echelon | 7135b5be3dc2a1cb7f2dc06a6b22bcd2d52a7e999753c4d268ef95fa14cffda9

Analysis

max time kernel
237s
max time network
281s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 01:01

Target

7135b5be3dc2a1cb7f2dc06a6b22bcd2d52a7e999753c4d268ef95fa14cffda9.exe
Size

574KB
MD5

e3d29040c5011f9f95e3ffb35e3aea6e
SHA1

004c45ddd1034b7704ae170321732cc7c0a9c443
SHA256

7135b5be3dc2a1cb7f2dc06a6b22bcd2d52a7e999753c4d268ef95fa14cffda9
SHA512

1beaf5140e160fb1e5ebec739511dc064d036a0f2b36b27f0b1da577c09686624da3035e68af8fbbe4578a5dec5fb0d3bd8289de4758f7cddb04c02c4ba02e5d
SSDEEP

12288:d+pNyY47ela4ZLJLUf9snBS4csPYae6qfzuQAxhp:d+pNZ4KhhUF54clNf7uRDp

Score

10^/10

Detects Echelon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2964-0-0x00000000008A0000-0x0000000000936000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7135b5be3dc2a1cb7f2dc06a6b22bcd2d52a7e999753c4d268ef95fa14cffda9.exe

description pid process

Token: SeDebugPrivilege 2964 7135b5be3dc2a1cb7f2dc06a6b22bcd2d52a7e999753c4d268ef95fa14cffda9.exe

flow	ioc
2	api.ipify.org
3	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	2964	7135b5be3dc2a1cb7f2dc06a6b22bcd2d52a7e999753c4d268ef95fa14cffda9.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7135b5be3dc2a1cb7f2dc06a6b22bcd2d52a7e999753c4d268ef95fa14cffda9.exe

description	pid	process	target process
PID 2964 wrote to memory of 2844	2964	7135b5be3dc2a1cb7f2dc06a6b22bcd2d52a7e999753c4d268ef95fa14cffda9.exe	WerFault.exe
PID 2964 wrote to memory of 2844	2964	7135b5be3dc2a1cb7f2dc06a6b22bcd2d52a7e999753c4d268ef95fa14cffda9.exe	WerFault.exe
PID 2964 wrote to memory of 2844	2964	7135b5be3dc2a1cb7f2dc06a6b22bcd2d52a7e999753c4d268ef95fa14cffda9.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\7135b5be3dc2a1cb7f2dc06a6b22bcd2d52a7e999753c4d268ef95fa14cffda9.exe
"C:\Users\Admin\AppData\Local\Temp\7135b5be3dc2a1cb7f2dc06a6b22bcd2d52a7e999753c4d268ef95fa14cffda9.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2964 -s 1228
  2⤵
  PID:2844

memory/2964-0-0x00000000008A0000-0x0000000000936000-memory.dmp

Filesize
600KB

Download
memory/2964-1-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2964-2-0x000000001AE50000-0x000000001AED0000-memory.dmp

Filesize
512KB

Download
memory/2964-3-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download