echelon | 69a8d609e5a41d8d4e97f4e401679f2ab48a317c6e1ca65d08c6c0dd14679248

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-12-2023 01:03

Target

69a8d609e5a41d8d4e97f4e401679f2ab48a317c6e1ca65d08c6c0dd14679248.exe
Size

581KB
MD5

38548a03a3931edbfc2960124240eb03
SHA1

458d686d3a1942b8f7f1c30c5918df2c045463a0
SHA256

69a8d609e5a41d8d4e97f4e401679f2ab48a317c6e1ca65d08c6c0dd14679248
SHA512

67d23fb07cf1b7d5e2158b79d295d0b8da9ddc99dabe1f3d979fbb735b0318a9af51f00d94d0b00a8cab8d79005b88798d9c8a2d7c5bd68567cd4647eaef56a3
SSDEEP

12288:7+cWzZ0iVjP8iwoWrYZLJLUf9snBS4csPYae6qfzVAA:uy1rYhhUF54clNf7VB

Score

10^/10

Detects Echelon Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000DC0000-0x0000000000E58000-memory.dmp	family_echelon
behavioral1/memory/2220-2-0x000000001A720000-0x000000001A7A0000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

69a8d609e5a41d8d4e97f4e401679f2ab48a317c6e1ca65d08c6c0dd14679248.exe

description	pid	Process
Token: SeDebugPrivilege	2220	69a8d609e5a41d8d4e97f4e401679f2ab48a317c6e1ca65d08c6c0dd14679248.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

69a8d609e5a41d8d4e97f4e401679f2ab48a317c6e1ca65d08c6c0dd14679248.exe

description	pid	Process	procid_target
PID 2220 wrote to memory of 2556	2220	69a8d609e5a41d8d4e97f4e401679f2ab48a317c6e1ca65d08c6c0dd14679248.exe	29
PID 2220 wrote to memory of 2556	2220	69a8d609e5a41d8d4e97f4e401679f2ab48a317c6e1ca65d08c6c0dd14679248.exe	29
PID 2220 wrote to memory of 2556	2220	69a8d609e5a41d8d4e97f4e401679f2ab48a317c6e1ca65d08c6c0dd14679248.exe	29

C:\Users\Admin\AppData\Local\Temp\69a8d609e5a41d8d4e97f4e401679f2ab48a317c6e1ca65d08c6c0dd14679248.exe
"C:\Users\Admin\AppData\Local\Temp\69a8d609e5a41d8d4e97f4e401679f2ab48a317c6e1ca65d08c6c0dd14679248.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2220 -s 1272
  2⤵
  PID:2556

memory/2220-0-0x0000000000DC0000-0x0000000000E58000-memory.dmp

Filesize
608KB

Download
memory/2220-1-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

Filesize
9.9MB

Download
memory/2220-2-0x000000001A720000-0x000000001A7A0000-memory.dmp

Filesize
512KB

Download
memory/2220-3-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

Filesize
9.9MB

Download