Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • resource tags

    arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18-06-2024 15:00

General

  • Target

    EcoH Client/Eco-H Revival.exe

  • Size

    79.7MB

  • MD5

    f0f2e4e572005c0c8c2e33b0d4340ebe

  • SHA1

    0a6c1c5f9cd3789353d75084108d319eff90bdff

  • SHA256

    c4861f4924a43729b89f68ad51d06a77e632888772492f31b091dbea329cf586

  • SHA512

    c5dc767bb7fcc5c91f685d6bdf9827fccf387ad20c21d856529f9708e812833bf6b733c7c3274e24cf9af039b6b594d7667c7d5c427f7cf798414628fc24cccb

  • SSDEEP

    196608:dd3skwZVjDOokcBDzf4LBIP6dL2Vmd6+D/2c/f/+ScEaE7WhNnoHKMbrsMKZ:JYKRszf490qL2Vmd6m+c/eA6zMb49

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 22 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\EcoH Client\Eco-H Revival.exe
    "C:\Users\Admin\AppData\Local\Temp\EcoH Client\Eco-H Revival.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Users\Admin\AppData\Local\Temp\EcoH Client\Eco-H Revival.exe
      "C:\Users\Admin\AppData\Local\Temp\EcoH Client\Eco-H Revival.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of WriteProcessMemory
      PID:1500
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:832

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\MSVCP140.dll
      Filesize

      564KB

      MD5

      1ba6d1cf0508775096f9e121a24e5863

      SHA1

      df552810d779476610da3c8b956cc921ed6c91ae

      SHA256

      74892d9b4028c05debaf0b9b5d9dc6d22f7956fa7d7eee00c681318c26792823

      SHA512

      9887d9f5838aa1555ea87968e014edfe2f7747f138f1b551d1f609bc1d5d8214a5fdab0d76fcac98864c1da5eb81405ca373b2a30cb12203c011d89ea6d069af

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\VCRUNTIME140.dll
      Filesize

      96KB

      MD5

      f12681a472b9dd04a812e16096514974

      SHA1

      6fd102eb3e0b0e6eef08118d71f28702d1a9067c

      SHA256

      d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

      SHA512

      7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\VCRUNTIME140_1.dll
      Filesize

      37KB

      MD5

      75e78e4bf561031d39f86143753400ff

      SHA1

      324c2a99e39f8992459495182677e91656a05206

      SHA256

      1758085a61527b427c4380f0c976d29a8bee889f2ac480c356a3f166433bf70e

      SHA512

      ce4daf46bce44a89d21308c63e2de8b757a23be2630360209c4a25eb13f1f66a04fbb0a124761a33bbf34496f2f2a02b8df159b4b62f1b6241e1dbfb0e5d9756

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\_brotli.cp310-win_amd64.pyd
      Filesize

      861KB

      MD5

      6d44fd95c62c6415999ebc01af40574b

      SHA1

      a5aee5e107d883d1490257c9702913c12b49b22a

      SHA256

      58bacb135729a70102356c2d110651f1735bf40a602858941e13bdeabfacab4a

      SHA512

      59b6c07079f979ad4a27ec394eab3fdd2d2d15d106544246fe38f4eb1c9e12672f11d4a8efb5a2a508690ce2677edfac85eb793e2f6a5f8781b258c421119ff3

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\_bz2.pyd
      Filesize

      81KB

      MD5

      a4b636201605067b676cc43784ae5570

      SHA1

      e9f49d0fc75f25743d04ce23c496eb5f89e72a9a

      SHA256

      f178e29921c04fb68cc08b1e5d1181e5df8ce1de38a968778e27990f4a69973c

      SHA512

      02096bc36c7a9ecfa1712fe738b5ef8b78c6964e0e363136166657c153727b870a6a44c1e1ec9b81289d1aa0af9c85f1a37b95b667103edc2d3916280b6a9488

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\_ctypes.pyd
      Filesize

      119KB

      MD5

      87596db63925dbfe4d5f0f36394d7ab0

      SHA1

      ad1dd48bbc078fe0a2354c28cb33f92a7e64907e

      SHA256

      92d7954d9099762d81c1ae2836c11b6ba58c1883fde8eeefe387cc93f2f6afb4

      SHA512

      e6d63e6fe1c3bd79f1e39cb09b6f56589f0ee80fd4f4638002fe026752bfa65457982adbef13150fa2f36e68771262d9378971023e07a75d710026ed37e83d7b

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\_hashlib.pyd
      Filesize

