Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
13-01-2024 01:32
General
-
Target
63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe
-
Size
581KB
-
MD5
e9e69a29f527bb4cad2668b2e2a7ca1b
-
SHA1
fcb3976cc5759d8f0e273d1d1746f45db7f20516
-
SHA256
63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2
-
SHA512
76d83c0c48011612e750e35cb461fe8b580f7a112427765f4bfb5c48757c0c7265c3fe5f2b0312ee81f9a5334978ce741c3b43276b270620b59ce5b9da440c33
-
SSDEEP
12288:Ku5kjMFW/Yq9a7p8rGZLJLUf9snBS4csPYae6qfz3AA:CcwrGhhUF54clNf73B
Score
10/10
Malware Config
Signatures
-
Detects Echelon Stealer payload 2 IoCs
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe"C:\Users\Admin\AppData\Local\Temp\63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1756 -s 12242⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1756-0-0x0000000000100000-0x0000000000198000-memory.dmpFilesize
608KB
-
memory/1756-1-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmpFilesize
9.9MB
-
memory/1756-2-0x000000001AA70000-0x000000001AAF0000-memory.dmpFilesize
512KB
-
memory/1756-3-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmpFilesize
9.9MB