echelon | d74b85d646feda822c37e75a040d6f78c5bb77a2bff573cd1b979a6cee24e14a

General

Target

819b5fb73253e7d3f28317e55d8abe50_JaffaCakes118.exe
Size

3.0MB
MD5

819b5fb73253e7d3f28317e55d8abe50
SHA1

7cf2d9e29f7920fbae1ef3b85de9acdf3a4aca92
SHA256

d74b85d646feda822c37e75a040d6f78c5bb77a2bff573cd1b979a6cee24e14a
SHA512

fd1a72f47c123db28581c4dd38dfe8a2beddee7d48bde58c73095b78e3d786af17313178655e61764a8fd60f64c99877e450d1d8cef5499d1addc89cacfde78d
SSDEEP

49152:sU4hts+ogRQExtgK2NQaovxFiTMboJz75izELu2JuqlVu222lgqvsAMLoTAeGaVU:ghtxoiQQacxLbQz75xTVu2YEAxax

Score

10^/10

echelon spyware stealer

Malware Config

Signatures

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	Clickermann.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	819b5fb73253e7d3f28317e55d8abe50_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4556	Clickermann.exe
432	чит.exe.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	api.ipify.org
15	api.ipify.org
17	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	819b5fb73253e7d3f28317e55d8abe50_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3504	819b5fb73253e7d3f28317e55d8abe50_JaffaCakes118.exe
3504	819b5fb73253e7d3f28317e55d8abe50_JaffaCakes118.exe
3504	819b5fb73253e7d3f28317e55d8abe50_JaffaCakes118.exe
4556	Clickermann.exe
4556	Clickermann.exe
4556	Clickermann.exe
432	чит.exe.exe
432	чит.exe.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	819b5fb73253e7d3f28317e55d8abe50_JaffaCakes118.exe
Token: SeDebugPrivilege	4556	Clickermann.exe
Token: SeDebugPrivilege	432	чит.exe.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 4556	3504	819b5fb73253e7d3f28317e55d8abe50_JaffaCakes118.exe	89
PID 3504 wrote to memory of 4556	3504	819b5fb73253e7d3f28317e55d8abe50_JaffaCakes118.exe	89
PID 4556 wrote to memory of 432	4556	Clickermann.exe	92
PID 4556 wrote to memory of 432	4556	Clickermann.exe	92

C:\Users\Admin\AppData\Local\Temp\819b5fb73253e7d3f28317e55d8abe50_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\819b5fb73253e7d3f28317e55d8abe50_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Users\Admin\AppData\Local\Temp\Clickermann.exe
  "C:\Users\Admin\AppData\Local\Temp\Clickermann.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Users\Admin\AppData\Local\Temp\чит.exe.exe
    "C:\Users\Admin\AppData\Local\Temp\чит.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Clickermann.exe

Filesize
3.0MB

MD5
8becb410816637816e135d434c7c1ba1

SHA1
5136b51d2e9c47d303653ab650678d7d4d23428d

SHA256
5f7889777637e28831aa3c5516e6f004aa271a5a5be6693855c73429930b388d

SHA512
c6d1e0f06a1986c8fa7c5dc2ee574670f572c176e47a60f72572326ecdd1b558a0a3465398ae1ccf7371c58f0207d6a1d358383bd1cd82dfb6610bbb4d482dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\чит.exe.exe

Filesize
1.0MB

MD5
de95d010435edcb75114d1930ce382e9

SHA1
bf31e42580476dd86db963b76762d33544c5a1e3

SHA256
314578eea5e3c96f9e893b65c43646ac1304368a06dd7477413b13903d8e7eec

SHA512
9862e9ce504f1addea1d467f0b4f0286d27fcb419d3f0ff71e9ddac12318903e186b82522224369c9e3c81a7b258bafac1e163239e94f52fe4919ac0bd367f6a

Download Submit
C:\Users\Admin\AppData\Local\uuLTDNy078BFBFF000306D20C3638F836\36078BFBFF000306D20C3638F8uuLTDNy\Browsers\Passwords\Passwords_Edge.txt

