echelon | ceb8e3b6055c093d73b740ec68aeb2b35688c70ead8d53f9221c677049213905

General

Target

6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe
Size

1018KB
MD5

6ac52086b2353d329f2c6b96dfc4b2bd
SHA1

c9ab0a3a4c3439d15ad30a6ea0ad738296853b24
SHA256

ceb8e3b6055c093d73b740ec68aeb2b35688c70ead8d53f9221c677049213905
SHA512

c86f4ce9c915419fe4f43af577ac930413665e4ae9df7453047abe445a08f3910a2e7929d580ba57ecf694302e4f08949ca24278e5f463cc947f32036979f6ff
SSDEEP

24576:ar4FsOULhhUF54clNf7CokNLQyhFoCRsAz:+o54clMSuNj

Score

10^/10

echelon spyware stealer vmprotect

Malware Config

Signatures

Detects Echelon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2256-1-0x0000000000AA0000-0x0000000000BA4000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon

Drops startup file 2 IoCs

Processes:

Decoder.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows driver update.exe	Decoder.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows driver update.exe	Decoder.exe

Executes dropped EXE 2 IoCs

Processes:

Decoder.exesystems32.exe

pid process

2612 Decoder.exe
399740 systems32.exe

pid	process
2612	Decoder.exe
399740	systems32.exe

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\ProgramData\Decoder.exe	vmprotect
behavioral1/memory/2612-21-0x00000000001C0000-0x00000000001F2000-memory.dmp	vmprotect
behavioral1/memory/399740-34-0x0000000000840000-0x0000000000872000-memory.dmp	vmprotect

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

401284 schtasks.exe
108 schtasks.exe
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

2460 timeout.exe
2868 timeout.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Decoder.exesystems32.exe

pid process

2612 Decoder.exe
399740 systems32.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

pid	process
401284	schtasks.exe
108	schtasks.exe

pid	process
2460	timeout.exe
2868	timeout.exe

pid	process
2612	Decoder.exe
399740	systems32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exeDecoder.exesystems32.exe

description	pid	process
Token: SeDebugPrivilege	2256	6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe
Token: SeDebugPrivilege	2612	Decoder.exe
Token: SeDebugPrivilege	399740	systems32.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.execmd.execmd.exeDecoder.exetaskeng.exesystems32.exe

description	pid	process	target process
PID 2256 wrote to memory of 2612	2256	6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe	Decoder.exe
PID 2256 wrote to memory of 2612	2256	6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe	Decoder.exe
PID 2256 wrote to memory of 2612	2256	6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe	Decoder.exe
PID 2256 wrote to memory of 2072	2256	6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe	cmd.exe
PID 2256 wrote to memory of 2072	2256	6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe	cmd.exe
PID 2256 wrote to memory of 2072	2256	6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe	cmd.exe
PID 2256 wrote to memory of 2560	2256	6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe	cmd.exe
PID 2256 wrote to memory of 2560	2256	6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe	cmd.exe
PID 2256 wrote to memory of 2560	2256	6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe	cmd.exe
PID 2072 wrote to memory of 2460	2072	cmd.exe	timeout.exe
PID 2072 wrote to memory of 2460	2072	cmd.exe	timeout.exe
PID 2072 wrote to memory of 2460	2072	cmd.exe	timeout.exe
PID 2560 wrote to memory of 2868	2560	cmd.exe	timeout.exe
PID 2560 wrote to memory of 2868	2560	cmd.exe	timeout.exe
PID 2560 wrote to memory of 2868	2560	cmd.exe	timeout.exe
PID 2612 wrote to memory of 108	2612	Decoder.exe	schtasks.exe
PID 2612 wrote to memory of 108	2612	Decoder.exe	schtasks.exe
PID 2612 wrote to memory of 108	2612	Decoder.exe	schtasks.exe
PID 398692 wrote to memory of 399740	398692	taskeng.exe	systems32.exe
PID 398692 wrote to memory of 399740	398692	taskeng.exe	systems32.exe
PID 398692 wrote to memory of 399740	398692	taskeng.exe	systems32.exe
PID 399740 wrote to memory of 401284	399740	systems32.exe	schtasks.exe
PID 399740 wrote to memory of 401284	399740	systems32.exe	schtasks.exe
PID 399740 wrote to memory of 401284	399740	systems32.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6ac52086b2353d329f2c6b96dfc4b2bd_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256
- C:\ProgramData\Decoder.exe
  "C:\ProgramData\Decoder.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Services" /tr "\systems32_bit\systems32.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:108
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\.cmd""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\system32\timeout.exe
    timeout 4
    3⤵
    - Delays execution with timeout.exe
    PID:2460
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp3044.tmp.cmd""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\system32\timeout.exe
    timeout 4
    3⤵
    - Delays execution with timeout.exe
    PID:2868

C:\Windows\system32\taskeng.exe
taskeng.exe {1D5C8D2A-5989-44AB-B280-DD62B2F365E5} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:398692
- C:\systems32_bit\systems32.exe
  \systems32_bit\systems32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:399740
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Services" /tr "\systems32_bit\systems32.exe" /f
    3⤵
    - Creates scheduled task(s)
    PID:401284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Decoder.exe

Filesize
148KB

MD5
21998709466c12a52cbc5aff86744aae

SHA1
5cbb11d167af1e1e1d10f920b084e26a89d5441f

SHA256
96d5aff39e576f94994c005b9b7db5d41a6f8db9505f4a462d259f2141830c03

SHA512
75398142630308dcf5d90f75b5eafab0a182d63522626cff3798973ab098fc80fda1c767aa6c14649951a54130b8ac12bdcfd8d2e09e01b8cbd91b552b8a3862

Download Submit
C:\Users\Admin\AppData\Local\Temp\.cmd

Filesize
28B

MD5
217407484aac2673214337def8886072

SHA1
0f8c4c94064ce1f7538c43987feb5bb2d7fec0c6

SHA256
467c28ed423f513128575b1c8c6674ee5671096ff1b14bc4c32deebd89fc1797

SHA512
8466383a1cb71ea8b049548fd5a41aaf01c0423743b886cd3cb5007f66bff87d8d5cfa67344451f4490c8f26e4ebf9e306075d5cfc655dc62f0813a456cf1330

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp3044.tmp.cmd

Filesize
131B

MD5
c7b40a7a8156723e74683d7166943a68

SHA1
39b66511d5e79a8fbe572de80ef55e3ab4ab365f

SHA256
c92eae6a38bace9a91dcaa08c973d38c58c3befef037da3421374b9d98e90ce8

SHA512
9627592c2796052471611851046fdb9b0c8f1d51108de5ef1b6402255a1c6e9206e2f0e1c29504294cc2fa1d3bbd148ce740cc27bd23a7202acf53fcfd10b69b

Download Submit
memory/2256-0-0x000007FEF6033000-0x000007FEF6034000-memory.dmp

Filesize
4KB

Download
memory/2256-1-0x0000000000AA0000-0x0000000000BA4000-memory.dmp

Filesize
1.0MB

Download
memory/2256-2-0x00000000009E0000-0x0000000000A56000-memory.dmp

Filesize
472KB

Download
memory/2256-3-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/2256-22-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/2612-21-0x00000000001C0000-0x00000000001F2000-memory.dmp

Filesize
200KB

Download
memory/2612-25-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/2612-30-0x000007FEF6030000-0x000007FEF6A1C000-memory.dmp

Filesize
9.9MB

Download
memory/399740-34-0x0000000000840000-0x0000000000872000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads