Overview

overview

10

Static

static

10

6d298ea9fd...4e.exe

windows7-x64

10

6d298ea9fd...4e.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-01-2024 11:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6d298ea9fddcb15bc12be3699b88724e.exe

  • Size

    1.0MB

  • MD5

    6d298ea9fddcb15bc12be3699b88724e

  • SHA1

    946732233c9490060639a44ea593f2ccd6ddc30b

  • SHA256

    74499fe96913a5ec1b89d8b79ca8bf2d3fd598c0d65339bd6d6223599f20aa7b

  • SHA512

    40e40caaf22651eb749694b1827f1902c89935bb5f40baf7ec3c68bfd277b68bd76c3a7c54cfa4ce7959b7067b6fb00ec1513f57e330df7790a95e7ed6ebc8ed

  • SSDEEP

    24576:PjE5gAVhhUF54clNf7+6uHAW92zt/sWu2BSMCqDoR4E:yo54clgLH+tkWJ0Nj

Score
10/10
echelonspywarestealer

Malware Config

Signatures

  • Detects Echelon Stealer payload 1 IoCs
  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    stealerspywareechelon
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d298ea9fddcb15bc12be3699b88724e.exe
    "C:\Users\Admin\AppData\Local\Temp\6d298ea9fddcb15bc12be3699b88724e.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3464

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\HPVuZVZBFTFwJuDVFZDL078BFBFF000306D22ED8715E80\80078BFBFF000306D22ED8715EHPVuZVZBFTFwJuDVFZDL\Browsers\Passwords\Passwords_Edge.txt
    Filesize

    426B

    MD5

    42fa959509b3ed7c94c0cf3728b03f6d

    SHA1

    661292176640beb0b38dc9e7a462518eb592d27d

    SHA256

    870ef3d2370932a8938faa60abd47d75ea0af98bfa11c82ae8efe9e94fd8be00

    SHA512

    7def291737d081c93d0cc38ac8d3062fd34d93b68d191eb0d54e9857e0c0afdbcd241471a2e10c28ce8db3b1d1ae0dba2ef6f609cfe8a1e8fe1dd103dba80007

    Download Submit
  • memory/3464-0-0x00000000005A0000-0x00000000006A6000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/3464-1-0x00007FF9B66F0000-0x00007FF9B71B1000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/3464-2-0x000000001C320000-0x000000001C330000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3464-3-0x000000001C240000-0x000000001C2B6000-memory.dmp
    Filesize

    472KB

    Download
  • memory/3464-49-0x00007FF9B66F0000-0x00007FF9B71B1000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/3464-64-0x000000001C320000-0x000000001C330000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3464-76-0x00007FF9B66F0000-0x00007FF9B71B1000-memory.dmp
    Filesize

    10.8MB

    Download