echelon | hxxps://dosya[.]co/d2ucyv70iys0/logger[.]zip[.]html

Analysis

max time kernel
279s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2024 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://dosya.co/d2ucyv70iys0/logger.zip.html

Score

10^/10

echelon collection discovery spyware stealer

Malware Config

Signatures

Detects Echelon Stealer payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\logger\Echelon.exe	family_echelon
behavioral1/memory/4720-169-0x000001FE47EB0000-0x000001FE47F48000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
Executes dropped EXE 3 IoCs

Processes:

Echelon.exeEchelon.exeEchelon.exe

pid process

4720 Echelon.exe
212 Echelon.exe
4680 Echelon.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4720	Echelon.exe
212	Echelon.exe
4680	Echelon.exe

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

Processes:

Echelon.exeEchelon.exeEchelon.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Echelon.exe
Key opened	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Echelon.exe
Key opened	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Echelon.exe
Key opened	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Echelon.exe
Key opened	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Echelon.exe
Key opened	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Echelon.exe
Key opened	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Echelon.exe
Key opened	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Echelon.exe
Key opened	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Echelon.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

201 ip-api.com
376 api.ipify.org
399 api.ipify.org
411 ip-api.com
173 api.ipify.org
174 api.ipify.org

flow	ioc
201	ip-api.com
376	api.ipify.org
399	api.ipify.org
411	ip-api.com
173	api.ipify.org
174	api.ipify.org

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exeEchelon.exemsedge.exeEchelon.exeEchelon.exe

pid	process
3552	msedge.exe
3552	msedge.exe
4000	msedge.exe
4000	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe
5856	msedge.exe
5856	msedge.exe
4720	Echelon.exe
4720	Echelon.exe
4720	Echelon.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
212	Echelon.exe
212	Echelon.exe
212	Echelon.exe
4680	Echelon.exe
4680	Echelon.exe
4680	Echelon.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

Processes:

msedge.exe

pid	process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

7zG.exeEchelon.exeEchelon.exeEchelon.exe

description	pid	process
Token: SeRestorePrivilege	4376	7zG.exe
Token: 35	4376	7zG.exe
Token: SeSecurityPrivilege	4376	7zG.exe
Token: SeSecurityPrivilege	4376	7zG.exe
Token: SeDebugPrivilege	4720	Echelon.exe
Token: SeDebugPrivilege	212	Echelon.exe
Token: SeDebugPrivilege	4680	Echelon.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4000 wrote to memory of 4084	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 4084	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 1660	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 3552	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 3552	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe
PID 4000 wrote to memory of 5068	4000	msedge.exe	msedge.exe

outlook_office_path 1 IoCs

Processes:

Echelon.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Echelon.exe

outlook_win_path 1 IoCs

Processes:

Echelon.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Echelon.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dosya.co/d2ucyv70iys0/logger.zip.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd95a46f8,0x7ffdd95a4708,0x7ffdd95a4718
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,1688266301702967283,208996264347325007,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1780 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5936

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\logger\" -ad -an -ai#7zMap11042:74:7zEvent19735
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4376

C:\Users\Admin\Downloads\logger\Echelon.exe
"C:\Users\Admin\Downloads\logger\Echelon.exe"
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720

C:\Users\Admin\Downloads\logger\Echelon.exe
"C:\Users\Admin\Downloads\logger\Echelon.exe"
1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:212

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:5732
- C:\Users\Admin\Downloads\logger\Echelon.exe
  Echelon.exe
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
703KB

MD5
4d09e51bf9027c7a09bf320a1dd82715

SHA1
8ee5ae8f2f2287b2fdcd0696b0a750c53cfb6bcf

SHA256
f27616b91b378b735fbf07e736369bd0bca801acb869c6fa471d2b93b55ea933

SHA512
66a8268f9a093d095edd28014f6f171757423e965d014116a1adef3c4c9280795cffab0bae3f59a9a81b3771a0703f4497015925245ba3776db7cf259f95e7b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
fb5bb5473351b538de2278caf3dd07b4

SHA1
311d4ff0ab66fc70552dc7454189e3415cc7e9cd

SHA256
93ce046d2184ecf967458963f7067cf5347347123f93ba2e17647b2b28f2c83e

SHA512
cdf0a485812e0d188a74917a55c6dc80e9f31a97e7ec1cc0c01a0acaf54971f53f6784160c360c354bc22bdf56fdc3eaff73aa365713aaef872a1aa135a96f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
07b4d6411174ee1d85cba07250a3df91

