echelon | 2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-02-2024 01:07

Target

2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe
Size

1.1MB
MD5

4f09391934f598db83741393a456e17c
SHA1

5386cc0a62afe676249cd50cb109ee88631687a3
SHA256

2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb
SHA512

eee829f5ae3417d78404267bbd0620aaf366afc1d648989c7829922fda86d0427232e3429eb068780f52b39cc66488e483626ebc6209d8e6db04d27b110535c4
SSDEEP

12288:SeSsPfs5iHPO/4jJgX6tSz1wVxvrD/1QmeuKZLJLUf9snBS4csPYae6qfzdUrRn:Sx1qjM6tLVxjDleThhUF54clNf7d+n

Score

10^/10

Detects Echelon Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1812-0-0x0000000000CC0000-0x0000000000E94000-memory.dmp	family_echelon
behavioral1/memory/1812-7-0x0000000000160000-0x00000000001E0000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/1812-0-0x0000000000CC0000-0x0000000000E94000-memory.dmp	vmprotect
behavioral1/memory/1812-6-0x0000000000160000-0x00000000001E0000-memory.dmp	vmprotect

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe

description pid process

Token: SeDebugPrivilege 1812 2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe

flow	ioc
2	api.ipify.org
3	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	1812	2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe

description	pid	process	target process
PID 1812 wrote to memory of 2556	1812	2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe	WerFault.exe
PID 1812 wrote to memory of 2556	1812	2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe	WerFault.exe
PID 1812 wrote to memory of 2556	1812	2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe
"C:\Users\Admin\AppData\Local\Temp\2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1812 -s 1240
  2⤵
  PID:2556

memory/1812-0-0x0000000000CC0000-0x0000000000E94000-memory.dmp

Filesize
1.8MB

Download
memory/1812-1-0x000007FEF5680000-0x000007FEF606C000-memory.dmp

Filesize
9.9MB

Download
memory/1812-2-0x0000000000160000-0x00000000001E0000-memory.dmp

Filesize
512KB

Download
memory/1812-3-0x0000000000160000-0x00000000001E0000-memory.dmp

Filesize
512KB

Download
memory/1812-4-0x0000000000160000-0x00000000001E0000-memory.dmp

Filesize
512KB

Download
memory/1812-5-0x000007FEF5680000-0x000007FEF606C000-memory.dmp

Filesize
9.9MB

Download
memory/1812-6-0x0000000000160000-0x00000000001E0000-memory.dmp

Filesize
512KB

Download
memory/1812-7-0x0000000000160000-0x00000000001E0000-memory.dmp

Filesize
512KB

Download
memory/1812-8-0x0000000000160000-0x00000000001E0000-memory.dmp

Filesize
512KB

Download
memory/1812-9-0x0000000000160000-0x00000000001E0000-memory.dmp

Filesize
512KB

Download