Analysis
-
max time kernel
117s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
11-07-2022 12:25
General
-
Target
Lucky Fixed.exe
-
Size
1.5MB
-
MD5
02346b31c94a650a16dea1a262db5153
-
SHA1
a301b0d05d01a35b6e893d3d2ebe9bf8985ae434
-
SHA256
2da5d10cdba79d8a8153eaf7ab3d4aad3afaf14c6d9098f7720858c61910948c
-
SHA512
1b6bd5adc407829ffbfadea6e4d37b0b21baaac926fd909ed9fe0c7084a2f432df11a2640dd6423cff9a8beb0b4e11b272c2a02f48f75b64dc25f8b109838c9a
Malware Config
Signatures
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Lucky Fixed.exe"C:\Users\Admin\AppData\Local\Temp\Lucky Fixed.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Decoder.exe"C:\ProgramData\Decoder.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Decoder.exeFilesize
490KB
MD5c29c0d495ed13e703f433d53bdffdab8
SHA174ed36e6b6027b61abcfe2956670ffd9de7fd71a
SHA25620309707aa6fc678963aace7685a37839d439c850b1ba399bdbfbbeddc10ed4b
SHA512fea4c1066ee6df3ebb29a354678a3d0f1398cd216b92b261296fcff580b00e19cefe24d975beebcc41854cceef3df2702d569811358dae4203a924fb52cf5426
-
C:\ProgramData\Decoder.exeFilesize
490KB
MD5c29c0d495ed13e703f433d53bdffdab8
SHA174ed36e6b6027b61abcfe2956670ffd9de7fd71a
SHA25620309707aa6fc678963aace7685a37839d439c850b1ba399bdbfbbeddc10ed4b
SHA512fea4c1066ee6df3ebb29a354678a3d0f1398cd216b92b261296fcff580b00e19cefe24d975beebcc41854cceef3df2702d569811358dae4203a924fb52cf5426
-
C:\Users\Admin\AppData\Local\Temp\.cmdFilesize
85B
MD573712247036b6a24d16502c57a3e5679
SHA165ca9edadb0773fc34db7dfefe9e6416f1ac17fa
SHA2568bd49d7e7e6b2c2dc16a4cb0eebb8f28892775fad56c9e4aaa22d59f01883cd0
SHA512548eef10b0118f7d907fa19c12de68b47278afffb3eb9460621efb2b711ebcf6b90d0ea1c077fc480e032bf241fb3f8cc995ec1373e301446f89f1a74a6309de
-
memory/484-139-0x00007FFAFC2D0000-0x00007FFAFCD91000-memory.dmpFilesize
10.8MB
-
memory/484-132-0x00007FFAFC2D0000-0x00007FFAFCD91000-memory.dmpFilesize
10.8MB
-
memory/484-131-0x00007FFAFC2D0000-0x00007FFAFCD91000-memory.dmpFilesize
10.8MB
-
memory/484-130-0x0000000000630000-0x00000000007B4000-memory.dmpFilesize
1.5MB
-
memory/2480-135-0x0000000000000000-mapping.dmp
-
memory/2968-137-0x0000000000000000-mapping.dmp
-
memory/4484-133-0x0000000000000000-mapping.dmp
-
memory/4484-140-0x0000000004C50000-0x00000000051F4000-memory.dmpFilesize
5.6MB
-
memory/4484-141-0x0000000006460000-0x00000000064F2000-memory.dmpFilesize
584KB
-
memory/4484-142-0x0000000007390000-0x00000000073F6000-memory.dmpFilesize
408KB