Overview

overview

10

Static

static

54ea2a61aa...6b.exe

windows7_x64

10

54ea2a61aa...6b.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    09/03/2022, 14:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    54ea2a61aa910b1286c4edaea7e386f98fd69bdd3b9b70917e5f90a87fb7af6b.exe
  • Size 1.4MB
  • Sample220309-r61wjscccj
  • SHA256 54ea2a61aa910b1286c4edaea7e386f98fd69bdd3b9b70917e5f90a87fb7af6b
  • MD5 SHA1 SHA512
Score
10/10
echeloncollectiondiscoveryspywarestealer

Malware Config

Signatures

  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    stealerspywareechelon
  • Echelon log file 1 IoCs

    Detects a log file produced by Echelon.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\54ea2a61aa910b1286c4edaea7e386f98fd69bdd3b9b70917e5f90a87fb7af6b.exe
    "C:\Users\Admin\AppData\Local\Temp\54ea2a61aa910b1286c4edaea7e386f98fd69bdd3b9b70917e5f90a87fb7af6b.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • outlook_office_path
    • outlook_win_path
    PID:3728
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3728 -s 2348
      2⤵
      • Program crash
      PID:4348
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 416 -p 3728 -ip 3728
    1⤵
      PID:4848

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/3728-130-0x0000000000E70000-0x0000000000FDE000-memory.dmp
          Download

          memory/3728-131-0x00007FFB2BB10000-0x00007FFB2C5D1000-memory.dmp
          Download

          memory/3728-132-0x000000001D9F0000-0x000000001D9F2000-memory.dmp
          Download

          memory/3728-133-0x000000001E7B0000-0x000000001E7D2000-memory.dmp
          Download