echelon | e62a5f82689482fa11c20393ff8d07ff6307a99ca1d91ee5536c9f005f9022fe | Triage

Analysis

max time kernel
136s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 09:59

Sharing

Report Analysis Logs

General

Target

152faee4029f8e6be7863df6591499e0.exe
Size

586KB
MD5

152faee4029f8e6be7863df6591499e0
SHA1

b2c485102341297a9851b87fd465f8cecc48e6cc
SHA256

e62a5f82689482fa11c20393ff8d07ff6307a99ca1d91ee5536c9f005f9022fe
SHA512

c55014ab9d30e0f49abae8aee0e5b8d6fd0d038b2976d354d48c48288166e2e21ff88bf63965a79824061ce02ac30da56cfd58dba2629833c1dfd4283c8154aa
SSDEEP

12288:I16h+NBCZLJLUf9snBS4csPYae6qfzMAA:I1TChhUF54clNf7MB

Score

10^/10

echelon spyware stealer

Malware Config

Signatures

Detects Echelon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2332-0-0x00000000004C0000-0x0000000000556000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

C:\Users\Admin\AppData\Local\Temp\152faee4029f8e6be7863df6591499e0.exe
"C:\Users\Admin\AppData\Local\Temp\152faee4029f8e6be7863df6591499e0.exe"
1⤵
PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x00000000004C0000-0x0000000000556000-memory.dmp

Filesize
600KB

Download
memory/2332-1-0x00007FFA22360000-0x00007FFA22E21000-memory.dmp

Filesize
10.8MB

Download
memory/2332-3-0x00007FFA22360000-0x00007FFA22E21000-memory.dmp

Filesize
10.8MB

Download