Analysis
-
max time kernel
144s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
15-03-2024 02:05
General
-
Target
a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64.exe
-
Size
1.0MB
-
MD5
930e7562f89df014ef1b057dd1fa4bde
-
SHA1
62afddf1478753828c9910e5d1f1b565ab6761c7
-
SHA256
a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64
-
SHA512
6c99d12963639c18398839d9bdb8133d12568c188d01b0e74c859e11d9cb0531352fac29fff437ea02cfc12cfa4ff6f780a013c68dfe373f40d3c936787acb6a
-
SSDEEP
24576:kdJmFfqOqugtNDFQcLaBRyhhUF54clNf7/I:kqFyugzXho54cl
Score
10/10
Malware Config
Signatures
-
Detects Echelon Stealer payload 1 IoCs
-
Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
-
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64.exe"C:\Users\Admin\AppData\Local\Temp\a28fd758885394005a0420a25cbdf4b3b2de0839908c2854fd9a8b1a2d672a64.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
10.8MB