echelon | 63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-01-2024 01:32

Target

63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe
Size

581KB
MD5

e9e69a29f527bb4cad2668b2e2a7ca1b
SHA1

fcb3976cc5759d8f0e273d1d1746f45db7f20516
SHA256

63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2
SHA512

76d83c0c48011612e750e35cb461fe8b580f7a112427765f4bfb5c48757c0c7265c3fe5f2b0312ee81f9a5334978ce741c3b43276b270620b59ce5b9da440c33
SSDEEP

12288:Ku5kjMFW/Yq9a7p8rGZLJLUf9snBS4csPYae6qfz3AA:CcwrGhhUF54clNf73B

Score

10^/10

Detects Echelon Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1756-0-0x0000000000100000-0x0000000000198000-memory.dmp	family_echelon
behavioral1/memory/1756-2-0x000000001AA70000-0x000000001AAF0000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
2	api.ipify.org
3	api.ipify.org

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe

description	pid	Process
Token: SeDebugPrivilege	1756	63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe

description	pid	Process	procid_target
PID 1756 wrote to memory of 2736	1756	63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe	29
PID 1756 wrote to memory of 2736	1756	63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe	29
PID 1756 wrote to memory of 2736	1756	63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe	29

C:\Users\Admin\AppData\Local\Temp\63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe
"C:\Users\Admin\AppData\Local\Temp\63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1756 -s 1224
  2⤵
  PID:2736

memory/1756-0-0x0000000000100000-0x0000000000198000-memory.dmp

Filesize
608KB

Download
memory/1756-1-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download
memory/1756-2-0x000000001AA70000-0x000000001AAF0000-memory.dmp

Filesize
512KB

Download
memory/1756-3-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Filesize
9.9MB

Download