Analysis
-
max time kernel
210s -
max time network
236s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
29-01-2023 17:36
General
-
Target
329dcb6dad9f6417897aabee2c031e81d1e2fe054c0d30815af204405897dab3.exe
-
Size
682KB
-
MD5
b890b71fc8ae5c295de0727f811f01d9
-
SHA1
aa8fcf80df7d8c5aaa7d6dc8180b7d83746a5230
-
SHA256
329dcb6dad9f6417897aabee2c031e81d1e2fe054c0d30815af204405897dab3
-
SHA512
60bdd8fc317fb2632a738c234ee1a0a7cad5140bffa16860a08247e69e3bbe9074b8a4b6dc32edf706a80717c3ad545d8a29dd25527856c81f2c75f1bbea7fd4
-
SSDEEP
12288:Z2bYlne6BkD5Eg0u81mF8Z6nIiMQoYsS3jid3AbSc6OqImFaRWo:Z2bYlnrkL0fmNnIMtZE35hOgF
Score
10/10
Malware Config
Signatures
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\329dcb6dad9f6417897aabee2c031e81d1e2fe054c0d30815af204405897dab3.exe"C:\Users\Admin\AppData\Local\Temp\329dcb6dad9f6417897aabee2c031e81d1e2fe054c0d30815af204405897dab3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1572-132-0x0000000000980000-0x0000000000A2E000-memory.dmpFilesize
696KB
-
memory/1572-133-0x00007FFA23340000-0x00007FFA23E01000-memory.dmpFilesize
10.8MB
-
memory/1572-134-0x00007FFA23340000-0x00007FFA23E01000-memory.dmpFilesize
10.8MB
-
memory/1572-135-0x00007FFA23340000-0x00007FFA23E01000-memory.dmpFilesize
10.8MB