Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
20-01-2024 01:02
Behavioral task
behavioral1
Sample
818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033.exe
Resource
win7-20231215-en
General
-
Target
818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033.exe
-
Size
592KB
-
MD5
a6c5e33747f3087b1f1c96d5c800aa99
-
SHA1
d3e400f79fb0520deca6eaf52ac030eadec98a71
-
SHA256
818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033
-
SHA512
5339057ce8126bb5fc1c4a2115b4887533761ed5cb54976ec8b2087abf6a4602012cc939c04876a3cbf10ed270b100ee55b20fdecae51fa6952194ee2900fdb8
-
SSDEEP
12288:2ZhhKDNUUA7ZLJLUf9snBS4csPYae6qfzRAA:2ZCxUF7hhUF54clNf7RB
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1220-0-0x0000000000D40000-0x0000000000DDA000-memory.dmp family_echelon -
Stops running service(s) 3 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 5 api.ipify.org -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2772 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033.exedescription pid process Token: SeDebugPrivilege 1220 818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033.execmd.exedescription pid process target process PID 1220 wrote to memory of 2684 1220 818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033.exe cmd.exe PID 1220 wrote to memory of 2684 1220 818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033.exe cmd.exe PID 1220 wrote to memory of 2684 1220 818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033.exe cmd.exe PID 2684 wrote to memory of 2772 2684 cmd.exe sc.exe PID 2684 wrote to memory of 2772 2684 cmd.exe sc.exe PID 2684 wrote to memory of 2772 2684 cmd.exe sc.exe PID 1220 wrote to memory of 2764 1220 818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033.exe WerFault.exe PID 1220 wrote to memory of 2764 1220 818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033.exe WerFault.exe PID 1220 wrote to memory of 2764 1220 818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033.exe"C:\Users\Admin\AppData\Local\Temp\818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop "MpsSvc"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop "MpsSvc"3⤵
- Launches sc.exe
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1220 -s 15642⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1220-0-0x0000000000D40000-0x0000000000DDA000-memory.dmpFilesize
616KB
-
memory/1220-1-0x000007FEF5910000-0x000007FEF62FC000-memory.dmpFilesize
9.9MB
-
memory/1220-2-0x000000001B080000-0x000000001B100000-memory.dmpFilesize
512KB
-
memory/1220-3-0x000007FEF5910000-0x000007FEF62FC000-memory.dmpFilesize
9.9MB
-
memory/1220-4-0x000000001B080000-0x000000001B100000-memory.dmpFilesize
512KB