Overview

overview

10

Static

static

10

3bc1d00f06...74.exe

windows7-x64

10

3bc1d00f06...74.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30-03-2024 01:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74.exe

  • Size

    1.5MB

  • MD5

    b48e703173ef1528c021f5378342fed3

  • SHA1

    86c4f91ced9e9090ef17e0a2c1c1f494ddd61e93

  • SHA256

    3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74

  • SHA512

    ab6932abcc92ae8b9404fe54e421c28f59820eba63054ea10ab81c49db739f79a82237f77dfe8527727ba2e30fa12af8bcfc99f23891a3988a73386d46361075

  • SSDEEP

    24576:PFOa+nsJ39LyjbJkQFMhmC+6GD9iS0NYTuothhUF54clNf7zBl:tSnsHyjtk2MYC5GDgIo54cl9z

Score
10/10
echelonevasionpersistencespywarestealer

Malware Config

Signatures

  • Detects Echelon Stealer payload 8 IoCs
  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    stealerspywareechelon
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Drops startup file 2 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 12 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74.exe
    "C:\Users\Admin\AppData\Local\Temp\3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2128
    • \??\c:\users\admin\appdata\local\temp\3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74.exe 
      c:\users\admin\appdata\local\temp\3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74.exe 
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1792
      • C:\ProgramData\Synaptics\Synaptics.exe
        "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
          "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2236
          • C:\ProgramData\Decoder.exe
            "C:\ProgramData\Decoder.exe"
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2960
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Services" /tr "\systems32_bit\systems32.exe" /f
              6⤵
              • Creates scheduled task(s)
              PID:2132
          • C:\Windows\system32\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2024
            • C:\Windows\system32\timeout.exe
              timeout 4
              6⤵
              • Delays execution with timeout.exe
              PID:2112
          • C:\Windows\system32\cmd.exe
            cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp37B3.tmp.cmd""
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2108
            • C:\Windows\system32\timeout.exe
              timeout 4
              6⤵
              • Delays execution with timeout.exe
              PID:572
    • C:\Windows\Resources\Themes\icsys.icn.exe
      C:\Windows\Resources\Themes\icsys.icn.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2052
      • \??\c:\windows\resources\themes\explorer.exe
        c:\windows\resources\themes\explorer.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2700
        • \??\c:\windows\resources\spoolsv.exe
          c:\windows\resources\spoolsv.exe SE
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2476
          • \??\c:\windows\resources\svchost.exe
            c:\windows\resources\svchost.exe
            5⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in System32 directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2608
            • \??\c:\windows\resources\spoolsv.exe
              c:\windows\resources\spoolsv.exe PR
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2540
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:24 /f
              6⤵
              • Creates scheduled task(s)
              PID:1652
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:25 /f
              6⤵
              • Creates scheduled task(s)
              PID:432252
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 01:26 /f
              6⤵
              • Creates scheduled task(s)
              PID:728464
        • C:\Windows\Explorer.exe
          C:\Windows\Explorer.exe
          4⤵
            PID:1872
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
      1⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2500
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {09B2F141-DE61-45F4-B0C4-6772CDAD36C7} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:400872
      • C:\systems32_bit\systems32.exe
        \systems32_bit\systems32.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:401528
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Services" /tr "\systems32_bit\systems32.exe" /f
          3⤵
          • Creates scheduled task(s)
          PID:401660

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Decoder.exe
      Filesize

      39KB

      MD5

      e753a9a4c3a393d9eccc31e5c6aded66

      SHA1

      5501ae71598925711dbee54f6ee1c827dd01d845

      SHA256

      52773fccbe6883ca7465ffe857c3fe7193521f0807bd8462f95bd4ad73be9867

      SHA512

      ee03d79cd24db07c3466cc602a657c9eb33119267b591a64a0d9215e3a80a24e3c435275ccfb5ffd7356def5bf717c5f2d8bc9a5b2daf1950ecf951b5e614c2e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\.cmd
      Filesize

      28B

      MD5

      217407484aac2673214337def8886072

      SHA1

      0f8c4c94064ce1f7538c43987feb5bb2d7fec0c6

      SHA256

      467c28ed423f513128575b1c8c6674ee5671096ff1b14bc4c32deebd89fc1797

      SHA512

      8466383a1cb71ea8b049548fd5a41aaf01c0423743b886cd3cb5007f66bff87d8d5cfa67344451f4490c8f26e4ebf9e306075d5cfc655dc62f0813a456cf1330

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\ZFDF1g5u.xlsm
      Filesize

      17KB

      MD5

      e566fc53051035e1e6fd0ed1823de0f9

      SHA1

      00bc96c48b98676ecd67e81a6f1d7754e4156044

      SHA256

      8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

      SHA512

      a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmp37B3.tmp.cmd
      Filesize

      131B

      MD5

      491332db57876cc1196df68fbabfef3f

      SHA1

      701ab9afdee25ae55a97bd6a30b6539606511be9

      SHA256

      e814260a4d299e46300b156880d7282aca9ffa9ccb18911dadd77714c302763a

      SHA512

      68a36a42567dc8723354112a4c71b191e30db4dee203910e60a432dc185263c4d5912d0b554532afae7a68654479143bfcfd0391b21a7f134bceef223a3e7b59

