echelon | 562720cf37245f6bdf71692343b7d7ccc2187e45979e957b86407a21aa83854c

General

Target

69c10e8fa7d800c4a24b36dffec2cea7.exe
Size

2.4MB
MD5

69c10e8fa7d800c4a24b36dffec2cea7
SHA1

07bea76542382f9613d4de5da9b36abb3276988d
SHA256

562720cf37245f6bdf71692343b7d7ccc2187e45979e957b86407a21aa83854c
SHA512

4cd0dbb29192a8ebc31abd673aa7983a6e2f24e89cc684fb720777aaf5a692010c6f800e1f50b9ffbc9dea397d97a91118a0325cfc4337d83cb2296a6b68bd6f
SSDEEP

49152:IzecMn91vjBteouiARLrW8oj12yoYBGfUjAIgX2z2r:gu9dNtb4nWpjIYBCv9

Score

10^/10

echelon zgrat rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 35 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1672-17-0x0000000002370000-0x000000000240C000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-24-0x0000000002270000-0x000000000230A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-26-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-32-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-30-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-42-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-44-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-46-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-58-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-70-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-72-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-76-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-74-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-82-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-88-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-86-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-84-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-80-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-78-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-68-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-66-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-64-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-62-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-60-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-56-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-54-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-52-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-50-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-48-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-40-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-38-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-36-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-34-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-28-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1
behavioral1/memory/1672-25-0x0000000002270000-0x0000000002304000-memory.dmp	family_zgrat_v1

Detects Echelon Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1940-1-0x0000000000B30000-0x00000000010E6000-memory.dmp	family_echelon
behavioral1/memory/1940-18-0x0000000000B30000-0x00000000010E6000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 1 IoCs

Processes:

Decoder.exe

pid process

1672 Decoder.exe
Loads dropped DLL 1 IoCs

Processes:

69c10e8fa7d800c4a24b36dffec2cea7.exe

pid process

1940 69c10e8fa7d800c4a24b36dffec2cea7.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org
4 api.ipify.org
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

69c10e8fa7d800c4a24b36dffec2cea7.exe

pid process

1940 69c10e8fa7d800c4a24b36dffec2cea7.exe
1940 69c10e8fa7d800c4a24b36dffec2cea7.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

2672 timeout.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

69c10e8fa7d800c4a24b36dffec2cea7.exeDecoder.exe

description pid process

Token: SeDebugPrivilege 1940 69c10e8fa7d800c4a24b36dffec2cea7.exe
Token: SeDebugPrivilege 1672 Decoder.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

69c10e8fa7d800c4a24b36dffec2cea7.exe

pid process

1940 69c10e8fa7d800c4a24b36dffec2cea7.exe

pid	process
1672	Decoder.exe

pid	process
1940	69c10e8fa7d800c4a24b36dffec2cea7.exe

flow	ioc
5	api.ipify.org
4	api.ipify.org

pid	process
1940	69c10e8fa7d800c4a24b36dffec2cea7.exe
1940	69c10e8fa7d800c4a24b36dffec2cea7.exe

pid	process
2672	timeout.exe

description	pid	process
Token: SeDebugPrivilege	1940	69c10e8fa7d800c4a24b36dffec2cea7.exe
Token: SeDebugPrivilege	1672	Decoder.exe

pid	process
1940	69c10e8fa7d800c4a24b36dffec2cea7.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

69c10e8fa7d800c4a24b36dffec2cea7.execmd.exe

description	pid	process	target process
PID 1940 wrote to memory of 1672	1940	69c10e8fa7d800c4a24b36dffec2cea7.exe	Decoder.exe
PID 1940 wrote to memory of 1672	1940	69c10e8fa7d800c4a24b36dffec2cea7.exe	Decoder.exe
PID 1940 wrote to memory of 1672	1940	69c10e8fa7d800c4a24b36dffec2cea7.exe	Decoder.exe
PID 1940 wrote to memory of 1672	1940	69c10e8fa7d800c4a24b36dffec2cea7.exe	Decoder.exe
PID 1940 wrote to memory of 2432	1940	69c10e8fa7d800c4a24b36dffec2cea7.exe	cmd.exe
PID 1940 wrote to memory of 2432	1940	69c10e8fa7d800c4a24b36dffec2cea7.exe	cmd.exe
PID 1940 wrote to memory of 2432	1940	69c10e8fa7d800c4a24b36dffec2cea7.exe	cmd.exe
PID 1940 wrote to memory of 2432	1940	69c10e8fa7d800c4a24b36dffec2cea7.exe	cmd.exe
PID 2432 wrote to memory of 2672	2432	cmd.exe	timeout.exe
PID 2432 wrote to memory of 2672	2432	cmd.exe	timeout.exe
PID 2432 wrote to memory of 2672	2432	cmd.exe	timeout.exe
PID 2432 wrote to memory of 2672	2432	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\69c10e8fa7d800c4a24b36dffec2cea7.exe
"C:\Users\Admin\AppData\Local\Temp\69c10e8fa7d800c4a24b36dffec2cea7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940

