Analysis
-
max time kernel
125s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
27-03-2022 20:22
General
-
Target
6bba6f3268e99406db27258831b7f90dcd67eedfeadf5a9d21f2fa3c64091bca.exe
-
Size
1.3MB
-
MD5
1ed0417049b2a72cad3d18aa12d544eb
-
SHA1
afa868cdbc6cf10786f886f74b221df2a86f71f4
-
SHA256
6bba6f3268e99406db27258831b7f90dcd67eedfeadf5a9d21f2fa3c64091bca
-
SHA512
97c16b84b7f8de0f47072022d35b0ca8b67e69bd047822dcd0fe3e1055572eb118bfea264e9e0334a0db13f491643aa1ae4f11a054e9a21ab74bbe5614254fbb
Malware Config
Signatures
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Echelon log file 1 IoCs
Detects a log file produced by Echelon.
-
Executes dropped EXE 2 IoCs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bba6f3268e99406db27258831b7f90dcd67eedfeadf5a9d21f2fa3c64091bca.exe"C:\Users\Admin\AppData\Local\Temp\6bba6f3268e99406db27258831b7f90dcd67eedfeadf5a9d21f2fa3c64091bca.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\ProgramData\Decoder.exe"C:\ProgramData\Decoder.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Services" /tr "\systems32_bit\systems32.exe" /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA371.tmp.cmd""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
-
-
C:\systems32_bit\systems32.exe\systems32_bit\systems32.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Services" /tr "\systems32_bit\systems32.exe" /f2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5e753a9a4c3a393d9eccc31e5c6aded66
SHA15501ae71598925711dbee54f6ee1c827dd01d845
SHA25652773fccbe6883ca7465ffe857c3fe7193521f0807bd8462f95bd4ad73be9867
SHA512ee03d79cd24db07c3466cc602a657c9eb33119267b591a64a0d9215e3a80a24e3c435275ccfb5ffd7356def5bf717c5f2d8bc9a5b2daf1950ecf951b5e614c2e
-
Filesize
39KB
MD5e753a9a4c3a393d9eccc31e5c6aded66
SHA15501ae71598925711dbee54f6ee1c827dd01d845
SHA25652773fccbe6883ca7465ffe857c3fe7193521f0807bd8462f95bd4ad73be9867
SHA512ee03d79cd24db07c3466cc602a657c9eb33119267b591a64a0d9215e3a80a24e3c435275ccfb5ffd7356def5bf717c5f2d8bc9a5b2daf1950ecf951b5e614c2e
-
Filesize
85B
MD573712247036b6a24d16502c57a3e5679
SHA165ca9edadb0773fc34db7dfefe9e6416f1ac17fa
SHA2568bd49d7e7e6b2c2dc16a4cb0eebb8f28892775fad56c9e4aaa22d59f01883cd0
SHA512548eef10b0118f7d907fa19c12de68b47278afffb3eb9460621efb2b711ebcf6b90d0ea1c077fc480e032bf241fb3f8cc995ec1373e301446f89f1a74a6309de
-
Filesize
131B
MD568afdc7c17f1a9c4b87413da387bef2d
SHA144448fb50f80f90d96f5b6dc20cadbde66dfaa4a
SHA25644a744788a222008010534c1de1e008c8ec61935c0a080ef028583b3c717dc78
SHA5128d0eecf0fc0c8afe019dbda5f1d07423ebb673026e4415c693657accb4700f2f701be3bda1e03c6abd6e086cdc840123d9a57d983cf86e297a68f6b856630005
-
Filesize
39KB
MD5e753a9a4c3a393d9eccc31e5c6aded66
SHA15501ae71598925711dbee54f6ee1c827dd01d845
SHA25652773fccbe6883ca7465ffe857c3fe7193521f0807bd8462f95bd4ad73be9867
SHA512ee03d79cd24db07c3466cc602a657c9eb33119267b591a64a0d9215e3a80a24e3c435275ccfb5ffd7356def5bf717c5f2d8bc9a5b2daf1950ecf951b5e614c2e
-
Filesize
39KB
MD5e753a9a4c3a393d9eccc31e5c6aded66
SHA15501ae71598925711dbee54f6ee1c827dd01d845
SHA25652773fccbe6883ca7465ffe857c3fe7193521f0807bd8462f95bd4ad73be9867
SHA512ee03d79cd24db07c3466cc602a657c9eb33119267b591a64a0d9215e3a80a24e3c435275ccfb5ffd7356def5bf717c5f2d8bc9a5b2daf1950ecf951b5e614c2e
-
-
-
-
Filesize
10.8MB
-
Filesize
1.3MB
-
Filesize
8KB
-
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
8KB
-
-
-
Filesize
10.8MB
-
Filesize
8KB
-