echelon | f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-02-2024 01:02

Target

f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe
Size

1.1MB
MD5

0658b52aaefb3b4a5d28b0515e2bed59
SHA1

fafbf3cac415e0e5131c1bf0e47b03467baa4c24
SHA256

f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639
SHA512

549e1edc5bb9d61f73de62d52ee8478b8e5ba35da583873719aceafaa5560aadb15d3bcdf34364e0a49a60f3e8b704a86c490f7830922e298668e1fc987be174
SSDEEP

24576:kSiQ0D95JOYkl/8b6OHQ94CghhUF54clNf7ACA4LdV4wVD:kTThTOY2OwL+o54cl

Score

10^/10

Detects Echelon Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2880-0-0x0000000000820000-0x00000000009EE000-memory.dmp	family_echelon
behavioral1/memory/2880-7-0x000000001B4C0000-0x000000001B540000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2880-0-0x0000000000820000-0x00000000009EE000-memory.dmp	vmprotect
behavioral1/memory/2880-6-0x000000001B4C0000-0x000000001B540000-memory.dmp	vmprotect

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
2	api.ipify.org
3	api.ipify.org

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe

description	pid	Process
Token: SeDebugPrivilege	2880	f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe

description	pid	Process	procid_target
PID 2880 wrote to memory of 2576	2880	f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe	29
PID 2880 wrote to memory of 2576	2880	f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe	29
PID 2880 wrote to memory of 2576	2880	f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe	29

C:\Users\Admin\AppData\Local\Temp\f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe
"C:\Users\Admin\AppData\Local\Temp\f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2880 -s 1240
  2⤵
  PID:2576

memory/2880-0-0x0000000000820000-0x00000000009EE000-memory.dmp

Filesize
1.8MB

Download
memory/2880-1-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download
memory/2880-2-0x000000001B4C0000-0x000000001B540000-memory.dmp

Filesize
512KB

Download
memory/2880-3-0x000000001B4C0000-0x000000001B540000-memory.dmp

Filesize
512KB

Download
memory/2880-4-0x000000001B4C0000-0x000000001B540000-memory.dmp

Filesize
512KB

Download
memory/2880-5-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download
memory/2880-6-0x000000001B4C0000-0x000000001B540000-memory.dmp

Filesize
512KB

Download
memory/2880-7-0x000000001B4C0000-0x000000001B540000-memory.dmp

Filesize
512KB

Download
memory/2880-8-0x000000001B4C0000-0x000000001B540000-memory.dmp

Filesize
512KB

Download