      60KB

      MD5

      49ce7a28e1c0eb65a9a583a6ba44fa3b

      SHA1

      dcfbee380e7d6c88128a807f381a831b6a752f10

      SHA256

      1be5cfd06a782b2ae8e4629d9d035cbc487074e8f63b9773c85e317be29c0430

      SHA512

      cf1f96d6d61ecb2997bb541e9eda7082ef4a445d3dd411ce6fd71b0dfe672f4dfaddf36ae0fb7d5f6d1345fbd90c19961a8f35328332cdaa232f322c0bf9a1f9

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\_lzma.pyd
      Filesize

      154KB

      MD5

      b5fbc034ad7c70a2ad1eb34d08b36cf8

      SHA1

      4efe3f21be36095673d949cceac928e11522b29c

      SHA256

      80a6ebe46f43ffa93bbdbfc83e67d6f44a44055de1439b06e4dd2983cb243df6

      SHA512

      e7185da748502b645030c96d3345d75814ba5fd95a997c2d1c923d981c44d5b90db64faf77ddbbdc805769af1bec37daf0ecee0930a248b67a1c2d92b59c250c

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\_pytransform.dll
      Filesize

      1.1MB

      MD5

      35b49ccb0516cb0e1180e95aa657aaa9

      SHA1

      f6e4c4a993dbaa276f321d7135f96c8df522eef8

      SHA256

      dcc65393ae46df9d5721ad167c227019631325e744226e4285ef9bb295a7cfb1

      SHA512

      921bc6d1c3be4f87b53697fa17ccaa488e31162322aef5fa256c8f79b5566c488d4485bc0fc4102f69b14a59b0711449ee18e52b3c671ccefa7efd6e0848a09a

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\_queue.pyd
      Filesize

      29KB

      MD5

      23f4becf6a1df36aee468bb0949ac2bc

      SHA1

      a0e027d79a281981f97343f2d0e7322b9fe9b441

      SHA256

      09c5faf270fd63bde6c45cc53b05160262c7ca47d4c37825ed3e15d479daee66

      SHA512

      3ee5b3b7583be1408c0e1e1c885512445a7e47a69ff874508e8f0a00a66a40a0e828ce33e6f30ddc3ac518d69e4bb96c8b36011fb4ededf9a9630ef98a14893b

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\_socket.pyd
      Filesize

      75KB

      MD5

      e137df498c120d6ac64ea1281bcab600

      SHA1

      b515e09868e9023d43991a05c113b2b662183cfe

      SHA256

      8046bf64e463d5aa38d13525891156131cf997c2e6cdf47527bc352f00f5c90a

      SHA512

      cc2772d282b81873aa7c5cba5939d232cceb6be0908b211edb18c25a17cbdb5072f102c0d6b7bc9b6b2f1f787b56ab1bc9be731bb9e98885c17e26a09c2beb90

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\_ssl.pyd
      Filesize

      155KB

      MD5

      35f66ad429cd636bcad858238c596828

      SHA1

      ad4534a266f77a9cdce7b97818531ce20364cb65

      SHA256

      58b772b53bfe898513c0eb264ae4fa47ed3d8f256bc8f70202356d20f9ecb6dc

      SHA512

      1cca8e6c3a21a8b05cc7518bd62c4e3f57937910f2a310e00f13f60f6a94728ef2004a2f4a3d133755139c3a45b252e6db76987b6b78bc8269a21ad5890356ad

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\base_library.zip
      Filesize

      812KB

      MD5

      0239a8c77b984b0e64042cff9320e51d

      SHA1

      86ce543744a1cf87ea0df46617e11a53fab5a6d3

      SHA256

      e3a2a9396e764876d50b94db11447e14fd1c91514ecc289e3c762e48af6362d9

      SHA512

      7010751f3e4c3ab7a4a5f041ab89e488a230b3f55ead8b32550bd20b5c921e0f17ab6b1eba3c8f8ff6806d58af9e3e04c64120c0c4d0048b31b3438802d7f782

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\certifi\cacert.pem
      Filesize

      253KB

      MD5

      3dcd08b803fbb28231e18b5d1eef4258

      SHA1

      b81ea40b943cd8a0c341f3a13e5bc05090b5a72a

      SHA256

      de2fa17c4d8ae68dc204a1b6b58b7a7a12569367cfeb8a3a4e1f377c73e83e9e

      SHA512

      9cc7106e921fbcf8c56745b38051a5a56154c600e3c553f2e64d93ec988c88b17f6d49698bdc18e3aa57ae96a79ee2c08c584c7c4c91cc6ea72db3dca6ccc2f5

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\libcrypto-1_1.dll
      Filesize

