Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18-01-2024 01:14
Behavioral task
behavioral1
Sample
8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930.exe
Resource
win7-20231215-en
General
-
Target
8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930.exe
-
Size
592KB
-
MD5
52c389a5c951fa6b0c5636ece3b9a4cc
-
SHA1
7ea98e6dc3113e1bb7a89a4b8c3f29f770163b68
-
SHA256
8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930
-
SHA512
6bdbd1dfd21f7db0682972502e632fa006843db79c46265e8199c75f69458ecf6506c3c5b8424d465d004483897056739e2edb73b821205b48a0d7fb6b48f38d
-
SSDEEP
12288:gZhhKDNUUA7ZLJLUf9snBS4csPYae6qfzRAA:gZCxUF7hhUF54clNf7RB
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3044-0-0x0000000000100000-0x000000000019A000-memory.dmp family_echelon -
Stops running service(s) 3 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2756 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930.exedescription pid process Token: SeDebugPrivilege 3044 8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930.execmd.exedescription pid process target process PID 3044 wrote to memory of 2828 3044 8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930.exe cmd.exe PID 3044 wrote to memory of 2828 3044 8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930.exe cmd.exe PID 3044 wrote to memory of 2828 3044 8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930.exe cmd.exe PID 2828 wrote to memory of 2756 2828 cmd.exe sc.exe PID 2828 wrote to memory of 2756 2828 cmd.exe sc.exe PID 2828 wrote to memory of 2756 2828 cmd.exe sc.exe PID 3044 wrote to memory of 2568 3044 8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930.exe WerFault.exe PID 3044 wrote to memory of 2568 3044 8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930.exe WerFault.exe PID 3044 wrote to memory of 2568 3044 8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930.exe"C:\Users\Admin\AppData\Local\Temp\8b7240910326218e895b469398b4e98443ba8aba78e17270659050fb7562f930.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop "MpsSvc"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop "MpsSvc"3⤵
- Launches sc.exe
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3044 -s 15362⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3044-0-0x0000000000100000-0x000000000019A000-memory.dmpFilesize
616KB
-
memory/3044-1-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmpFilesize
9.9MB
-
memory/3044-2-0x000000001AC50000-0x000000001ACD0000-memory.dmpFilesize
512KB
-
memory/3044-3-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmpFilesize
9.9MB
-
memory/3044-4-0x000000001AC50000-0x000000001ACD0000-memory.dmpFilesize
512KB