echelon | ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687

Resubmissions

06/04/2023, 22:39

230406-2lbe9sfe28 10

31/01/2022, 03:40

220131-d79yysfba2 6

Analysis

max time kernel
29s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
06/04/2023, 22:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687.exe
Size

390KB
MD5

f407b3f68d5603c74c810ba16c08ec9d
SHA1

0f3aac3d2ea898b4722d08dd6fcca0b9a861528b
SHA256

ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687
SHA512

c41ca7fd1e827ba819b77c2349c6fdc621d61437a37193700beb7888e8f51efe9f160fca801fae451c38243c47885864c08896cf93b18986bda9519ad9b9ccf3
SSDEEP

6144:Kj+GKiZ5N2T3dSRcmvmtfYZSAQxGOVP2IkJ8PlMTIwZhYLMBKMYE96B7NtHf798:KVFUrdWcvY8lV+I4gTw3kMBKL26BBtj

Score

10^/10

echelon spyware stealer

Malware Config

Signatures

Detects Echelon Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/2000-55-0x000000001A770000-0x000000001A80A000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
4	api.ipify.org

Program crash 1 IoCs

pid	pid_target	Process	procid_target
892	2000	WerFault.exe	25

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 892	2000	ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687.exe	27
PID 2000 wrote to memory of 892	2000	ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687.exe	27
PID 2000 wrote to memory of 892	2000	ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687.exe	27

C:\Users\Admin\AppData\Local\Temp\ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687.exe
"C:\Users\Admin\AppData\Local\Temp\ea9d870a9260fddc829194c8288fec41075bfa24fd1a0cb2988b538efe329687.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2000 -s 1384
  2⤵
  - Program crash
  PID:892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-54-0x00000000008D0000-0x0000000000938000-memory.dmp

Filesize
416KB

Download
memory/2000-55-0x000000001A770000-0x000000001A80A000-memory.dmp

Filesize
616KB

Download
memory/2000-56-0x0000000002000000-0x0000000002080000-memory.dmp

Filesize
512KB

Download