echelon | 262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 02:01

Target

262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893.exe
Size

1.1MB
MD5

fa5eb8fed006a2021e3166aa98840dbc
SHA1

1f4ed48d2d15eb7f8020cdf8f85fa4afe4d3cd40
SHA256

262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893
SHA512

0b8346723df23d96f8d7852eda94398b92c6c6dbc6f1ad40dbd16ad10d991975b958643b53e0722f83a088b4125c6d3e80ce143fc3d3f4236f2a3ae16bf4b76c
SSDEEP

12288:4flnY3KLykUX8rsfq4ZqugtyIPDFQk1cWGGJ7jZLJLUf9snBS4csPYae6qfz4uNa:4dqfqOqugtNDFQAjhhUF54clNf77BM

Score

10^/10

Detects Echelon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2584-0-0x0000000000F10000-0x00000000010DC000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2584-0-0x0000000000F10000-0x00000000010DC000-memory.dmp	vmprotect

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
2 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893.exe

description pid process

Token: SeDebugPrivilege 2584 262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893.exe

flow	ioc
3	api.ipify.org
2	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	2584	262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893.exe

description	pid	process	target process
PID 2584 wrote to memory of 2412	2584	262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893.exe	WerFault.exe
PID 2584 wrote to memory of 2412	2584	262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893.exe	WerFault.exe
PID 2584 wrote to memory of 2412	2584	262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893.exe
"C:\Users\Admin\AppData\Local\Temp\262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2584 -s 1252
  2⤵
  PID:2412

memory/2584-0-0x0000000000F10000-0x00000000010DC000-memory.dmp

Filesize
1.8MB

Download
memory/2584-1-0x000007FEF61F0000-0x000007FEF6BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2584-2-0x000000001B5D0000-0x000000001B650000-memory.dmp

Filesize
512KB

Download
memory/2584-3-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2584-4-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2584-5-0x000007FEF61F0000-0x000007FEF6BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2584-6-0x000000001B5D0000-0x000000001B650000-memory.dmp

Filesize
512KB

Download
memory/2584-7-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2584-8-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2584-9-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download