Overview

overview

10

Static

static

9080bc4976...93.exe

windows7_x64

10

9080bc4976...93.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    131s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    19-03-2022 19:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9080bc4976e84352e150192b485256e801d9c62a6675bf564b226c8ce95eba93.exe

  • Size

    2.4MB

  • MD5

    a5f9185372c30dca4d5f921f3a8a67cf

  • SHA1

    593d14be593f1b6b6e7c969f5130147e7735a7d2

  • SHA256

    9080bc4976e84352e150192b485256e801d9c62a6675bf564b226c8ce95eba93

  • SHA512

    f6f99b3bf1f20fa5f30d778016d1b2245f89f826957db083e98570038a4d0c7fde57f84f326ece15a0855c1af797a3feb28901a1deb887e802113483ed8d3029

Score
10/10
echelonbootkitcollectionevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    stealerspywareechelon
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9080bc4976e84352e150192b485256e801d9c62a6675bf564b226c8ce95eba93.exe
    "C:\Users\Admin\AppData\Local\Temp\9080bc4976e84352e150192b485256e801d9c62a6675bf564b226c8ce95eba93.exe"
    1⤵
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Accesses Microsoft Outlook profiles
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • outlook_office_path
    • outlook_win_path
    PID:1648
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 1608
      2⤵
      • Program crash
      PID:2672
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1648 -ip 1648
    1⤵
      PID:1508

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Bootkit

    1
    T1067

    Privilege Escalation

    Defense Evasion

    Virtualization/Sandbox Evasion

    2
    T1497

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    3
    T1012

    Virtualization/Sandbox Evasion

    2
    T1497

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Email Collection

    1
    T1114

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1648-130-0x0000000077850000-0x00000000779F3000-memory.dmp
      Filesize

      1.6MB

      Download
    • memory/1648-131-0x0000000000480000-0x0000000000AE8000-memory.dmp
      Filesize

      6.4MB

      Download
    • memory/1648-132-0x00000000746C0000-0x0000000074E70000-memory.dmp
      Filesize

      7.7MB

      Download
    • memory/1648-133-0x0000000000480000-0x0000000000AE8000-memory.dmp
      Filesize

      6.4MB

      Download
    • memory/1648-134-0x0000000005530000-0x0000000005596000-memory.dmp
      Filesize

      408KB

      Download
    • memory/1648-135-0x0000000006170000-0x0000000006714000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/1648-136-0x0000000005700000-0x0000000005701000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1648-137-0x0000000005703000-0x0000000005705000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1648-138-0x0000000005705000-0x0000000005706000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1648-139-0x00000000069C0000-0x0000000006A5C000-memory.dmp
      Filesize

      624KB

      Download
    • memory/1648-140-0x0000000005706000-0x0000000005707000-memory.dmp
      Filesize

      4KB

      Download