Analysis

  • max time kernel
    92s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-11-2024 04:18

General

  • Target

    NewHacks.exe

  • Size

    1.1MB

  • MD5

    d59bf492da2f21db13264aba7b40f464

  • SHA1

    c69eadf5aa174c34c90445548d5b2d5888957eae

  • SHA256

    4732655de9b6a0497a825ab53ef9e8c3db1a9d1520d1ae505ec2b07df305cef1

  • SHA512

    f781f75e84f88c9aa015644ba5744d5b360951fc753d054f2e999244907baae5a109563c5b4817a2e7ee2f91c2048366552d22364e593503ba8aec05ce4cef59

  • SSDEEP

    12288:74OAp4Hqw3QMrTM6TgMcnFO1sQATEQkhXdwWjgRNKjyjlG7bWsd:74OAp4KQrTMhOGRTodwWjWjlGes

Malware Config

Signatures

  • Detects Echelon Stealer payload 1 IoCs
  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

  • Echelon family
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NewHacks.exe
    "C:\Users\Admin\AppData\Local\Temp\NewHacks.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • outlook_office_path
    • outlook_win_path
    PID:4772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\VuJDLRVuHBFFuFPuTPTPDZE87CF40088\88E87CF400VuJDLRVuHBFFuFPuTPTPDZ\Browsers\Passwords\Passwords_Edge.txt

    Filesize

    426B

    MD5

    42fa959509b3ed7c94c0cf3728b03f6d

    SHA1

    661292176640beb0b38dc9e7a462518eb592d27d

    SHA256

    870ef3d2370932a8938faa60abd47d75ea0af98bfa11c82ae8efe9e94fd8be00

    SHA512

    7def291737d081c93d0cc38ac8d3062fd34d93b68d191eb0d54e9857e0c0afdbcd241471a2e10c28ce8db3b1d1ae0dba2ef6f609cfe8a1e8fe1dd103dba80007

  • memory/4772-0-0x00007FF8028E3000-0x00007FF8028E5000-memory.dmp

    Filesize

    8KB

  • memory/4772-1-0x00000000008B0000-0x00000000009D8000-memory.dmp

    Filesize

    1.2MB

  • memory/4772-5-0x00007FF8028E0000-0x00007FF8033A1000-memory.dmp

    Filesize

    10.8MB

  • memory/4772-71-0x000000001C0A0000-0x000000001C0C2000-memory.dmp

    Filesize

    136KB

  • memory/4772-84-0x00007FF8028E0000-0x00007FF8033A1000-memory.dmp

    Filesize

    10.8MB