echelon | 08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58

General

Target

08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe
Size

2.4MB
MD5

ff9fa74b300ba172e8490d3ed9ccea2b
SHA1

7b0536b8e74f8c540e52bc79259096e4136bd6ee
SHA256

08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58
SHA512

d8ad5cf55ed0afac58ddc6c9424bc268b22238e5b1271c3b097744493708839ef98d33e34dbf19ba8b055072bfdf692ac7ab8b127d8e5542613a762f28f0f988

Score

10^/10

echelon collection spyware stealer

Malware Config

Signatures

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

Echelon log file 1 IoCs

Detects a log file produced by Echelon.

Processes:

yara_rule
echelon_log_file

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

InstallUtil.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	api.ipify.org
5	api.ipify.org
6	ip-api.com
8	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe

description	pid	Process	procid_target
PID 1728 set thread context of 972	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe	27

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1740	972	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

InstallUtil.exe

pid	Process
972	InstallUtil.exe
972	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exeInstallUtil.exe

description	pid	Process
Token: SeDebugPrivilege	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe
Token: SeDebugPrivilege	972	InstallUtil.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exeInstallUtil.exe

description	pid	Process	procid_target
PID 1728 wrote to memory of 972	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe	27
PID 1728 wrote to memory of 972	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe	27
PID 1728 wrote to memory of 972	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe	27
PID 1728 wrote to memory of 972	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe	27
PID 1728 wrote to memory of 972	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe	27
PID 1728 wrote to memory of 972	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe	27
PID 1728 wrote to memory of 972	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe	27
PID 1728 wrote to memory of 972	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe	27
PID 1728 wrote to memory of 972	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe	27
PID 1728 wrote to memory of 972	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe	27
PID 1728 wrote to memory of 972	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe	27
PID 1728 wrote to memory of 972	1728	08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe	27
PID 972 wrote to memory of 1740	972	InstallUtil.exe	29
PID 972 wrote to memory of 1740	972	InstallUtil.exe	29
PID 972 wrote to memory of 1740	972	InstallUtil.exe	29
PID 972 wrote to memory of 1740	972	InstallUtil.exe	29

outlook_office_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

outlook_win_path 1 IoCs

Processes:

InstallUtil.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe
"C:\Users\Admin\AppData\Local\Temp\08127d638d79e5a6000f2db4b8ef5ce9e1423d501a9a90d1454184247c0e6b58.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:972
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 928
    3⤵
    - Program crash
    PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-72-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/972-60-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/972-75-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/972-74-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/972-64-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/972-73-0x0000000076371000-0x0000000076373000-memory.dmp

Filesize
8KB

Download
memory/972-70-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/972-62-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/972-68-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/972-66-0x0000000000400000-0x0000000000528000-memory.dmp

Filesize
1.2MB

Download
memory/1728-58-0x0000000000280000-0x00000000002A4000-memory.dmp

Filesize
144KB

Download
memory/1728-55-0x0000000074450000-0x0000000074B3E000-memory.dmp

Filesize
6.9MB

Download
memory/1728-54-0x0000000001220000-0x000000000148A000-memory.dmp

Filesize
2.4MB

Download
memory/1728-59-0x00000000002C0000-0x00000000002D2000-memory.dmp

Filesize
72KB

Download
memory/1728-57-0x0000000000250000-0x0000000000270000-memory.dmp

Filesize
128KB

Download
memory/1728-56-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads