Overview

overview

10

Static

static

3a61e234ba...5b.exe

windows7_x64

10

3a61e234ba...5b.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    12s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    25-05-2022 00:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3a61e234ba93ea14a976c3664d0d5bd922c15f34365f139a0e7644ed983a4f5b.exe

  • Size

    3.9MB

  • MD5

    ed97eae657fb64e41b66be70ef77c9a9

  • SHA1

    04e771a749ce2a593130b7e5663fa2a85157e9a0

  • SHA256

    3a61e234ba93ea14a976c3664d0d5bd922c15f34365f139a0e7644ed983a4f5b

  • SHA512

    339563dc9ab3a92e3c253e1be1acb25af982e9783519bbb50f3f260f1cd6e79d71aff855d47fa523318b720bdece4db3e61ce68132155eb9bf75b7045dac74ab

Score
10/10
echelonbootkitcollectionevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    stealerspywareechelon
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a61e234ba93ea14a976c3664d0d5bd922c15f34365f139a0e7644ed983a4f5b.exe
    "C:\Users\Admin\AppData\Local\Temp\3a61e234ba93ea14a976c3664d0d5bd922c15f34365f139a0e7644ed983a4f5b.exe"
    1⤵
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Accesses Microsoft Outlook profiles
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • outlook_office_path
    • outlook_win_path
    PID:3272
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 1924
      2⤵
      • Program crash
      PID:3452
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3272 -ip 3272
    1⤵
      PID:4408

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Bootkit

    1
    T1067

    Privilege Escalation

    Defense Evasion

    Virtualization/Sandbox Evasion

    2
    T1497

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    3
    T1012

    Virtualization/Sandbox Evasion

    2
    T1497

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Email Collection

    1
    T1114

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3272-130-0x0000000077660000-0x0000000077803000-memory.dmp
      Filesize

      1.6MB

      Download
    • memory/3272-131-0x0000000000040000-0x0000000000968000-memory.dmp
      Filesize

      9.2MB

      Download
    • memory/3272-132-0x0000000000040000-0x0000000000968000-memory.dmp
      Filesize

      9.2MB

      Download
    • memory/3272-133-0x00000000054A0000-0x0000000005506000-memory.dmp
      Filesize

      408KB

      Download
    • memory/3272-134-0x0000000006020000-0x00000000060BC000-memory.dmp
      Filesize

      624KB

      Download
    • memory/3272-135-0x00000000074E0000-0x0000000007572000-memory.dmp
      Filesize

      584KB

      Download
    • memory/3272-136-0x0000000007C40000-0x00000000081E4000-memory.dmp
      Filesize

      5.6MB

      Download