Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
25-02-2024 01:07
General
-
Target
2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe
-
Size
1.1MB
-
MD5
4f09391934f598db83741393a456e17c
-
SHA1
5386cc0a62afe676249cd50cb109ee88631687a3
-
SHA256
2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb
-
SHA512
eee829f5ae3417d78404267bbd0620aaf366afc1d648989c7829922fda86d0427232e3429eb068780f52b39cc66488e483626ebc6209d8e6db04d27b110535c4
-
SSDEEP
12288:SeSsPfs5iHPO/4jJgX6tSz1wVxvrD/1QmeuKZLJLUf9snBS4csPYae6qfzdUrRn:Sx1qjM6tLVxjDleThhUF54clNf7d+n
Score
10/10
Malware Config
Signatures
-
Detects Echelon Stealer payload 2 IoCs
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe"C:\Users\Admin\AppData\Local\Temp\2ae2ae473ead2143f8e27cee2a31b7ffed95323c9fd0a924e5a33638b49f66eb.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/896-0-0x000002A23E960000-0x000002A23EB34000-memory.dmpFilesize
1.8MB
-
memory/896-1-0x00007FFEF9A50000-0x00007FFEFA511000-memory.dmpFilesize
10.8MB
-
memory/896-3-0x000002A23EED0000-0x000002A23EED1000-memory.dmpFilesize
4KB
-
memory/896-2-0x000002A259200000-0x000002A259210000-memory.dmpFilesize
64KB
-
memory/896-4-0x000002A23EED0000-0x000002A23EED1000-memory.dmpFilesize
4KB
-
memory/896-5-0x000002A259210000-0x000002A259407000-memory.dmpFilesize
2.0MB
-
memory/896-6-0x00007FFEF9A50000-0x00007FFEFA511000-memory.dmpFilesize
10.8MB