echelon | 557f4c234d26b35a5b4a65357b1b05b84e3ece6c59fcb265083b1545343bc854

General

Target

916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe
Size

593KB
MD5

916740096f7fb73f2e2b8ee87deaf675
SHA1

90bf01fafbd4353f295ba7987436a1950a138152
SHA256

557f4c234d26b35a5b4a65357b1b05b84e3ece6c59fcb265083b1545343bc854
SHA512

133d638202f19737700ab8d7aecb50d54ff3b0fe92def121c5125b43d2c01a2bf6c70172b0bb68341d97b1fa904378c5dff5115325a6aae6f46f552ff2cf16c5
SSDEEP

12288:dAAkeAPcDL+36QCKyR/ZLJLUf9snBS4csPYae6qfzsTC4:dBZhhUF54clNf7sTl

Score

10^/10

echelon collection discovery spyware stealer

Malware Config

Signatures

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.ipify.org
2	api.ipify.org
42	ip-api.com

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1168	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4844	916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe
4844	916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe
4844	916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 4412	4844	916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe	100
PID 4844 wrote to memory of 4412	4844	916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe	100
PID 4412 wrote to memory of 1168	4412	cmd.exe	102
PID 4412 wrote to memory of 1168	4412	cmd.exe	102

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\916740096f7fb73f2e2b8ee87deaf675_JaffaCakes118.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpC7A0.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\system32\timeout.exe
    timeout 4
    3⤵
    - Delays execution with timeout.exe
    PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

Email Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpC7A0.tmp.bat

Filesize
92B

MD5
beacc3908f75898916a0887c5d75b0bd

SHA1
3232519efc4040de64eb5957d217b69178b6039c

SHA256
10258656dd6aa5a543458be044efe742c6f6511d3fa7f8310cd0ed47e0ea2d91

SHA512
e8bb04dd1b888839bf56848a02da322b335fb50c2df0712e9b1e816a0b469bdf9c379d9dfc0ceced345ddf8cf53774a488834b4800d78c0b9a16a0fa1611f942

Download Submit
memory/4844-0-0x00007FFAE3683000-0x00007FFAE3685000-memory.dmp

Filesize
8KB

Download
memory/4844-1-0x000001CFB4AD0000-0x000001CFB4B6A000-memory.dmp

Filesize
616KB

Download
memory/4844-2-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/4844-3-0x000001CFCF270000-0x000001CFCF2E6000-memory.dmp

Filesize
472KB

Download
memory/4844-4-0x00007FFAE3683000-0x00007FFAE3685000-memory.dmp

Filesize
8KB

Download
memory/4844-6-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download
memory/4844-65-0x00007FFAE3680000-0x00007FFAE4141000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing