echelon | cab5dcf0af0ee68bc7113ab59e08ef43f2a62c8538afb2d96e154fc6fd19b9f0

Analysis

max time kernel
18s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-09-2024 19:36

Target

Echelon.exe
Size

778KB
MD5

76af6669d9635ffe4fdbf97af1a57fa6
SHA1

d3cba94b74f67e8d98cfa89209748ea2701bef80
SHA256

cab5dcf0af0ee68bc7113ab59e08ef43f2a62c8538afb2d96e154fc6fd19b9f0
SHA512

11fc1464800a4481865649cd71815f8d5be79d28bf36e6d56ffac65ce9564e346b22f73e8f0404efba5687e2291a4530f4ff125e580b2f62ec377a2c2bf743e7
SSDEEP

24576:9FYpeHEsokNLQyhFoVdJOlc8msV0EWRr:6ASumJmc8mW0d

Score

10^/10

Detects Echelon Stealer payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1964-1-0x0000000000220000-0x00000000002E8000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.ipify.org
5 api.ipify.org
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Echelon.exe

description pid process

Token: SeDebugPrivilege 1964 Echelon.exe

flow	ioc
4	api.ipify.org
5	api.ipify.org

description	pid	process
Token: SeDebugPrivilege	1964	Echelon.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Echelon.exe

description	pid	process	target process
PID 1964 wrote to memory of 1804	1964	Echelon.exe	WerFault.exe
PID 1964 wrote to memory of 1804	1964	Echelon.exe	WerFault.exe
PID 1964 wrote to memory of 1804	1964	Echelon.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Echelon.exe
"C:\Users\Admin\AppData\Local\Temp\Echelon.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1964 -s 1280
  2⤵
  PID:1804

memory/1964-0-0x000007FEF5883000-0x000007FEF5884000-memory.dmp

Filesize
4KB

Download
memory/1964-1-0x0000000000220000-0x00000000002E8000-memory.dmp

Filesize
800KB

Download
memory/1964-2-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download
memory/1964-3-0x000007FEF5883000-0x000007FEF5884000-memory.dmp

Filesize
4KB

Download
memory/1964-4-0x000007FEF5880000-0x000007FEF626C000-memory.dmp

Filesize
9.9MB

Download