echelon | 62b0221391c3a3b97dc587329b5ecf17e4435515026072f2419503ceefc2a455

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 01:19

Target

62b0221391c3a3b97dc587329b5ecf17e4435515026072f2419503ceefc2a455.exe
Size

780KB
MD5

d8cb800bdea9202ffcfe01bfcbf3f8da
SHA1

0c643c77649b59ddd141d9fa02724b1408d8ca28
SHA256

62b0221391c3a3b97dc587329b5ecf17e4435515026072f2419503ceefc2a455
SHA512

4eb5c8c6f3995d9311a39886a6f40b32074b45a0bd8b200b0dd047dc5d53d39e28dddf336cdffa2f5780097d0d28f5e0c0d8fcd68228755b840d95a2badbfbe9
SSDEEP

12288:9uReJkcXyjgJ7Isn1wA6BBkeDTONbIcAA:seKcnJ7IgwA6DCNbzB

Score

10^/10

Detects Echelon Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2968-0-0x0000000000830000-0x00000000008FA000-memory.dmp	family_echelon
behavioral1/memory/2968-4-0x000000001B2F0000-0x000000001B370000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

62b0221391c3a3b97dc587329b5ecf17e4435515026072f2419503ceefc2a455.exe

description	pid	Process
Token: SeDebugPrivilege	2968	62b0221391c3a3b97dc587329b5ecf17e4435515026072f2419503ceefc2a455.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

62b0221391c3a3b97dc587329b5ecf17e4435515026072f2419503ceefc2a455.exe

description	pid	Process	procid_target
PID 2968 wrote to memory of 1928	2968	62b0221391c3a3b97dc587329b5ecf17e4435515026072f2419503ceefc2a455.exe	29
PID 2968 wrote to memory of 1928	2968	62b0221391c3a3b97dc587329b5ecf17e4435515026072f2419503ceefc2a455.exe	29
PID 2968 wrote to memory of 1928	2968	62b0221391c3a3b97dc587329b5ecf17e4435515026072f2419503ceefc2a455.exe	29

C:\Users\Admin\AppData\Local\Temp\62b0221391c3a3b97dc587329b5ecf17e4435515026072f2419503ceefc2a455.exe
"C:\Users\Admin\AppData\Local\Temp\62b0221391c3a3b97dc587329b5ecf17e4435515026072f2419503ceefc2a455.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2968 -s 1320
  2⤵
  PID:1928

memory/2968-0-0x0000000000830000-0x00000000008FA000-memory.dmp

Filesize
808KB

Download
memory/2968-1-0x000007FEF5FC0000-0x000007FEF69AC000-memory.dmp

Filesize
9.9MB

Download
memory/2968-2-0x000000001B2F0000-0x000000001B370000-memory.dmp

Filesize
512KB

Download
memory/2968-3-0x000007FEF5FC0000-0x000007FEF69AC000-memory.dmp

Filesize
9.9MB

Download
memory/2968-4-0x000000001B2F0000-0x000000001B370000-memory.dmp

Filesize
512KB

Download