echelon | de8211573c5ce932d6cdd2f4ffe8f350268f6d0007d7a83bf5cb88e86c87a5fa

General

Target

File.exe
Size

1.1MB
MD5

49a8859c0b016aa1d4fc71fec3607c41
SHA1

e5fbe3bf3e6896b147a0f004af84caa3c059069b
SHA256

de8211573c5ce932d6cdd2f4ffe8f350268f6d0007d7a83bf5cb88e86c87a5fa
SHA512

2cfb2157c24fb1d2f413c752618daffc5899269d16ca97f749325c57cd62c6729d5234ee2ed2f852ee1955d1988fa0253e402d012332fdd8659a24118a40ab64

Score

10^/10

echelon collection discovery spyware stealer

Malware Config

Signatures

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
Echelon log file 1 IoCs
Detects a log file produced by Echelon.

Processes:

yara_rule

echelon_log_file
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

yara_rule
echelon_log_file

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

File.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	File.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	File.exe
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	File.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 api.ipify.org
10 ip-api.com
8 api.ipify.org
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4016 timeout.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

File.exe

pid process

736 File.exe
736 File.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

File.exe

description pid process

Token: SeDebugPrivilege 736 File.exe

flow	ioc
9	api.ipify.org
10	ip-api.com
8	api.ipify.org

pid	process
4016	timeout.exe

pid	process
736	File.exe
736	File.exe

description	pid	process
Token: SeDebugPrivilege	736	File.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

File.execmd.exe

description	pid	process	target process
PID 736 wrote to memory of 2292	736	File.exe	cmd.exe
PID 736 wrote to memory of 2292	736	File.exe	cmd.exe
PID 2292 wrote to memory of 4016	2292	cmd.exe	timeout.exe
PID 2292 wrote to memory of 4016	2292	cmd.exe	timeout.exe

outlook_office_path 1 IoCs

Processes:

File.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	File.exe

outlook_win_path 1 IoCs

Processes:

File.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	File.exe

C:\Users\Admin\AppData\Local\Temp\File.exe
"C:\Users\Admin\AppData\Local\Temp\File.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA56C.tmp.cmd""
2⤵
- Suspicious use of WriteProcessMemory
PID:2292

C:\Windows\system32\timeout.exe
timeout 4
3⤵
- Delays execution with timeout.exe
PID:4016

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Email Collection

1

T1114

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpA56C.tmp.cmd
Filesize
153B

MD5
39ac3451842af3185a6ee1ae81b126f0

SHA1
21615734dffe9e91930c8da7d36ff1049e26a01c

SHA256
303951788325c518772a04432ff0b4c727410cac600766c8939fd9fe76e0a9bf

SHA512
9e9d00fec5a901471bd1a323a32cfbf4f3894fd3c4122896275b3f5e1b62a18bd3f72ec3c58f824b828ed3af383930d606d137826cee4874c27290678fce1bc2

Download Submit
memory/736-130-0x000001A0D93F0000-0x000001A0D9518000-memory.dmp

Filesize
1.2MB

Download
memory/736-131-0x00007FF9DE280000-0x00007FF9DED41000-memory.dmp

Filesize
10.8MB

Download
memory/736-132-0x000001A0F46E0000-0x000001A0F4702000-memory.dmp

Filesize
136KB

Download
memory/736-133-0x00007FF9DE280000-0x00007FF9DED41000-memory.dmp

Filesize
10.8MB

Download
memory/736-137-0x00007FF9DE280000-0x00007FF9DED41000-memory.dmp

Filesize
10.8MB

Download
memory/2292-134-0x0000000000000000-mapping.dmp

Download
memory/4016-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads