Analysis
-
max time kernel
151s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-05-2022 23:19
General
-
Target
b6b855bda533fefd81c9a7ca8929e52b1b79be7b5e4c4d9fb494392a2c4d8db3.exe
-
Size
1.5MB
-
MD5
fe7c13445868482b63e1ae71bca9d150
-
SHA1
78111d52ba0215bb531d487bc6e9a218ea768377
-
SHA256
b6b855bda533fefd81c9a7ca8929e52b1b79be7b5e4c4d9fb494392a2c4d8db3
-
SHA512
c1a2bc27e1381f6ed142ffb8a6cdb0006a9161433dbb9222f83ec407cf0bb5510f9986108b4e96c4a3d0dd30659cc48baec96b9ca962082c64c0fcbcc8c0879c
Malware Config
Signatures
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Echelon log file 1 IoCs
Detects a log file produced by Echelon.
-
Executes dropped EXE 2 IoCs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6b855bda533fefd81c9a7ca8929e52b1b79be7b5e4c4d9fb494392a2c4d8db3.exe"C:\Users\Admin\AppData\Local\Temp\b6b855bda533fefd81c9a7ca8929e52b1b79be7b5e4c4d9fb494392a2c4d8db3.exe"1⤵
- Checks computer location settings
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\ProgramData\Decoder.exe"C:\ProgramData\Decoder.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Services" /tr "\systems32_bit\systems32.exe" /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3D76.tmp.cmd""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
-
-
C:\systems32_bit\systems32.exe\systems32_bit\systems32.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Services" /tr "\systems32_bit\systems32.exe" /f2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5e753a9a4c3a393d9eccc31e5c6aded66
SHA15501ae71598925711dbee54f6ee1c827dd01d845
SHA25652773fccbe6883ca7465ffe857c3fe7193521f0807bd8462f95bd4ad73be9867
SHA512ee03d79cd24db07c3466cc602a657c9eb33119267b591a64a0d9215e3a80a24e3c435275ccfb5ffd7356def5bf717c5f2d8bc9a5b2daf1950ecf951b5e614c2e
-
Filesize
39KB
MD5e753a9a4c3a393d9eccc31e5c6aded66
SHA15501ae71598925711dbee54f6ee1c827dd01d845
SHA25652773fccbe6883ca7465ffe857c3fe7193521f0807bd8462f95bd4ad73be9867
SHA512ee03d79cd24db07c3466cc602a657c9eb33119267b591a64a0d9215e3a80a24e3c435275ccfb5ffd7356def5bf717c5f2d8bc9a5b2daf1950ecf951b5e614c2e
-
Filesize
85B
MD573712247036b6a24d16502c57a3e5679
SHA165ca9edadb0773fc34db7dfefe9e6416f1ac17fa
SHA2568bd49d7e7e6b2c2dc16a4cb0eebb8f28892775fad56c9e4aaa22d59f01883cd0
SHA512548eef10b0118f7d907fa19c12de68b47278afffb3eb9460621efb2b711ebcf6b90d0ea1c077fc480e032bf241fb3f8cc995ec1373e301446f89f1a74a6309de
-
Filesize
131B
MD54fb4a80941d5a8acdd721ff333023939
SHA1c5cae850eba266c87f7cd32f39572a3d024ebbcd
SHA256373dac231d9214f27f6ca133e3f03d75a384d207dc12869feac3771ab981505a
SHA5126f22d3724456be03f7021bc4fcf2bbf1a855fba19309aee514f6f293669a24437698fc014594babf58469dfe95ac06eec15fcd265a43746c299bd7299a16c9d4
-
Filesize
39KB
MD5e753a9a4c3a393d9eccc31e5c6aded66
SHA15501ae71598925711dbee54f6ee1c827dd01d845
SHA25652773fccbe6883ca7465ffe857c3fe7193521f0807bd8462f95bd4ad73be9867
SHA512ee03d79cd24db07c3466cc602a657c9eb33119267b591a64a0d9215e3a80a24e3c435275ccfb5ffd7356def5bf717c5f2d8bc9a5b2daf1950ecf951b5e614c2e
-
Filesize
39KB
MD5e753a9a4c3a393d9eccc31e5c6aded66
SHA15501ae71598925711dbee54f6ee1c827dd01d845
SHA25652773fccbe6883ca7465ffe857c3fe7193521f0807bd8462f95bd4ad73be9867
SHA512ee03d79cd24db07c3466cc602a657c9eb33119267b591a64a0d9215e3a80a24e3c435275ccfb5ffd7356def5bf717c5f2d8bc9a5b2daf1950ecf951b5e614c2e
-
-
Filesize
10.8MB
-
Filesize
64KB
-
-
-
-
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
4.3MB
-
Filesize
624KB
-
Filesize
408KB
-
-
Filesize
10.8MB
-