Overview

overview

10

Static

static

File.exe

windows7_x64

10

File.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    45s
  • max time network
    100s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    24-06-2022 08:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    File.exe

  • Size

    1.1MB

  • MD5

    49a8859c0b016aa1d4fc71fec3607c41

  • SHA1

    e5fbe3bf3e6896b147a0f004af84caa3c059069b

  • SHA256

    de8211573c5ce932d6cdd2f4ffe8f350268f6d0007d7a83bf5cb88e86c87a5fa

  • SHA512

    2cfb2157c24fb1d2f413c752618daffc5899269d16ca97f749325c57cd62c6729d5234ee2ed2f852ee1955d1988fa0253e402d012332fdd8659a24118a40ab64

Score
10/10
echeloncollectiondiscoveryspywarestealer

Malware Config

Signatures

  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    stealerspywareechelon
  • Echelon log file 1 IoCs

    Detects a log file produced by Echelon.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\File.exe
    "C:\Users\Admin\AppData\Local\Temp\File.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:872
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 872 -s 1668
      2⤵
      • Program crash
      PID:808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/808-55-0x0000000000000000-mapping.dmp
    Download
  • memory/872-54-0x0000000001030000-0x0000000001158000-memory.dmp
    Filesize

    1.2MB

    Download