      3.3MB

      MD5

      ab01c808bed8164133e5279595437d3d

      SHA1

      0f512756a8db22576ec2e20cf0cafec7786fb12b

      SHA256

      9c0a0a11629cced6a064932e95a0158ee936739d75a56338702fed97cb0bad55

      SHA512

      4043cda02f6950abdc47413cfd8a0ba5c462f16bcd4f339f9f5a690823f4d0916478cab5cae81a3d5b03a8a196e17a716b06afee3f92dec3102e3bbc674774f2

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\libffi-7.dll
      Filesize

      32KB

      MD5

      eef7981412be8ea459064d3090f4b3aa

      SHA1

      c60da4830ce27afc234b3c3014c583f7f0a5a925

      SHA256

      f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

      SHA512

      dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\libssl-1_1.dll
      Filesize

      682KB

      MD5

      de72697933d7673279fb85fd48d1a4dd

      SHA1

      085fd4c6fb6d89ffcc9b2741947b74f0766fc383

      SHA256

      ed1c8769f5096afd000fc730a37b11177fcf90890345071ab7fbceac684d571f

      SHA512

      0fd4678c65da181d7c27b19056d5ab0e5dd0e9714e9606e524cdad9e46ec4d0b35fe22d594282309f718b30e065f6896674d3edce6b3b0c8eb637a3680715c2c

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\python3.DLL
      Filesize

      63KB

      MD5

      07bd9f1e651ad2409fd0b7d706be6071

      SHA1

      dfeb2221527474a681d6d8b16a5c378847c59d33

      SHA256

      5d78cd1365ea9ae4e95872576cfa4055342f1e80b06f3051cf91d564b6cd09f5

      SHA512

      def31d2df95cb7999ce1f55479b2ff7a3cb70e9fc4778fc50803f688448305454fbbf82b5a75032f182dff663a6d91d303ef72e3d2ca9f2a1b032956ec1a0e2a

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\python310.dll
      Filesize

      4.3MB

      MD5

      c80b5cb43e5fe7948c3562c1fff1254e

      SHA1

      f73cb1fb9445c96ecd56b984a1822e502e71ab9d

      SHA256

      058925e4bbfcb460a3c00ec824b8390583baef0c780a7c7ff01d43d9eec45f20

      SHA512

      faa97a9d5d2a0bf78123f19f8657c24921b907268938c26f79e1df6d667f7bee564259a3a11022e8629996406cda9fa00434bb2b1de3e10b9bddc59708dbad81

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\select.pyd
      Filesize

      28KB

      MD5

      adc412384b7e1254d11e62e451def8e9

      SHA1

      04e6dff4a65234406b9bc9d9f2dcfe8e30481829

      SHA256

      68b80009ab656ffe811d680585fac3d4f9c1b45f29d48c67ea2b3580ec4d86a1

      SHA512

      f250f1236882668b2686bd42e1c334c60da7abec3a208ebebdee84a74d7c4c6b1bc79eed7241bc7012e4ef70a6651a32aa00e32a83f402475b479633581e0b07

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\unicodedata.pyd
      Filesize

      1.1MB

      MD5

      102bbbb1f33ce7c007aac08fe0a1a97e

      SHA1

      9a8601bea3e7d4c2fa6394611611cda4fc76e219

      SHA256

      2cf6c5dea30bb0584991b2065c052c22d258b6e15384447dcea193fdcac5f758

      SHA512

      a07731f314e73f7a9ea73576a89ccb8a0e55e53f9b5b82f53121b97b1814d905b17a2da9bd2eda9f9354fc3f15e3dea7a613d7c9bc98c36bba653743b24dfc32

    • C:\Users\Admin\AppData\Local\Temp\_MEI37682\zstandard\backend_c.cp310-win_amd64.pyd
      Filesize

      513KB

      MD5

      4ec296c5608d46afdb37048b920a676b

      SHA1

      c94c21c9e9621940f59bcec2f6a576a991b42a03

      SHA256

      a0f31c62e0c1b25857330afa3d8c23b68d2e2b1d18ffc6d69ffb3db481fae40d

      SHA512

      7c49668bc1e9cca2b07533ae7e1dfac27a6c660ddb33553b0300a3946188d32e471bcae1c1cc203388b21265bdcf04fcbfae94c767537dca5f3dc8d17be34e24

    • memory/1500-86-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-60-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-90-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-88-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-94-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-84-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-82-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-80-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-78-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-76-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-74-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-72-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-70-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-68-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-66-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-64-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-62-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-92-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-58-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-96-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-98-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-100-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-102-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-104-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-106-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-108-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-110-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-112-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-114-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-116-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-118-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-120-0x0000021C9D680000-0x0000021C9D681000-memory.dmp
      Filesize

      4KB

    • memory/1500-57-0x0000021C9D670000-0x0000021C9D671000-memory.dmp
      Filesize

      4KB