echelon | b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e

Analysis

max time kernel
4294183s
max time network
137s
platform
windows7_x64
resource
win7-20220311-en
submitted
19-03-2022 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
Size

2.4MB
MD5

00b6ffe300f9e53ecf04c746cc21009c
SHA1

533949203f4a9376defe1d7b1fffbaf9e04fcca8
SHA256

b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e
SHA512

b599f10372d67fd9b84c47dd13053937384d834dbf9ed5fe0fb60e180c42b5dab61ef7768fc9e6380ae9ddea7c40fb22d18ae0a75bd9afe474323bc9c140eca2

Score

10^/10

echelon bootkit collection discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
Echelon log file 1 IoCs
Detects a log file produced by Echelon.

Processes:

yara_rule

echelon_log_file
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

yara_rule
echelon_log_file

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Wine	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
6 ip-api.com
8 api.ipify.org
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

description ioc process

File opened for modification \??\PhysicalDrive0 b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org
6	ip-api.com
8	api.ipify.org

description	ioc	process
File opened for modification	\??\PhysicalDrive0	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs

Processes:

b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

pid	process
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1260 1956 WerFault.exe b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

pid	pid_target	process	target process
1260	1956	WerFault.exe	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

pid	process
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

description pid process

Token: SeDebugPrivilege 1956 b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

description	pid	process
Token: SeDebugPrivilege	1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

description	pid	process	target process
PID 1956 wrote to memory of 1260	1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe	WerFault.exe
PID 1956 wrote to memory of 1260	1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe	WerFault.exe
PID 1956 wrote to memory of 1260	1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe	WerFault.exe
PID 1956 wrote to memory of 1260	1956	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe	WerFault.exe

outlook_office_path 1 IoCs

Processes:

b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

outlook_win_path 1 IoCs

Processes:

b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe

C:\Users\Admin\AppData\Local\Temp\b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe
"C:\Users\Admin\AppData\Local\Temp\b42d6d1177db8c8864097d7b7fdf31490d60c5d29b0e6d06937188a1360cb21e.exe"
1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Accesses Microsoft Outlook profiles
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 1160
2⤵
- Program crash
PID:1260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1956-54-0x00000000767A1000-0x00000000767A3000-memory.dmp

Filesize
8KB

Download
memory/1956-56-0x0000000000CF0000-0x0000000001358000-memory.dmp

Filesize
6.4MB

Download
memory/1956-57-0x0000000000CF0000-0x0000000001358000-memory.dmp

Filesize
6.4MB

Download
memory/1956-58-0x0000000077AC0000-0x0000000077C40000-memory.dmp

Filesize
1.5MB

Download
memory/1956-59-0x0000000075370000-0x000000007537B000-memory.dmp

Filesize
44KB

Download
memory/1956-60-0x0000000075380000-0x00000000753CA000-memory.dmp

Filesize
296KB

Download
memory/1956-61-0x0000000075290000-0x0000000075299000-memory.dmp

Filesize
36KB

Download
memory/1956-62-0x00000000749E0000-0x00000000750CE000-memory.dmp

Filesize
6.9MB

Download
memory/1956-63-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/1956-64-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/1956-65-0x0000000076480000-0x0000000076503000-memory.dmp

Filesize
524KB

Download
memory/1956-66-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/1956-67-0x00000000742F0000-0x00000000749DE000-memory.dmp

Filesize
6.9MB

Download
memory/1956-68-0x0000000076510000-0x0000000076600000-memory.dmp

Filesize
960KB

Download
memory/1956-69-0x0000000075930000-0x00000000759FC000-memory.dmp

Filesize
816KB

Download
memory/1956-70-0x0000000075210000-0x0000000075290000-memory.dmp

Filesize
512KB

Download
memory/1956-71-0x0000000006320000-0x0000000006321000-memory.dmp

Filesize
4KB

Download
memory/1956-72-0x0000000006325000-0x0000000006336000-memory.dmp

Filesize
68KB

Download
memory/1956-73-0x0000000075A50000-0x0000000075B6D000-memory.dmp

Filesize
1.1MB

Download
memory/1956-74-0x0000000006336000-0x0000000006337000-memory.dmp

Filesize
4KB

Download
memory/1956-75-0x0000000074180000-0x0000000074197000-memory.dmp

Filesize
92KB

Download
memory/1956-76-0x000000006EEF0000-0x000000006EF42000-memory.dmp

Filesize
328KB

Download
memory/1956-77-0x0000000073F90000-0x0000000073F9D000-memory.dmp

Filesize
52KB

Download
memory/1956-78-0x000000006EE50000-0x000000006EEA8000-memory.dmp

Filesize
352KB

Download
memory/1956-79-0x00000000775F0000-0x0000000077617000-memory.dmp

Filesize
156KB

Download