      Download Submit

    • C:\Windows\Resources\Themes\explorer.exe
      Filesize

      135KB

      MD5

      f5cd617c7af0dea989f6f4a735755ffc

      SHA1

      dd3efe87d78a17a6259c9f047c4ba92e9fb4aeb1

      SHA256

      3869a1008d14d636b5e329611b55838cf85ac7e7e2c89a4d5639ff8c09ce271e

      SHA512

      12a219f72e97d880b79f3ee9d19205e4455fcf60c11234c389ef49aaa9a48c3fcc9127e1822c15b1c6a49fb29a3f9a1fbb267fa75b5f89d3c68d4d4d6be8fb13

      Download Submit

    • C:\Windows\Resources\Themes\icsys.icn.exe
      Filesize

      135KB

      MD5

      5a5f99e5c824c1137b3ab4b5bab4fe73

      SHA1

      423f3ce5205817f1526b10865b1fb196acbf81c3

      SHA256

      5dc470973a9e9ab655bbcbafbae0dac7848f3bbb68886689c0f1564faefca99e

      SHA512

      e224f9cea4606e657b7d2835017905c31cc72c1d445b19d0542f1ee5ff404cf615cb389573c37b548fbe99ab3bc4cec9cc0ff8f10b9b904475453e6526d03ec1

      Download Submit

    • \Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
      Filesize

      631KB

      MD5

      2ecf15082145d0711dba34265ee7a4ce

      SHA1

      4396b4e15867db2f4bd3c2b307840184f893cf17

      SHA256

      a93ff2073d5d3147c9c2e58fb5b5dabc156fdff20c626d2585932fc511703468

      SHA512

      c412503982b989b6bce81b90e1fc839e5601fab1268e768eb812ae34118e1c48cf79359054ba2cb60da676d99f2efdf1c9549a203ea234c7388712928c7562d2

      Download Submit

    • \Users\Admin\AppData\Local\Temp\3bc1d00f0674053b830c8f7dd0524c7cc9e9bc903d8b8ed68ada0a0bfcea8f74.exe 
      Filesize

      1.4MB

      MD5

      1120682075df316620a28c0198cef6a4

      SHA1

      a6cd55e02f1fd57de0bc08386f7faa6460033f65

      SHA256

      2b692ee54ae1326f68226042e2ec048b66beea4e20afd5f18750c2730cb8555a

      SHA512

      54d9458ae7751e4d07112d99dd24aa22859377e2005285f2c5dfa7d1fa830ee960850cf5254023456126360139b46ecacba02cd6113aa371c9e3d86569091c9b

      Download Submit

    • \Windows\Resources\spoolsv.exe
      Filesize

      135KB

      MD5

      c7debc55f30ae70d78bd10bc59eef1ea

      SHA1

      17a83150746f6b2a58183de4e7388a5f07f5a024

      SHA256

      8f9e2ef75c11b5942ef97ff1dafb0deb624ce316a49bd0c0448593d4f7b95c90

      SHA512

      5af6bda4ccadab53a854c2c5261113708d3cbded7749fba38e5b0a76f377a785ab809e580001079e6f8d3bd6ae8adce1cb5224158cdf6ffc22499cee82983fd3

      Download Submit

    • \Windows\Resources\svchost.exe
      Filesize

      135KB

      MD5

      31e38c6cf6c01172a56abd00807faeb2

      SHA1

      450659edc37dab7c281c6b943ab67c59e0422c85

      SHA256

      568dfeb0a722eb92e7d32eb7656ef382a75d9f0741148ea4345dd193420bcfdc

      SHA512

      d073c870cc1ad360c3a78730b92227a0011b92c914f2a156db93aebd7a0c2cd7733d89aa1d7912dffd82c4496b23ed24ee00a2511c2261de2eb82b909733e392

      Download Submit

    • memory/1792-13-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1792-72-0x0000000000400000-0x0000000000560000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/2052-31-0x0000000000290000-0x00000000002AF000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2052-97-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2128-0-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2128-20-0x00000000003E0000-0x00000000003FF000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2128-96-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2236-123-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2236-100-0x000000001ABF0000-0x000000001AC70000-memory.dmp

      Filesize

      512KB

      Download

    • memory/2236-98-0x0000000000B30000-0x0000000000BD4000-memory.dmp

      Filesize

      656KB

      Download

    • memory/2236-99-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2236-101-0x0000000002320000-0x0000000002396000-memory.dmp

      Filesize

      472KB

      Download

    • memory/2452-150-0x0000000000400000-0x0000000000560000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/2452-75-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2452-194-0x0000000000400000-0x0000000000560000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/2452-152-0x0000000000400000-0x0000000000560000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/2452-151-0x0000000000220000-0x0000000000221000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2476-60-0x00000000003E0000-0x00000000003FF000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2476-91-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2500-109-0x00000000720CD000-0x00000000720D8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2500-153-0x00000000720CD000-0x00000000720D8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2500-102-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2540-85-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2540-87-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2608-79-0x00000000002C0000-0x00000000002DF000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2960-121-0x00000000002B0000-0x00000000002C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2960-126-0x000000001BD30000-0x000000001BDB0000-memory.dmp

      Filesize

      512KB

      Download

    • memory/2960-154-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2960-122-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/401528-161-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/401528-162-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/401528-163-0x000000001B5A0000-0x000000001B620000-memory.dmp

      Filesize

      512KB

      Download

    • memory/401528-195-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/401528-196-0x000000001B5A0000-0x000000001B620000-memory.dmp

      Filesize

      512KB

      Download