Overview

overview

10

Static

static

10

a08b92e0ef...b4.exe

windows7-x64

10

a08b92e0ef...b4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    55s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2024, 01:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a08b92e0ef621c731c9c9a0a38095df4515f95c8200e508d772cf533395bcab4.exe
  • Size 1.5MB
  • Sample240129-bhsx2aegb5
  • SHA256 a08b92e0ef621c731c9c9a0a38095df4515f95c8200e508d772cf533395bcab4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
echelonspywarestealer

Malware Config

Signatures

  • Detects Echelon Stealer payload 1 IoCs
  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    stealerspywareechelon
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a08b92e0ef621c731c9c9a0a38095df4515f95c8200e508d772cf533395bcab4.exe
    "C:\Users\Admin\AppData\Local\Temp\a08b92e0ef621c731c9c9a0a38095df4515f95c8200e508d772cf533395bcab4.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3156

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Computer.txt
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Computer.txt
        • Size 302B
        • SHA256 8455e42e6b24776f081414bc93407354a3ed37984e166d6b50faa5038bd45a34
        • MD5 SHA1 SHA512
        Submit Download

        Are.docx
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Grabber\Are.docx
        • Size 11KB
        • SHA256 5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Files.docx
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Grabber\Files.docx
        • Size 11KB
        • SHA256 714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Opened.docx
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Grabber\Opened.docx
        • Size 11KB
        • SHA256 272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Recently.docx
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Grabber\Recently.docx
        • Size 11KB
        • SHA256 07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ResetEdit.jpg
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Grabber\ResetEdit.jpg
        • Size 228KB
        • SHA256 2e0166bd1a12fd035e6fde12b0027795dc2390fea5deaed2025ba9d9ed94b6c8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        These.docx
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Grabber\These.docx
        • Size 11KB
        • SHA256 57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UnlockOpen.mp3
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Grabber\UnlockOpen.mp3
        • Size 283KB
        • SHA256 2dcd682ecca7a1544c17e7be6136fceac6564338d0d2bd19d8432beb5676d0d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UnregisterMerge.cfg
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Grabber\UnregisterMerge.cfg
        • Size 255KB
        • SHA256 a2fe44637b988bba6ca2cd73cc75b986c2f386fc6602faae71c56eaa8f593ee1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Processes.txt
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Processes.txt
        • Size 950B
        • SHA256 57d7a407022226978994d5e9c369ade24f47044b041611386029bc1f0f3a8f17
        • MD5 SHA1 SHA512
        Submit Download

        Processes.txt
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Processes.txt
        • Size 925B
        • SHA256 615a341d630cf4b9cf0a2c4832c9e8f3484de387b6c0af2b74c82047493ed019
        • MD5 SHA1 SHA512
        Submit Download

        Processes.txt
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Processes.txt
        • Size 930B
        • SHA256 86e4ac1f93f9127280b3bf281cc964281fdf9731f72aae1a4968eaabf2ed0ea2
        • MD5 SHA1 SHA512
        Submit Download

        Processes.txt
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Processes.txt
        • Size 919B
        • SHA256 3fc208bdbafc66dec5ea6d2cbd6d04de9019f4885908e8c96a18ca1f5bb8433d
        • MD5 SHA1 SHA512
        Submit Download

        Screenshot.Jpeg
        • Path C:\Users\Admin\AppData\Local\Temp\VL078BFBFF000306D2CE1374FC19\19078BFBFF000306D2CE1374FCVL\Screenshot.Jpeg
        • Size 81KB
        • SHA256 c1ed8dd626bdbaa2a3c837b756391518adee9a4049730ad76b63bfe486112626
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bd078BFBFF000306D2CE1374FC.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\bd078BFBFF000306D2CE1374FC.tmp
        • Size 46KB
        • SHA256 522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bd078BFBFF000306D2CE1374FC.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\bd078BFBFF000306D2CE1374FC.tmp
        • Size 148KB
        • SHA256 7cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bd078BFBFF000306D2CE1374FC.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\bd078BFBFF000306D2CE1374FC.tmp
        • Size 20KB
        • SHA256 4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        bd078BFBFF000306D2CE1374FC.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\bd078BFBFF000306D2CE1374FC.tmp
        • Size 92KB
        • SHA256 c44cbdf2dbfb3ea10d471fa39c9b63e6e2fc00f1add109d51419b208a426f4d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ls078BFBFF000306D2CE1374FC.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\ls078BFBFF000306D2CE1374FC.tmp
        • Size 114KB
        • SHA256 dc0ec54293d20a9453594fb294900ebbb4c9353cee08c14a52a8a18b0c73cc66
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tempDataBase2024-01-29T01_09_23.2229780+00_001515
        • Path C:\Users\Admin\AppData\Local\Temp\tempDataBase2024-01-29T01_09_23.2229780+00_001515
        • Size 96KB
        • SHA256 0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tempDataBase2024-01-29T01_09_23.3323590+00_001515
        • Path C:\Users\Admin\AppData\Local\Temp\tempDataBase2024-01-29T01_09_23.3323590+00_001515
        • Size 288KB
        • SHA256 8a23da9513c1834922811f8b4f4379922101d0e6debac3926c5da01936d101bd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3156-0-0x000001D4BFD20000-0x000001D4BFEA2000-memory.dmp
        Download

        memory/3156-1-0x00007FFEC3D10000-0x00007FFEC47D1000-memory.dmp
        Download

        memory/3156-558-0x00007FFEC3D10000-0x00007FFEC47D1000-memory.dmp
        Download

        memory/3156-627-0x000001D4DA3C0000-0x000001D4DA3D0000-memory.dmp
        Download

        memory/3156-3-0x000001D4DA320000-0x000001D4DA396000-memory.dmp
        Download

        memory/3156-2-0x000001D4DA3C0000-0x000001D4DA3D0000-memory.dmp
        Download

        memory/3156-1537-0x00007FFEC3D10000-0x00007FFEC47D1000-memory.dmp
        Download