 1664	2388	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe
PID 2388 wrote to memory of 1664	2388	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe
PID 2388 wrote to memory of 1664	2388	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe
PID 2388 wrote to memory of 1664	2388	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe	a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe

C:\Users\Admin\AppData\Local\Temp\a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe
"C:\Users\Admin\AppData\Local\Temp\a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2388

C:\Users\Admin\AppData\Local\Temp\a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe
"{path}"
2⤵
PID:1664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1664 -s 1800
3⤵
- Program crash
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1664 -ip 1664
1⤵
PID:2964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\a6127104ba331a8430306cacf11298af4d754a3c1991e170f38dd742a9f816d2.exe.log
MD5
6f8f3a9a57cb30e686d3355e656031e0

SHA1
acccd6befb1a2f40e662280bc5182e086a0d079b

SHA256
283586e83b25099a5698cb9caf9c594a37060d11e0f55c81bb9c6d4f728448ea

SHA512
8f11d645ff4f8d5b1c45b06eb52cd45319659255306d60e80e33abfd04b9e3b1164679f11a8a23bd493e4b3f6b9841d70e553a01835eeaf6035b4d05e4fd7b54

Download Submit
memory/1664-138-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/1664-142-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/1664-141-0x0000000075170000-0x0000000075920000-memory.dmp

Filesize
7.7MB

Download
memory/1664-140-0x00000000053A0000-0x0000000005406000-memory.dmp

Filesize
408KB

Download
memory/2388-133-0x0000000004E00000-0x0000000004E92000-memory.dmp

Filesize
584KB

Download
memory/2388-136-0x0000000007790000-0x0000000007CBC000-memory.dmp

Filesize
5.2MB

Download
memory/2388-137-0x00000000084C0000-0x000000000855C000-memory.dmp

Filesize
624KB

Download
memory/2388-135-0x0000000004D20000-0x00000000052C4000-memory.dmp

Filesize
5.6MB

Download
memory/2388-134-0x0000000004DA0000-0x0000000004DAA000-memory.dmp

Filesize
40KB

Download
memory/2388-130-0x0000000000220000-0x00000000003F0000-memory.dmp

Filesize
1.8MB

Download
memory/2388-132-0x00000000052D0000-0x0000000005874000-memory.dmp

Filesize
5.6MB

Download
memory/2388-131-0x00000000750D0000-0x0000000075880000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing