Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25-02-2024 01:02
Behavioral task
behavioral1
Sample
f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe
-
Size
1.1MB
-
MD5
0658b52aaefb3b4a5d28b0515e2bed59
-
SHA1
fafbf3cac415e0e5131c1bf0e47b03467baa4c24
-
SHA256
f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639
-
SHA512
549e1edc5bb9d61f73de62d52ee8478b8e5ba35da583873719aceafaa5560aadb15d3bcdf34364e0a49a60f3e8b704a86c490f7830922e298668e1fc987be174
-
SSDEEP
24576:kSiQ0D95JOYkl/8b6OHQ94CghhUF54clNf7ACA4LdV4wVD:kTThTOY2OwL+o54cl
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/752-0-0x0000020DC2240000-0x0000020DC240E000-memory.dmp family_echelon -
Processes:
resource yara_rule behavioral2/memory/752-0-0x0000020DC2240000-0x0000020DC240E000-memory.dmp vmprotect -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org 6 api.ipify.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exedescription pid process Token: SeDebugPrivilege 752 f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/752-0-0x0000020DC2240000-0x0000020DC240E000-memory.dmpFilesize
1.8MB
-
memory/752-1-0x00007FFA3B4D0000-0x00007FFA3BF91000-memory.dmpFilesize
10.8MB
-
memory/752-2-0x0000020DC27B0000-0x0000020DC27B1000-memory.dmpFilesize
4KB
-
memory/752-3-0x0000020DDCAF0000-0x0000020DDCB00000-memory.dmpFilesize
64KB
-
memory/752-4-0x0000020DDCB00000-0x0000020DDCCF7000-memory.dmpFilesize
2.0MB
-
memory/752-5-0x00007FFA3B4D0000-0x00007FFA3BF91000-memory.dmpFilesize
10.8MB