Analysis
-
max time kernel
13s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13-01-2024 01:32
General
-
Target
63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe
-
Size
581KB
-
MD5
e9e69a29f527bb4cad2668b2e2a7ca1b
-
SHA1
fcb3976cc5759d8f0e273d1d1746f45db7f20516
-
SHA256
63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2
-
SHA512
76d83c0c48011612e750e35cb461fe8b580f7a112427765f4bfb5c48757c0c7265c3fe5f2b0312ee81f9a5334978ce741c3b43276b270620b59ce5b9da440c33
-
SSDEEP
12288:Ku5kjMFW/Yq9a7p8rGZLJLUf9snBS4csPYae6qfz3AA:CcwrGhhUF54clNf73B
Score
10/10
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe"C:\Users\Admin\AppData\Local\Temp\63e5f3e3699067e2b20bac97ddb07afdc284a4e75cd8e1ed4fd31d45c4a449b2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5092-0-0x000001D71DD60000-0x000001D71DDF8000-memory.dmpFilesize
608KB
-
memory/5092-1-0x00007FF8F5A70000-0x00007FF8F6531000-memory.dmpFilesize
10.8MB
-
memory/5092-2-0x000001D71FA30000-0x000001D71FA40000-memory.dmpFilesize
64KB
-
memory/5092-3-0x000001D7382E0000-0x000001D738356000-memory.dmpFilesize
472KB
-
memory/5092-36-0x00007FF8F5A70000-0x00007FF8F6531000-memory.dmpFilesize
10.8MB