echelon | 0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d

General

Target

0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe
Size

2.3MB
MD5

07aa0a33eb921a940635dd804be277af
SHA1

16e53f37a15dc860d3e2a0a12270785d78569cf7
SHA256

0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d
SHA512

4e0185c618e99d1e2e095ff63b1ca9999a0e91bfd87d2e120e8fcf0c83e3ff113e73f13d9e5a2f17f06f672bcf2e25eef5df5db352aac11eed3b6bf00db177a2
SSDEEP

49152:8CN4LRX+yXXpJX0gRgSSlhSGmpcmueezjO:8CN49X+yHpyuUSpvuPjO

Score

10^/10

echelon evasion spyware stealer

Malware Config

Signatures

Detects Echelon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1748-0-0x0000000000890000-0x0000000000AF2000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.ipify.org
3 api.ipify.org

flow	ioc
2	api.ipify.org
3	api.ipify.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

pid process

1748 0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

description pid process

Token: SeDebugPrivilege 1748 0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

pid	process
1748	0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

description	pid	process
Token: SeDebugPrivilege	1748	0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe

description	pid	process	target process
PID 1748 wrote to memory of 2584	1748	0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe	WerFault.exe
PID 1748 wrote to memory of 2584	1748	0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe	WerFault.exe
PID 1748 wrote to memory of 2584	1748	0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe
"C:\Users\Admin\AppData\Local\Temp\0feb3ed11175361c5974dec8e1030d48eb165ac778d64a28f93bfaa72c21629d.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1748 -s 1316
2⤵
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1748-0-0x0000000000890000-0x0000000000AF2000-memory.dmp

Filesize
2.4MB

Download
memory/1748-1-0x000007FEF53B0000-0x000007FEF5D9C000-memory.dmp

Filesize
9.9MB

Download
memory/1748-2-0x00000000021B0000-0x0000000002230000-memory.dmp

Filesize
512KB

Download
memory/1748-3-0x000000001B1F0000-0x000000001B26A000-memory.dmp

Filesize
488KB

Download
memory/1748-4-0x000007FEF53B0000-0x000007FEF5D9C000-memory.dmp

Filesize
9.9MB

Download
memory/1748-5-0x00000000021B0000-0x0000000002230000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads