Overview

overview

10

Static

static

10

cac98fd47f...f5.exe

windows7-x64

10

cac98fd47f...f5.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-08-2024 05:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cac98fd47f3d1f7929ed1600304b4d4d3cfcb49fa323939dd39eb59342f2c2f5.exe

  • Size

    1.3MB

  • MD5

    14abfb51f8f57a091b87a733296c1523

  • SHA1

    947404f47050ef01f71493ccaec4f851f0c4eb30

  • SHA256

    cac98fd47f3d1f7929ed1600304b4d4d3cfcb49fa323939dd39eb59342f2c2f5

  • SHA512

    61d1149f2c911fa99bebc24a7a5b40a096fa87ddd8b7c7e44fa9acf47af066c56ff048605453458cf864b48d1b06d2440921170d1f15e819f5ffc9d47b57520d

  • SSDEEP

    24576:/qPvbuhZUTd8hhUF54clNf7+6uHAW92zt/sWu2BSMCqDoRX:obKo54clgLH+tkWJ0NJ

Score
10/10
echeloncredential_accessdiscoveryspywarestealer

Malware Config

Signatures

  • Detects Echelon Stealer payload 1 IoCs
  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

    stealerspywareechelon
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cac98fd47f3d1f7929ed1600304b4d4d3cfcb49fa323939dd39eb59342f2c2f5.exe
    "C:\Users\Admin\AppData\Local\Temp\cac98fd47f3d1f7929ed1600304b4d4d3cfcb49fa323939dd39eb59342f2c2f5.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1388

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Browsers\Passwords\Passwords_Edge.txt
    Filesize

    1KB

    MD5

    6ca856c7d40e1edc69008e9f4f7a7ba2

    SHA1

    62b795c02b6b02e313c15e1c369991f08814a95c

    SHA256

    a8cdd831224a169d08a48633ace3675d98a243ccff849a85ebd1e95a76d04242

    SHA512

    6423bb1e45a8277b2c3ee1cb21324a8abca3735efcf8e45d1aa27e597230e37f01999a3229eb98ff2d42e68de17bf1f093546f5d7e89f246fecdb4b04e9d1db7

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Browsers\Passwords\Passwords_Edge.txt
    Filesize

    1KB

    MD5

    e21da2b922a86aa441a087588d8ba063

    SHA1

    eae0e83300e2fd672a5b75989f9934658aafc42e

    SHA256

    80a07a4e8531475b3819d1a9611b8bdb0205702bb6c7f96729cbc4b9ee496758

    SHA512

    e3131a211c6e5ec2ccafb0378fabeed48156b5e8df2d6ecb0b7dbfa47a7ca35244114ff788e72b8e6950be9bd3ed1fdcc4863b18af8d3103449e07abdd039343

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Browsers\Passwords\Passwords_Edge.txt
    Filesize

    2KB

    MD5

    88fe72ee318201e46a1fc7f58fc5a0f7

    SHA1

    799df8bb300d508996d900212edad6170a9bd2bf

    SHA256

    d62a3f605afb8ed80e349f488425d6fb576b9acbf0c8afac0cc341bbc7096912

    SHA512

    1ae6ca9d5e0295124618832910a062ddc85d3565dda03b1886bd0dcc483c861b21de7605713ed27813c15b9ffa4e0757c46d77a15c21a81cf41099e820294a9d

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Browsers\Passwords\Passwords_Edge.txt
    Filesize

    2KB

    MD5

    656726952302f87aa14938d0db9ee454

    SHA1

    a7218b06ef1170e77be390b33877b38519f19e28

    SHA256

    51664925b2e581d6a27d81a84273aaa8a1dbb6572956a5455bc73e1868ba6e8b

    SHA512

    101e39b11d24bbca94f815458c9c2296b724a9104cea9070c143216a69514b51aecb98d97be8899d4e0c925d7749557d9cfe61e35250dd8004a8154b538fd5c7

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Browsers\Passwords\Passwords_Edge.txt
    Filesize

    426B

    MD5

    42fa959509b3ed7c94c0cf3728b03f6d

    SHA1

    661292176640beb0b38dc9e7a462518eb592d27d

    SHA256

    870ef3d2370932a8938faa60abd47d75ea0af98bfa11c82ae8efe9e94fd8be00

    SHA512

    7def291737d081c93d0cc38ac8d3062fd34d93b68d191eb0d54e9857e0c0afdbcd241471a2e10c28ce8db3b1d1ae0dba2ef6f609cfe8a1e8fe1dd103dba80007

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Browsers\Passwords\Passwords_Edge.txt
    Filesize

    2KB

    MD5

    81b99703a3960d307cd3ab62339c6d2e

    SHA1

    78a2f3bc7bb88f881a2511cc2de8221c48f81a23

    SHA256

    2ca6e84f6978690a4fbe9f8afb9c8906362e17dfec9da01861ed44ac3df4832d

    SHA512

    33182c99d24f276968c8c85686593b71efdfca475e630864f5399895d83aa1d320b0de7866c1cce2231d02b80cce641e71763d28535ed05e90b9b0ad70eb478d

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Browsers\Passwords\Passwords_Edge.txt
    Filesize

    3KB

    MD5

    e181e9fc3087583b84164406113f6321

    SHA1

    7244c18a52b2c74fa39b7104e779f304b9ae4c12

    SHA256

    6661f2827c61623c6e7ab76fc8c79eb9dc4289e564b781d1f573fbf6f1a2f880

    SHA512

    0686425870c1faec44ab2becaff21a17aaf9ff89bf7d6ad7e41cc2ff0cf3e9f9c17028c614b4982a61e5adccb9cbed99a8edb57f85d962bcaa62858eb55c8249

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Browsers\Passwords\Passwords_Edge.txt
    Filesize

    3KB

    MD5

    78dd6580ce6665dd6d6c2f0c244463f8

    SHA1

    67cac6c403c3f17e1c0722fb0c2eb250fd8241d8

    SHA256

    ce4f8a9c0b97185ba35cffcf896ffb5076a0b82a13d250b25c452104583a277f

    SHA512

    31e53c2f36069f2491f2fa435e147abfa64467f495e99f5818f000a9c73c99600fba4cab10fc1e9a7ea1b866ab519a26d8444325c0db738952d5e42a929c4b39

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Browsers\Passwords\Passwords_Edge.txt
    Filesize

    4KB

    MD5

    266b750ff315185a8866f8a186995b76

    SHA1

    df45b2f0e9a4647cc74b90e7a13bc613c49fa93a

    SHA256

    cc40de1552dab9ec217ede32da2c13a8afcf4ad8e440143a0028099035586dd2

    SHA512

    3a7e7e9d664c02b65998cfb489a24d403e20593ce5f84484dec2e56d76a759ba8403e1671f0a6460388c268387978916cc4dfb3a5a2e47d2b0a6ed17a7014645

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Browsers\Passwords\Passwords_Edge.txt
    Filesize

    852B

    MD5

    f6112b3498179e945ef8ca979e810858

    SHA1

    78411bf22b09f0243f0c4405970b292e8f391f41

    SHA256

    72b2b8ebdc6ebf268b47939e38ff5c6439d458b1149af61b69103de2a0f3feb0

    SHA512

    1ab7bd43b6a62c79336d907e2ec6337f61b20bfdd4b184ff4d3838a84097353c8d7bf21a3e9751b1a7e1af0fae704c39aed1c683bbc1b9151351e246e91ac604

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Computer.txt
    Filesize

    284B

    MD5

    f250f77bd3e7dd34891774a0a59a1f73

    SHA1

    baef90b5a60b488c69cb3d386f0f50525675a6ad

    SHA256

    1efc16d97995c20937a73c74d7dc07a600cb31a07e39988e8f9fd55319a45fca

    SHA512

    c95b976bd7a1e8701df40d3763a0b3bf341b3a6ac71a1a5bc049fc8b2e832516f68b2ff15ceda2f0757188878b75b66112d393e811fad48fab3c3f8e3bb701a2

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Grabber\ExpandLock.doc
    Filesize

    295KB

    MD5

    83af4f66969ea30162d1c08bc559a300

    SHA1

    2dc44dac767dce4692409b63265ecb13db8c05ed

    SHA256

    bf65267c5c9668ed1f9cc7ba24f7fe8fe31a1c2fb11328c924c0ba8e08faf926

    SHA512

    83692dcc4e856dde7f0c4b1586a85528c038e87b63a01a0cc967d9c8c48ce0997cd60403dca85b1e5fa597d4cf806606c37102e687dafb04a6876f8a7be2231a

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Grabber\OpenMeasure.txt
    Filesize

    240KB

    MD5

    0614a7a25768302a796da9fc9a18ad81

    SHA1

    369fdb2cd7c9f03b4b006864a8706c2b3254b49c

    SHA256

    e2ce9f181f895adbeabf395499a999be23975277ce505ba36a1e05fa462aa58d

    SHA512

    dd4e295313e2f523e0b6af36fdd0dff2d9afabc4eef9af8fc19eb68b6b586feec8f17f46f1c29f26202dceaa6d26ee6ec77940984b8b7150c5882694b3bb884e

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Grabber\OutConfirm.txt
    Filesize

    708KB

    MD5

    d5543d47ef047d4ffc7e0f9dceed3dfb

    SHA1

    bc661493c0a05584be9a46b362516eab625c71fb

    SHA256

    01c832425132759653d4559a77f93db1922445b46e2bc2dcb3bf036f27850d31

    SHA512

    5cc7e680a37939f4e053eee8e44e1b0ee6ed0905e047130e367da218e3872096e11c7aee9d9551acbc634663c2f4af5069aefd64fb5f907379c55198b3650444

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Grabber\RepairUnlock.png
    Filesize

    118KB

    MD5

    6522c7df8033c97a10aa6b3eabe417f7

    SHA1

    ef2daaebd976abc1fbcbecac0086b1c3aea255ce

    SHA256

    9665a219c20f57943c7c62ed5e9b1ad94dabc833ac91ec9a84cb4d9933432274

    SHA512

    c0f9e318e46550bea6979ee6245e944114c6bcfa4e9b3ed358b773d362e67978cb9715b3850c2874873b621153b555ad36b2ee125e36a3b65810941e75be31bb

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Grabber\StepUnprotect.txt
    Filesize

    433KB

    MD5

    1d77ed3ab1ba3813953fd94e443e3692

    SHA1

    6f38c965c7cbfb4fdf89eff49769332806ea769c

    SHA256

    730083d4e3313a82e7d536fd6619cc122e7b4ece4d92e18cd401ecc93e2c117f

    SHA512

    26342c5dae732f87454d8e2edcf212819b0565094992726c025f28c1eb5d8cb2f57e440dbf8c5f97ac2b300de95b36d0b8da0e8ff0e560109063664dc6f25962

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Processes.txt
    Filesize

    916B

    MD5

    cb5326c4c2340c1f89be127939167d4c

    SHA1

    0829557cdcfa9cd36ad430f6d1ff5482f4634e44

    SHA256

    37adeb07b069ed8a39e7f4912edd9431946a7ad3e7249b3cf7c87a4ee58d2212

    SHA512

    b91913e9e49ade018049077663a9fc4ef3512305fda0b4c11532f3e300ebe0cea1c07d4cc1af0583850b51679b7057f389469260cbf18d4b095591e7e5a8d425

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Processes.txt
    Filesize

    913B

    MD5

    3c767f25e20e1f98619cc3cca19e7e65

    SHA1

    7fe36b85da23c61e687e3eeb24c389de6938f29e

    SHA256

    9505ef901f963011ca6c96882f69dba7f24bc16992863b1c03dca92df6dd9501

    SHA512

    8c11529881f3adbf36217ecd768a0212cd2dd117f48a4a33848d50944f61f1b7426eb406b391b0f66102ec60dfd38f2540d2de0e61816d75f0cca0f6d8ec79cb

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Processes.txt
    Filesize

    947B

    MD5

    9095985d0e672efa987da32e32a8dd30

    SHA1

    e6a855529d353ede3cbc065696513d0ebb8bd165

    SHA256

    9c965df1c95850f8f81803f71526f760e0023372a2a519d3c7f5b79274c27dfb

    SHA512

    5a79ff3fa90f96cb4a0a5a672e5e0cca0bf3678e3cee6151c5a21ef70034954aa64c17998179475df44fc968a7260bc869a8f3a7697b3f03dc849516e12fea4d

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Processes.txt
    Filesize

    936B

    MD5

    481a608272bafb568fbbf4f03d2b09c8

    SHA1

    9a913464f52d43d5681e4d4f59b1b42bfc7342af

    SHA256

    bba38ad366b2995eeb17cd33011d09f89fbefc394fe9a751e8a1548b281ad4f7

    SHA512

    2521bcb1f3ae41fd84300d4c5cf03cf5fdf4f96595103eff612dd14b73afdf52902b92850cf221a579b9c1a9d0ffc87a2388a93906f9d5c3d468222c6bb23b35

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Processes.txt
    Filesize

    916B

    MD5

    7b4c4bd161b436cabf3d9050790a8063

    SHA1

    08ec1c8d901e444180645cff6b5731a037d2c917

    SHA256

    526e20431ed2d5ab93e73739cc15ab19bd3b2f025551af81c04a29384902d1bb

    SHA512

    46de62ea9fa0b661e4e030095206b6d77238c1f6bd580dbf76a5f71d2c9d424e8351dfbb1057098a5d191df0be046d17507b79d2b0b37694205ab3785ff41b27

