echelon | 057033912ac6910cf4be03cc32bc326ea72ab688e1993a359749307f96cdaf9f

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-02-2024 01:42

Target

057033912ac6910cf4be03cc32bc326ea72ab688e1993a359749307f96cdaf9f.exe
Size

1.2MB
MD5

2c6c48bbc07c028e0995bad4b48d1198
SHA1

cd96c7a0f47657652cccb306a260bd7d5acabc43
SHA256

057033912ac6910cf4be03cc32bc326ea72ab688e1993a359749307f96cdaf9f
SHA512

fec6221009cdc7c9d076e85596be4a5bc268fa2b4663862faa4d25744abc5080964bfe644da99b5b2d7727b8260baddeb4807090e3c199724ec6f7e026436265
SSDEEP

24576:FpY28mQFgAyyOf39yo0pqdCLA5hVogMYgdk4ZYsl80+vVqmX:8mQqAydf39V0pqcLANSY7qTkz

Score

10^/10

Detects Echelon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2352-0-0x00000000001C0000-0x0000000000448000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

057033912ac6910cf4be03cc32bc326ea72ab688e1993a359749307f96cdaf9f.exe

pid	Process
2352	057033912ac6910cf4be03cc32bc326ea72ab688e1993a359749307f96cdaf9f.exe

C:\Users\Admin\AppData\Local\Temp\057033912ac6910cf4be03cc32bc326ea72ab688e1993a359749307f96cdaf9f.exe
"C:\Users\Admin\AppData\Local\Temp\057033912ac6910cf4be03cc32bc326ea72ab688e1993a359749307f96cdaf9f.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2352

memory/2352-0-0x00000000001C0000-0x0000000000448000-memory.dmp

Filesize
2.5MB

Download
memory/2352-1-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

Filesize
9.9MB

Download
memory/2352-2-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/2352-3-0x000000001B520000-0x000000001B5A0000-memory.dmp

Filesize
512KB

Download
memory/2352-4-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

Filesize
9.9MB

Download