Analysis
-
max time kernel
152s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
15-03-2024 02:01
General
-
Target
262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893.exe
-
Size
1.1MB
-
MD5
fa5eb8fed006a2021e3166aa98840dbc
-
SHA1
1f4ed48d2d15eb7f8020cdf8f85fa4afe4d3cd40
-
SHA256
262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893
-
SHA512
0b8346723df23d96f8d7852eda94398b92c6c6dbc6f1ad40dbd16ad10d991975b958643b53e0722f83a088b4125c6d3e80ce143fc3d3f4236f2a3ae16bf4b76c
-
SSDEEP
12288:4flnY3KLykUX8rsfq4ZqugtyIPDFQk1cWGGJ7jZLJLUf9snBS4csPYae6qfz4uNa:4dqfqOqugtNDFQAjhhUF54clNf77BM
Score
10/10
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893.exe"C:\Users\Admin\AppData\Local\Temp\262540bd67d01a52f4da9d01c2291c09b8547074aed875e5928df271da782893.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.8MB