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Processes.txt
    Filesize

    907B

    MD5

    da11b5830b115fc9815ccd251546fc13

    SHA1

    3b691329a96235d5cb11ca986c5b1d138d97c0be

    SHA256

    9da7593aaa9ff6b193ce773677b27e93ee8b8c01c4dcb031edf4536115305d95

    SHA512

    ac9a9089e7ce8e73f5b12450eb44c5d7687ff2639759c01eb9bcea394e5871edd549f6c60e18fad33d39394349b360837873d56c11999d65246233406c49d530

    Download Submit
  • C:\Users\Admin\AppData\Local\H7007F1AA16\167007F1AAH\Screenshot.Jpeg
    Filesize

    90KB

    MD5

    29fd4e2c7434c141271c80d11597787a

    SHA1

    fb398cff292b013db4464b7d26d2e5f83979ca2f

    SHA256

    577e3bcb50a90603fa57cc67ee646d66cd6dbacfc07e88f2816d25c47ad07326

    SHA512

    b69cd291abfaf53c1f0e842422d145e83a40b26e5d9179b339ea1c4afd7a96caf289cf1b3c82ed825aef37b5c670da2777ddea431ad08b3bb97adb8cc6da87ad

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\bd7007F1AA.tmp
    Filesize

    114KB

    MD5

    db26309558628fa1ef6a1edd23ab2b09

    SHA1

    9bfb0530d0c2dcc6f9b3947bc3ca602943356368

    SHA256

    e6287cb739a35ef64a6d19ec146c90c848de8646032fd98d570042c0e2ecf070

    SHA512

    4171bc6af1ffc5d24d6ddade7b47e94b0547297e25d9a4d45ca831801208b7d83edda0b138436626749711a953a5818486c293e8749c5c2539ef070e848b237c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\bd7007F1AA.tmp
    Filesize

    20KB

    MD5

    a603e09d617fea7517059b4924b1df93

    SHA1

    31d66e1496e0229c6a312f8be05da3f813b3fa9e

    SHA256

    ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

    SHA512

    eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\bd7007F1AA.tmp
    Filesize

    40KB

    MD5

    a182561a527f929489bf4b8f74f65cd7

    SHA1

    8cd6866594759711ea1836e86a5b7ca64ee8911f

    SHA256

    42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

    SHA512

    9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\bd7007F1AA.tmp
    Filesize

    160KB

    MD5

    f310cf1ff562ae14449e0167a3e1fe46

    SHA1

    85c58afa9049467031c6c2b17f5c12ca73bb2788

    SHA256

    e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

    SHA512

    1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\ls7007F1AA.tmp
    Filesize

    99KB

    MD5

    ea46c9f3f66836c4b4bddf712a303520

    SHA1

    b7e7b1ede0c032e86a47245f6f83441ceecd0489

    SHA256

    ec12363db37cba37d7b67a660e4cd713015c4b25058d0b61319881170cff2618

    SHA512

    5afbcb21faf9af43fc5f2a68b4f791030167f3d2736d56f1136ea723b95e4b87e950a453686dd4ed892141dc62adec1ec1ac043209f26f5189bdb1f17fce0376

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\tempDataBase2024-08-25T05_32_02.3773974+00_0044
    Filesize

    96KB

    MD5

    40f3eb83cc9d4cdb0ad82bd5ff2fb824

    SHA1

    d6582ba879235049134fa9a351ca8f0f785d8835

    SHA256

    cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

    SHA512

    cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\tempDataBase2024-08-25T05_32_02.4242808+00_0044
    Filesize

    288KB

    MD5

    f24de8560bf9835fac069507571058e0

    SHA1

    2f503a15b8560d0ad1857b122c132ac360a57ba4

    SHA256

    3d4879134e41fa8dbfd4f3633cc25c9d7138732666997b10de4b461722d5f0fd

    SHA512

    53ac1df2e9ed7fe5b8119aa535b29f2159d33411eb0c58f87a24484261e610cd928e4f00020685ec43bef1bb3c04db94973be4dea89411f8a60eb6f300160d43

    Download Submit
  • memory/1388-0-0x00007FFD1F223000-0x00007FFD1F225000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1388-1-0x00000000005A0000-0x00000000006EC000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1388-2-0x000000001B2C0000-0x000000001B336000-memory.dmp
    Filesize

    472KB

    Download
  • memory/1388-3-0x00007FFD1F220000-0x00007FFD1FCE1000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/1388-155-0x00007FFD1F220000-0x00007FFD1FCE1000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/1388-154-0x00007FFD1F223000-0x00007FFD1F225000-memory.dmp
    Filesize

    8KB

    Download