C:\ProgramData\Decoder.exe
"C:\ProgramData\Decoder.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""
2⤵
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\SysWOW64\timeout.exe
timeout 4
3⤵
- Delays execution with timeout.exe
PID:2672

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Decoder.exe
Filesize
2KB

MD5
5460a85ab22b67a0995b1f7710eb07c9

SHA1
6840935177c9373438016d6fd69b9bfe8dcf8110

SHA256
5b34d38f765004981f0c8f7695b7992e3d81f3161d3a796c173aadb4522014b8

SHA512
e36bb4ed10d15a53aac9a8ead5429bb0a9e4b91e362804fa2aaf50d39921c39adea598caf6d0ba7b1a16bc1474d09e925dcc67bbb09743e7cab8e93d731ce745

Download Submit
C:\Users\Admin\AppData\Local\Temp\.cmd
Filesize
28B

MD5
217407484aac2673214337def8886072

SHA1
0f8c4c94064ce1f7538c43987feb5bb2d7fec0c6

SHA256
467c28ed423f513128575b1c8c6674ee5671096ff1b14bc4c32deebd89fc1797

SHA512
8466383a1cb71ea8b049548fd5a41aaf01c0423743b886cd3cb5007f66bff87d8d5cfa67344451f4490c8f26e4ebf9e306075d5cfc655dc62f0813a456cf1330

Download Submit
\ProgramData\Decoder.exe
Filesize
490KB

MD5
c29c0d495ed13e703f433d53bdffdab8

SHA1
74ed36e6b6027b61abcfe2956670ffd9de7fd71a

SHA256
20309707aa6fc678963aace7685a37839d439c850b1ba399bdbfbbeddc10ed4b

SHA512
fea4c1066ee6df3ebb29a354678a3d0f1398cd216b92b261296fcff580b00e19cefe24d975beebcc41854cceef3df2702d569811358dae4203a924fb52cf5426

Download Submit
memory/1672-76-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-36-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-413-0x00000000021D0000-0x0000000002210000-memory.dmp

Filesize
256KB

Download
memory/1672-74-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-25-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-28-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-17-0x0000000002370000-0x000000000240C000-memory.dmp

Filesize
624KB

Download
memory/1672-22-0x00000000021D0000-0x0000000002210000-memory.dmp

Filesize
256KB

Download
memory/1672-34-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-20-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1672-23-0x00000000021D0000-0x0000000002210000-memory.dmp

Filesize
256KB

Download
memory/1672-24-0x0000000002270000-0x000000000230A000-memory.dmp

Filesize
616KB

Download
memory/1672-26-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-32-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-30-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-42-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-44-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-46-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-58-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-70-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-72-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-82-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-412-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1672-38-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-80-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-86-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-84-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-88-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-78-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-68-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-66-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-64-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-62-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-60-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-56-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-54-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-52-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-50-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-48-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1672-40-0x0000000002270000-0x0000000002304000-memory.dmp

Filesize
592KB

Download
memory/1940-4-0x00000000062C0000-0x0000000006336000-memory.dmp

Filesize
472KB

Download
memory/1940-0-0x0000000000B30000-0x00000000010E6000-memory.dmp

Filesize
5.7MB

Download
memory/1940-21-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1940-18-0x0000000000B30000-0x00000000010E6000-memory.dmp

Filesize
5.7MB

Download
memory/1940-1-0x0000000000B30000-0x00000000010E6000-memory.dmp

Filesize
5.7MB

Download
memory/1940-2-0x0000000074760000-0x0000000074E4E000-memory.dmp

Filesize
6.9MB

Download
memory/1940-3-0x0000000006470000-0x00000000064B0000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads