Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
25-02-2024 01:02
General
-
Target
f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe
-
Size
1.1MB
-
MD5
0658b52aaefb3b4a5d28b0515e2bed59
-
SHA1
fafbf3cac415e0e5131c1bf0e47b03467baa4c24
-
SHA256
f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639
-
SHA512
549e1edc5bb9d61f73de62d52ee8478b8e5ba35da583873719aceafaa5560aadb15d3bcdf34364e0a49a60f3e8b704a86c490f7830922e298668e1fc987be174
-
SSDEEP
24576:kSiQ0D95JOYkl/8b6OHQ94CghhUF54clNf7ACA4LdV4wVD:kTThTOY2OwL+o54cl
Score
10/10
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe"C:\Users\Admin\AppData\Local\Temp\f17bd8ad7bc305c6e066c6051ffda5d7cc61f9aab8c0590b6a4a29ae13860639.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
10.8MB