Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-01-2024 01:06
Static task
static1
Behavioral task
behavioral1
Sample
4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79.exe
Resource
win7-20231129-en
General
-
Target
4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79.exe
-
Size
649KB
-
MD5
d87dbaf2295af3f2f55f7ca333b4668f
-
SHA1
95aa151d52ce3174d4d0e909c8e14e8373e4506a
-
SHA256
4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79
-
SHA512
992b8d780758003e237e5c4c3b8eb9cd5276f79965d58976ce0b93128a95346927ee122294b8dea2c8f46aea4b7ab46c916099fbf60b15cc4987dec34217d0a3
-
SSDEEP
12288:jBdlwHRn+WlYV+8T+tkU5bw6g8h+Y409dMCZyH0FVI8QV:jBkVdlYAK23FNZyHf8QV
Malware Config
Signatures
-
Detects Echelon Stealer payload 3 IoCs
resource yara_rule behavioral1/files/0x000b000000014af6-3.dat family_echelon behavioral1/memory/3040-18-0x0000000001240000-0x00000000012DA000-memory.dmp family_echelon behavioral1/memory/3040-20-0x0000000000230000-0x00000000002B0000-memory.dmp family_echelon -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 3040 Echelon.exe -
Loads dropped DLL 5 IoCs
pid Process 1044 4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79.exe 1044 4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79.exe 1044 4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79.exe 1044 4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79.exe 1044 4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2148 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3040 Echelon.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1044 wrote to memory of 3040 1044 4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79.exe 28 PID 1044 wrote to memory of 3040 1044 4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79.exe 28 PID 1044 wrote to memory of 3040 1044 4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79.exe 28 PID 1044 wrote to memory of 3040 1044 4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79.exe 28 PID 3040 wrote to memory of 2712 3040 Echelon.exe 30 PID 3040 wrote to memory of 2712 3040 Echelon.exe 30 PID 3040 wrote to memory of 2712 3040 Echelon.exe 30 PID 2712 wrote to memory of 2148 2712 cmd.exe 32 PID 2712 wrote to memory of 2148 2712 cmd.exe 32 PID 2712 wrote to memory of 2148 2712 cmd.exe 32 PID 3040 wrote to memory of 2852 3040 Echelon.exe 33 PID 3040 wrote to memory of 2852 3040 Echelon.exe 33 PID 3040 wrote to memory of 2852 3040 Echelon.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79.exe"C:\Users\Admin\AppData\Local\Temp\4d02168925f891eba820a3d8050fdf7a3de7ddd9a3aabb529dfa45ae6e540f79.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Echelon.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Echelon.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop "MpsSvc"3⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\system32\sc.exesc stop "MpsSvc"4⤵
- Launches sc.exe
PID:2148
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3040 -s 15323⤵PID:2852
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
592KB
MD5a6c5e33747f3087b1f1c96d5c800aa99
SHA1d3e400f79fb0520deca6eaf52ac030eadec98a71
SHA256818d899f97b141d991937b1d39936ead0a845022ea685c7e83aef1fd55838033
SHA5125339057ce8126bb5fc1c4a2115b4887533761ed5cb54976ec8b2087abf6a4602012cc939c04876a3cbf10ed270b100ee55b20fdecae51fa6952194ee2900fdb8