Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
19-02-2024 01:16
General
-
Target
8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d.exe
-
Size
581KB
-
MD5
4c3eab225aabc7e675e5ca16056aa5dd
-
SHA1
3c28f07eba4a7163e1be5e9e2e0e4fba595832ea
-
SHA256
8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d
-
SHA512
604eb2047921dc92c5b8203847e9b3e7b4fa269a865cc3f2ca49aea388984ea54388f569563a2a1879c07a1c14de39ce368b09d484b5305454ceda8f64d099d5
-
SSDEEP
12288:zu5kjMFW/Yq9a7p8HRZLJLUf9snBS4csPYae6qfzYAA:9cwHRhhUF54clNf7YB
Score
10/10
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d.exe"C:\Users\Admin\AppData\Local\Temp\8793455ff0b8e1ba86950146f3b38eb2f40dd9f31509e51b4179d188469df05d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1736 -s 13522⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1736-0-0x0000000000EA0000-0x0000000000F38000-memory.dmpFilesize
608KB
-
memory/1736-1-0x000007FEF5220000-0x000007FEF5C0C000-memory.dmpFilesize
9.9MB
-
memory/1736-2-0x000000001AEC0000-0x000000001AF40000-memory.dmpFilesize
512KB
-
memory/1736-3-0x000007FEF5220000-0x000007FEF5C0C000-memory.dmpFilesize
9.9MB
-
memory/1736-4-0x000000001AEC0000-0x000000001AF40000-memory.dmpFilesize
512KB