Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-05-2022 02:43
General
-
Target
8f3ff63e2c029c663223ac1edb0fa1fc049bd084a36224eda2d89e842769561a.exe
-
Size
522KB
-
MD5
1eaced72fb7d641ae89622e325b00226
-
SHA1
3bf9aae121eb77ffc00e69d0331a100604bf13e8
-
SHA256
8f3ff63e2c029c663223ac1edb0fa1fc049bd084a36224eda2d89e842769561a
-
SHA512
a89770a240ffa337d54182018b161055f09f499d5bd9edab9a265bc8a34183d24e2ba21d866edf6055e23070071ba64dcb948580dad652b268187030b630b88e
Malware Config
Signatures
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Echelon log file 1 IoCs
Detects a log file produced by Echelon.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f3ff63e2c029c663223ac1edb0fa1fc049bd084a36224eda2d89e842769561a.exe"C:\Users\Admin\AppData\Local\Temp\8f3ff63e2c029c663223ac1edb0fa1fc049bd084a36224eda2d89e842769561a.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4628 -s 19282⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 416 -p 4628 -ip 46281⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544KB
-
Filesize
10.8MB
-
Filesize
24KB
-
Filesize
16KB
-
Filesize
12KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
12KB
-
Filesize
36KB
-
Filesize
84KB
-
Filesize
16KB
-
Filesize
12KB
-
Filesize
76KB
-
Filesize
20KB
-
Filesize
136KB
-
Filesize
16KB
-
Filesize
28KB