echelon | e62a5f82689482fa11c20393ff8d07ff6307a99ca1d91ee5536c9f005f9022fe | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 09:59

Sharing

Report Analysis Logs

General

Target

152faee4029f8e6be7863df6591499e0.exe
Size

586KB
MD5

152faee4029f8e6be7863df6591499e0
SHA1

b2c485102341297a9851b87fd465f8cecc48e6cc
SHA256

e62a5f82689482fa11c20393ff8d07ff6307a99ca1d91ee5536c9f005f9022fe
SHA512

c55014ab9d30e0f49abae8aee0e5b8d6fd0d038b2976d354d48c48288166e2e21ff88bf63965a79824061ce02ac30da56cfd58dba2629833c1dfd4283c8154aa
SSDEEP

12288:I16h+NBCZLJLUf9snBS4csPYae6qfzMAA:I1TChhUF54clNf7MB

Score

10^/10

echelon spyware stealer

Malware Config

Signatures

Detects Echelon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2512-0-0x000000013FFA0000-0x0000000140036000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

C:\Users\Admin\AppData\Local\Temp\152faee4029f8e6be7863df6591499e0.exe
"C:\Users\Admin\AppData\Local\Temp\152faee4029f8e6be7863df6591499e0.exe"
1⤵
PID:2512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-0-0x000000013FFA0000-0x0000000140036000-memory.dmp

Filesize
600KB

Download
memory/2512-1-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download
memory/2512-2-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp

Filesize
9.9MB

Download