SHA1
589071cf107824165e0721cd502513e76cb4c3ed

SHA256
89b07580227edabcee1098d6e2e6f03e3deed9e25bd2b25edfac72b5c9107476

SHA512
72050f8d1c62d4c9bcaeb5685c0474c0766fea50a2518005b19c79046d4afa5b5cb168dc08c205ee80db11371d7f7192bd41bf6843845a1b0837fafe49e8386e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
26d183b0be6c090cf2c9efd6c1ce6b49

SHA1
d7192244a600cacd723f29ea45875d5b9707edad

SHA256
98ad701fd878f2807944751072788099dd2f6ce87282d1eb38a3326b79fc1da4

SHA512
01ddb128d186a88a861d8a2428c959d2e6ce8aa68f39acacd1798ca5f27edad70ed0c1db00f3d133912650cc3497d173609356b74083779c9ab62cabc4672dbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2e0e81c3f9228607049724ebc1d33155

SHA1
8983fe5f8c820b7460d1f38dcb0cf0b906f3a1e0

SHA256
be3b87959248487f037b18a9a26e58afa075556daa718123a7471e2e99d0bfc1

SHA512
ce0b3ca63f8fe6a9169f123a4b812bfb6101e75f3ea4ba276b995ce52d41a1a988d8e8ad9be8ea5ea5941cd978c9b3a7dbda7a1558b2e93e40bd78a9581af433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
671f80d09aa4761a0f3b064d13ed021b

SHA1
ae890278e28309d766e9dacf606aa3b07454938e

SHA256
4501c94c7cf0e55ee7742b8f063d95d5023b1658049234e01b22408ee13352f1

SHA512
d8ae92ba124c5429ebab4e3709d6bd859acc43ef9db37f5cc6b27111ba11e2945acb8365259f779f096ba6076a79169c55f7bc15b0e5ce3cd52d24584ad38608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
95c1a3f79316a339225cefad8ccdeeb6

SHA1
328c193b2775f98a0e6cfd78fa8ba095b2377617

SHA256
903c10e929e3d864913c00a2b5f256c58b478800fd74f00b75f9938bb6933e46

SHA512
50e4851cf2197a698505e058275ebb4fd2cbf6d647b4ae04cdb377cdab58c64de6765bd7aad46cb93b1f8f69015ae622f1d2ca874add4bd64ccdd848cc545ed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6090ae0ba6836071f196a4a11219ec48

SHA1
c968b832a266f34f8ead0fd414c56f482112142a

SHA256
36476a92300e1e742877dfcb0d9c38bd0ed829e1b43ed386a7a54fba1363ee6c

SHA512
6c303900629de1264af545ef1c2de4e04069ad6e1a3a615fb0141a6675562a610afa4f1374b76151da1d79e49f81a44bba3419c01c1fbc0ae5ea384a61aa89f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\bdC484075B.tmp

Filesize
100KB

MD5
b45ed8b906f7b08bc5db33091c4cbce9

SHA1
b5cb87c23cf1dc00c3384bcae0598071ca92c9d1

SHA256
0a54a476c7eaaea3111a6285d2cd1cf4b020d7de3926b6705a409f9000eab675

SHA512
a4b43bd6b1c8eae01d58cf48fd435d40d580888ad18ec3ae846305411fcff928d8c3ec98aa0b1ed5cb8004d2180c4e9b69ac2ac27fa976e1fd30012b9432f852

Download Submit
C:\Users\Admin\AppData\Local\Temp\bdC484075B.tmp

Filesize
152KB

MD5
73bd1e15afb04648c24593e8ba13e983

SHA1
4dd85ca46fcdf9d93f6b324f8bb0b5bb512a1b91

SHA256
aab0b201f392fef9fdff09e56a9d0ac33d0f68be95da270e6dab89bb1f971d8b

SHA512
6eb58fb41691894045569085bd64a83acd62277575ab002cf73d729bda4b6d43c36643a5fa336342e87a493326337ed43b8e5eaeae32f53210714699cb8dfac7

Download Submit
C:\Users\Admin\AppData\Local\Temp\bdC484075B.tmp

Filesize
46KB

MD5
8f5942354d3809f865f9767eddf51314

SHA1
20be11c0d42fc0cef53931ea9152b55082d1a11e

SHA256
776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

SHA512
fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsC484075B.tmp

Filesize
127KB

MD5
ed60f4906a36d40ea20b53e91e663606

SHA1
01356a176302cc546205cfe524a78c14871788e9

SHA256
1d70596565c15e4a23976e85b568c01e2094c793ad6daa530d681df5260e2943

SHA512
d057e98915b56cf51d25b1f178927f452f4bc3156537231758dd77bc968a2bbba1caac0ed8b59fbe283e0e82792aec6996deba713697192c84f674236223e33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tempDataBase2024-04-21T07_13_22.5049950+00_001313

