Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-02-2024 01:07
Behavioral task
behavioral1
Sample
2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe
Resource
win7-20240221-en
General
-
Target
2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe
-
Size
1.1MB
-
MD5
4f09391934f598db83741393a456e17c
-
SHA1
5386cc0a62afe676249cd50cb109ee88631687a3
-
SHA256
2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb
-
SHA512
eee829f5ae3417d78404267bbd0620aaf366afc1d648989c7829922fda86d0427232e3429eb068780f52b39cc66488e483626ebc6209d8e6db04d27b110535c4
-
SSDEEP
12288:SeSsPfs5iHPO/4jJgX6tSz1wVxvrD/1QmeuKZLJLUf9snBS4csPYae6qfzdUrRn:Sx1qjM6tLVxjDleThhUF54clNf7d+n
Malware Config
Signatures
-
Detects Echelon Stealer payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1812-0-0x0000000000CC0000-0x0000000000E94000-memory.dmp family_echelon behavioral1/memory/1812-7-0x0000000000160000-0x00000000001E0000-memory.dmp family_echelon -
Processes:
resource yara_rule behavioral1/memory/1812-0-0x0000000000CC0000-0x0000000000E94000-memory.dmp vmprotect behavioral1/memory/1812-6-0x0000000000160000-0x00000000001E0000-memory.dmp vmprotect -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 api.ipify.org 3 api.ipify.org -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exedescription pid process Token: SeDebugPrivilege 1812 2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exedescription pid process target process PID 1812 wrote to memory of 2556 1812 2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe WerFault.exe PID 1812 wrote to memory of 2556 1812 2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe WerFault.exe PID 1812 wrote to memory of 2556 1812 2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe"C:\Users\Admin\AppData\Local\Temp\2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1812 -s 12402⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1812-0-0x0000000000CC0000-0x0000000000E94000-memory.dmpFilesize
1.8MB
-
memory/1812-1-0x000007FEF5680000-0x000007FEF606C000-memory.dmpFilesize
9.9MB
-
memory/1812-2-0x0000000000160000-0x00000000001E0000-memory.dmpFilesize
512KB
-
memory/1812-3-0x0000000000160000-0x00000000001E0000-memory.dmpFilesize
512KB
-
memory/1812-4-0x0000000000160000-0x00000000001E0000-memory.dmpFilesize
512KB
-
memory/1812-5-0x000007FEF5680000-0x000007FEF606C000-memory.dmpFilesize
9.9MB
-
memory/1812-6-0x0000000000160000-0x00000000001E0000-memory.dmpFilesize
512KB
-
memory/1812-7-0x0000000000160000-0x00000000001E0000-memory.dmpFilesize
512KB
-
memory/1812-8-0x0000000000160000-0x00000000001E0000-memory.dmpFilesize
512KB
-
memory/1812-9-0x0000000000160000-0x00000000001E0000-memory.dmpFilesize
512KB