echelon | fbb2992be0509961aa9592a99cd13bdaac8eb4ab140672977fc882bcaf7f8fe2

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 02:01

Target

fbb2992be0509961aa9592a99cd13bdaac8eb4ab140672977fc882bcaf7f8fe2.exe
Size

573KB
MD5

ee000a7fa90440f296205d2bd9c94a23
SHA1

a497e8634d42a15afc7004b010b1c2bc8fc71b93
SHA256

fbb2992be0509961aa9592a99cd13bdaac8eb4ab140672977fc882bcaf7f8fe2
SHA512

7b1fa56b033485dd67595c95122e4c73dad54f41f4366faa69d56ed7d8095eb745e591cc2601ad647d3127ba5481be8d1d99f07aa74fb89c47651f2f3e17248d
SSDEEP

12288:6tYZ/ZLVO2tyAZLJLUf9snBS4csPYae6qfzuQA3r/:6tYZxLBhhUF54clNf7uR3r/

Score

10^/10

Detects Echelon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2792-0-0x0000000000B30000-0x0000000000BC6000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
2	api.ipify.org
3	api.ipify.org

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

fbb2992be0509961aa9592a99cd13bdaac8eb4ab140672977fc882bcaf7f8fe2.exe

description	pid	Process
Token: SeDebugPrivilege	2792	fbb2992be0509961aa9592a99cd13bdaac8eb4ab140672977fc882bcaf7f8fe2.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

fbb2992be0509961aa9592a99cd13bdaac8eb4ab140672977fc882bcaf7f8fe2.exe

description	pid	Process	procid_target
PID 2792 wrote to memory of 2584	2792	fbb2992be0509961aa9592a99cd13bdaac8eb4ab140672977fc882bcaf7f8fe2.exe	29
PID 2792 wrote to memory of 2584	2792	fbb2992be0509961aa9592a99cd13bdaac8eb4ab140672977fc882bcaf7f8fe2.exe	29
PID 2792 wrote to memory of 2584	2792	fbb2992be0509961aa9592a99cd13bdaac8eb4ab140672977fc882bcaf7f8fe2.exe	29

C:\Users\Admin\AppData\Local\Temp\fbb2992be0509961aa9592a99cd13bdaac8eb4ab140672977fc882bcaf7f8fe2.exe
"C:\Users\Admin\AppData\Local\Temp\fbb2992be0509961aa9592a99cd13bdaac8eb4ab140672977fc882bcaf7f8fe2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2792 -s 1220
  2⤵
  PID:2584

memory/2792-0-0x0000000000B30000-0x0000000000BC6000-memory.dmp

Filesize
600KB

Download
memory/2792-1-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Filesize
9.9MB

Download
memory/2792-2-0x000000001B180000-0x000000001B200000-memory.dmp

Filesize
512KB

Download
memory/2792-3-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Filesize
9.9MB

Download