Filesize
288KB

MD5
6005f2f80a108170596bf4bb6a13bda3

SHA1
606f533dd8b30cc420e5e8b531d9526862aa8f20

SHA256
8a85cd0d7d69fc34d24bf31503499e425563324090924359bf0f952b4dcb9fb3

SHA512
8ad71289f6f67c42c073da6a28c6bd0c1a80b86fa59857bcf8fd0af6f19079587bac488f51a6595407362675f60361d9f215df18653cfaad70b0cfe621b9f83a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tempDataBase2024-04-21T07_13_22.5206128+00_001212

Filesize
96KB

MD5
d367ddfda80fdcf578726bc3b0bc3e3c

SHA1
23fcd5e4e0e5e296bee7e5224a8404ecd92cf671

SHA256
0b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0

SHA512
40e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77

Download Submit
C:\Users\Admin\Downloads\logger\DotNetZip.dll

Filesize
448KB

MD5
60caabbd43235889d64f230617c0e24e

SHA1
f5f922bd3c69591663187d40ad732c73a5bda290

SHA256
4d7851bb977d7bd1d7503e994bc4c4083faa2751f41624237309157b1b88681d

SHA512
fedccb31b488ec1b7b28e8614a3eb53eb130c176837f687395e61a0f3f522d742d46ece1f6852ca45e831abe21728e08dadf010d828a49fbfdc9840b42cc975c

Download Submit
C:\Users\Admin\Downloads\logger\Echelon.exe

Filesize
581KB

MD5
2d9d77004af06b7d5fba73def3768dbd

SHA1
2d48d995505f8e1ae14493c6c2bb61d342cdf016

SHA256
197984847de1c34ce400d548c13df6b1d2c4ac8a4d5dc2d4c3c985f47109f1eb

SHA512
36f41f0daf31e4f70c423512cb7189d0e4f9573ac3d43edcb4c9a8077d4555e9d7d194a32be041e3ee74fe62b28862de07107d025c840c1ebe463c3d257196bb

Download Submit
C:\Users\Admin\Downloads\logger\Echelon.exe.config

Filesize
216B

MD5
ed6192054a346a72d8bd4352895f25f9

SHA1
2de8e2859eb7451eb23d408cf9fa45f37a4e2d0e

SHA256
707f233f9e814e64d7655a78275e60bb44c35646292fa5b41ee936e1763c9f77

SHA512
7fe3851b67da2cd748c5e194e7b0c8252c65516ac710d950e5d6ac3aefe7051a5a01e034d6714f1dba077046ec211d234eb9f19e05c80d292b24e0f84dd6ce0f

Download Submit
C:\Users\Admin\Downloads\logger\Echelon.pdb

Filesize
417KB

MD5
82ff82cec67ef5d0408a498dedf0eccc

SHA1
03554cae4dcbac99077c180ded7ccda887a8cc2a

SHA256
103a8bb6db0259eb40bfe7077bb45265870aca3bdf7480433141b68aab8890de

SHA512
4542284408003aea4e3b8b2b6ed11e0a6d65f1e60953063558fa42457b534f6b4783d681c51676948d8039c33fa0d4375b585da072692cd4848c5f8337e04c80

Download Submit
\??\pipe\LOCAL\crashpad_4000_CMNHLXPQOQBVPYFJ

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/212-259-0x000001DC3AA80000-0x000001DC3AA90000-memory.dmp

Filesize
64KB

Download
memory/212-292-0x00007FFDC4860000-0x00007FFDC5321000-memory.dmp

Filesize
10.8MB

Download
memory/212-293-0x00007FFDC4860000-0x00007FFDC5321000-memory.dmp

Filesize
10.8MB

Download
memory/212-258-0x00007FFDC4860000-0x00007FFDC5321000-memory.dmp

Filesize
10.8MB

Download
memory/4680-261-0x00007FFDC4860000-0x00007FFDC5321000-memory.dmp

Filesize
10.8MB

Download
memory/4680-262-0x00000198BC980000-0x00000198BC990000-memory.dmp

Filesize
64KB

Download
memory/4680-321-0x00007FFDC4860000-0x00007FFDC5321000-memory.dmp

Filesize
10.8MB

Download
memory/4720-171-0x000001FE62620000-0x000001FE62630000-memory.dmp

Filesize
64KB

Download
memory/4720-170-0x00007FFDC4740000-0x00007FFDC5201000-memory.dmp

Filesize
10.8MB

Download
memory/4720-169-0x000001FE47EB0000-0x000001FE47F48000-memory.dmp

Filesize
608KB

Download
memory/4720-173-0x000001FE49D50000-0x000001FE49DC6000-memory.dmp

Filesize
472KB

Download
memory/4720-220-0x00007FFDC4740000-0x00007FFDC5201000-memory.dmp

Filesize
10.8MB

Download