Filesize
426B

MD5
42fa959509b3ed7c94c0cf3728b03f6d

SHA1
661292176640beb0b38dc9e7a462518eb592d27d

SHA256
870ef3d2370932a8938faa60abd47d75ea0af98bfa11c82ae8efe9e94fd8be00

SHA512
7def291737d081c93d0cc38ac8d3062fd34d93b68d191eb0d54e9857e0c0afdbcd241471a2e10c28ce8db3b1d1ae0dba2ef6f609cfe8a1e8fe1dd103dba80007

Download Submit
C:\Users\Admin\AppData\Local\uuLTDNy078BFBFF000306D20C3638F836\36078BFBFF000306D20C3638F8uuLTDNy\Grabber\ExpandEnable.txt

Filesize
913KB

MD5
57c59e49c88d938eda80774397d2fd9a

SHA1
2d4554651a9c24ecffb6f216af05463afe32a62d

SHA256
33dd518fca87e28cfec5e59bdcf3b09dcf04498c90c630a81e02652c4416017e

SHA512
2cf101a44762569587e3817723e3e6576fb5ddd5b45f6d8f2cb0a1ade7c0f67c0855f7fd2fbdf12dc28d21d139e8be5f4056cab5109d4f4f0ef237b6cd1123b3

Download Submit
C:\Users\Admin\AppData\Local\uuLTDNy078BFBFF000306D20C3638F836\36078BFBFF000306D20C3638F8uuLTDNy\Grabber\ImportSuspend.png

Filesize
682KB

MD5
6e903c0fa2164912f2f0fe6aa450c908

SHA1
51bf8a07669b6d321b6375a0d630f3436ddee7a4

SHA256
8e77503f3679062c9d9f0f24b9aaf9b907a268337e879dbde7f2372af372cef8

SHA512
ec0376d6dad2075f8d6dc2b7e0cac0e5192e4f2fb4a3ec3a022e7c286c0ba49f23a5cbcba3ee53962cd301ed7c010d5dac77511fec12465599a22a77ec0057a5

Download Submit
memory/432-88-0x0000018DA6800000-0x0000018DA6810000-memory.dmp

Filesize
64KB

Download
memory/432-85-0x0000018D8C130000-0x0000018D8C23A000-memory.dmp

Filesize
1.0MB

Download
memory/432-168-0x00007FFDA4090000-0x00007FFDA4B51000-memory.dmp

Filesize
10.8MB

Download
memory/432-87-0x0000018DA6810000-0x0000018DA6886000-memory.dmp

Filesize
472KB

Download
memory/432-86-0x00007FFDA4090000-0x00007FFDA4B51000-memory.dmp

Filesize
10.8MB

Download
memory/3504-0-0x0000000000F80000-0x000000000127E000-memory.dmp

Filesize
3.0MB

Download
memory/3504-4-0x000000001BED0000-0x000000001BEE0000-memory.dmp

Filesize
64KB

Download
memory/3504-67-0x00007FFDA4090000-0x00007FFDA4B51000-memory.dmp

Filesize
10.8MB

Download
memory/3504-3-0x000000001BED0000-0x000000001BEE0000-memory.dmp

Filesize
64KB

Download
memory/3504-2-0x000000001BED0000-0x000000001BEE0000-memory.dmp

Filesize
64KB

Download
memory/3504-1-0x00007FFDA4090000-0x00007FFDA4B51000-memory.dmp

Filesize
10.8MB

Download
memory/4556-84-0x00007FFDA4090000-0x00007FFDA4B51000-memory.dmp

Filesize
10.8MB

Download
memory/4556-70-0x000000001BC20000-0x000000001BC30000-memory.dmp

Filesize
64KB

Download
memory/4556-66-0x0000000000D30000-0x000000000102C000-memory.dmp

Filesize
3.0MB

Download
memory/4556-69-0x000000001BC20000-0x000000001BC30000-memory.dmp

Filesize
64KB

Download
memory/4556-68-0x00007FFDA4090000-0x00007FFDA4B51000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing