Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
04-03-2024 01:16
General
-
Target
fc33d5eff1235391ea7d1f28e50d8a15e630042211bcb1a4dc3616d78b6c43a2.exe
-
Size
581KB
-
MD5
80a90d5cf1639d82b28c78b398acc1f4
-
SHA1
f81ad759dbb843058cfe28776d5c7990db6e6f74
-
SHA256
fc33d5eff1235391ea7d1f28e50d8a15e630042211bcb1a4dc3616d78b6c43a2
-
SHA512
db793d060a82339b9bf87a3e0b2069a4ff720e88161328795026871d90e4cc108726fa28f94cebcac4216847dba3ddaddfc820bd17545e18ca64063bf19f7944
-
SSDEEP
12288:9ctvPYVlNWEZkVlFrGZLJLUf9snBS4csPYae6qfzEAA:usUrGhhUF54clNf7EB
Score
10/10
Malware Config
Signatures
-
Detects Echelon Stealer payload 2 IoCs
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc33d5eff1235391ea7d1f28e50d8a15e630042211bcb1a4dc3616d78b6c43a2.exe"C:\Users\Admin\AppData\Local\Temp\fc33d5eff1235391ea7d1f28e50d8a15e630042211bcb1a4dc3616d78b6c43a2.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2880 -s 12242⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2880-0-0x00000000000B0000-0x0000000000148000-memory.dmpFilesize
608KB
-
memory/2880-1-0x000007FEF5680000-0x000007FEF606C000-memory.dmpFilesize
9.9MB
-
memory/2880-2-0x000000001AFB0000-0x000000001B030000-memory.dmpFilesize
512KB
-
memory/2880-3-0x000007FEF5680000-0x000007FEF606C000-memory.dmpFilesize
9.9MB