echelon | 8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-02-2024 01:16

Target

8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d.exe
Size

581KB
MD5

4c3eab225aabc7e675e5ca16056aa5dd
SHA1

3c28f07eba4a7163e1be5e9e2e0e4fba595832ea
SHA256

8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d
SHA512

604eb2047921dc92c5b8203847e9b3e7b4fa269a865cc3f2ca49aea388984ea54388f569563a2a1879c07a1c14de39ce368b09d484b5305454ceda8f64d099d5
SSDEEP

12288:zu5kjMFW/Yq9a7p8HRZLJLUf9snBS4csPYae6qfzYAA:9cwHRhhUF54clNf7YB

Score

10^/10

Detects Echelon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1736-0-0x0000000000EA0000-0x0000000000F38000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d.exe

description pid process

Token: SeDebugPrivilege 1736 8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	1736	8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d.exe

description	pid	process	target process
PID 1736 wrote to memory of 2700	1736	8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d.exe	WerFault.exe
PID 1736 wrote to memory of 2700	1736	8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d.exe	WerFault.exe
PID 1736 wrote to memory of 2700	1736	8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d.exe
"C:\Users\Admin\AppData\Local\Temp\8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1736 -s 1352
  2⤵
  PID:2700

memory/1736-0-0x0000000000EA0000-0x0000000000F38000-memory.dmp

Filesize
608KB

Download
memory/1736-1-0x000007FEF5220000-0x000007FEF5C0C000-memory.dmp

Filesize
9.9MB

Download
memory/1736-2-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download
memory/1736-3-0x000007FEF5220000-0x000007FEF5C0C000-memory.dmp

Filesize
9.9MB

Download
memory/1736-4-0x000000001AEC0000-0x000000001AF40000-memory.dmp

Filesize
512KB

Download