echelon | 9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca

General

Target

9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe
Size

581KB
MD5

77b4883feb5a690e1f58fc8d9143198a
SHA1

b605c1085432eceeadb976f673fcf3cfd3f354cc
SHA256

9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca
SHA512

0948bf74a4375a415326398149907c684e12a631111a10fc6e0902b78081d6768c75b425cff0b6f3f2778c6981f5369ec119816744542e9e6d2feb6553df497a
SSDEEP

12288:L0tUv4VmeO8Ze9FFHAZLJLUf9snBS4csPYae6qfzwAA:HMsHAhhUF54clNf7wB

Score

10^/10

echelon collection discovery spyware stealer

Malware Config

Signatures

Detects Echelon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2992-0-0x000002C7309C0000-0x000002C730A58000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 api.ipify.org
12 api.ipify.org
77 ip-api.com

flow	ioc
11	api.ipify.org
12	api.ipify.org
77	ip-api.com

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe

pid	process
2992	9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe
2992	9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe
2992	9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe

description pid process

Token: SeDebugPrivilege 2992 9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe

description	pid	process
Token: SeDebugPrivilege	2992	9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe

outlook_office_path 1 IoCs

Processes:

9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe

outlook_win_path 1 IoCs

Processes:

9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe

C:\Users\Admin\AppData\Local\Temp\9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe
"C:\Users\Admin\AppData\Local\Temp\9c5560fc76e973e7b2284badfe33788fc541b21fa66c2087e3588bea71235bca.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2992-0-0x000002C7309C0000-0x000002C730A58000-memory.dmp

Filesize
608KB

Download
memory/2992-1-0x00007FFD76EB0000-0x00007FFD77971000-memory.dmp

Filesize
10.8MB

Download
memory/2992-2-0x000002C74B200000-0x000002C74B210000-memory.dmp

Filesize
64KB

Download
memory/2992-3-0x000002C74B210000-0x000002C74B286000-memory.dmp

Filesize
472KB

Download
memory/2992-5-0x00007FFD76EB0000-0x00007FFD77971000-memory.dmp

Filesize
10.8MB

Download
memory/2992-33-0x00007FFD76EB0000-0x00007FFD77971000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads