echelon | a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 02:05

Target

a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64.exe
Size

1.0MB
MD5

930e7562f89df014ef1b057dd1fa4bde
SHA1

62afddf1478753828c9910e5d1f1b565ab6761c7
SHA256

a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64
SHA512

6c99d12963639c18398839d9bdb8133d12568c188d01b0e74c859e11d9cb0531352fac29fff437ea02cfc12cfa4ff6f780a013c68dfe373f40d3c936787acb6a
SSDEEP

24576:kdJmFfqOqugtNDFQcLaBRyhhUF54clNf7/I:kqFyugzXho54cl

Score

10^/10

Detects Echelon Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2276-0-0x0000000000EB0000-0x000000000107A000-memory.dmp	family_echelon
behavioral1/memory/2276-7-0x000000001B590000-0x000000001B610000-memory.dmp	family_echelon
behavioral1/memory/2276-9-0x000000001B590000-0x000000001B610000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

Processes:

resource	yara_rule
behavioral1/memory/2276-0-0x0000000000EB0000-0x000000000107A000-memory.dmp	vmprotect
behavioral1/memory/2276-6-0x000000001B590000-0x000000001B610000-memory.dmp	vmprotect

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
3	api.ipify.org
2	api.ipify.org

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64.exe

description	pid	Process
Token: SeDebugPrivilege	2276	a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64.exe

description	pid	Process	procid_target
PID 2276 wrote to memory of 2196	2276	a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64.exe	29
PID 2276 wrote to memory of 2196	2276	a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64.exe	29
PID 2276 wrote to memory of 2196	2276	a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64.exe	29

C:\Users\Admin\AppData\Local\Temp\a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64.exe
"C:\Users\Admin\AppData\Local\Temp\a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2276 -s 1244
  2⤵
  PID:2196

memory/2276-0-0x0000000000EB0000-0x000000000107A000-memory.dmp

Filesize
1.8MB

Download
memory/2276-1-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download
memory/2276-2-0x000000001B590000-0x000000001B610000-memory.dmp

Filesize
512KB

Download
memory/2276-4-0x000000001B590000-0x000000001B610000-memory.dmp

Filesize
512KB

Download
memory/2276-3-0x000000001B590000-0x000000001B610000-memory.dmp

Filesize
512KB

Download
memory/2276-5-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download
memory/2276-6-0x000000001B590000-0x000000001B610000-memory.dmp

Filesize
512KB

Download
memory/2276-7-0x000000001B590000-0x000000001B610000-memory.dmp

Filesize
512KB

Download
memory/2276-8-0x000000001B590000-0x000000001B610000-memory.dmp

Filesize
512KB

Download
memory/2276-9-0x000000001B590000-0x000000001B610000-memory.dmp

Filesize
512KB

Download