echelon | 3db2ef3dae242116e79cea9b9f37b21b9810399cbdca9518968bf6f7d307f0ae

Analysis

max time kernel
93s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10-01-2025 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d6c5cf0e6c31050c06f19dbf824d2aa8.exe
Size

1.1MB
MD5

d6c5cf0e6c31050c06f19dbf824d2aa8
SHA1

d7dd4788fe50fec1a86f6992639f2ffb0b07b87c
SHA256

3db2ef3dae242116e79cea9b9f37b21b9810399cbdca9518968bf6f7d307f0ae
SHA512

c7447f3d7777d67707582f162b093dd306e757645d790e2c15f6073e6144cc8667b956749d4bb18cdfa747b82e452f62e4dcce3a2c26fe228853b25f30e6c3b6
SSDEEP

24576:pjE5JY4hhUF54clNf7+6uHAW92zt/sWu2BSMCqDoRfEtp7IX:Co54clgLH+tkWJ0Nyz

Score

10^/10

echelon discovery spyware stealer

Malware Config

Signatures

Detects Echelon Stealer payload 1 IoCs

resource	yara_rule
behavioral2/memory/32-1-0x0000000000940000-0x0000000000A66000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
Echelon family
echelon
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org
4	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
32	JaffaCakes118_d6c5cf0e6c31050c06f19dbf824d2aa8.exe
32	JaffaCakes118_d6c5cf0e6c31050c06f19dbf824d2aa8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	32	JaffaCakes118_d6c5cf0e6c31050c06f19dbf824d2aa8.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d6c5cf0e6c31050c06f19dbf824d2aa8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d6c5cf0e6c31050c06f19dbf824d2aa8.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:32

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Fw1A76F31618\181A76F316Fw\Browsers\Passwords\Passwords_Edge.txt

Filesize
426B

MD5
42fa959509b3ed7c94c0cf3728b03f6d

SHA1
661292176640beb0b38dc9e7a462518eb592d27d

SHA256
870ef3d2370932a8938faa60abd47d75ea0af98bfa11c82ae8efe9e94fd8be00

SHA512
7def291737d081c93d0cc38ac8d3062fd34d93b68d191eb0d54e9857e0c0afdbcd241471a2e10c28ce8db3b1d1ae0dba2ef6f609cfe8a1e8fe1dd103dba80007

Download Submit
C:\Users\Admin\AppData\Local\Temp\Fw1A76F31618\181A76F316Fw\Grabber\DenyConvertFrom.doc

Filesize
456KB

MD5
dac6b04e57b56150dffd0baa26e3a114

SHA1
066db0eddf45a1b3d0049a7c6ec9dc1a370f35c7

SHA256
ae8833223b2264df327b5daa4df6825d682fc8f448c07718a1f3e0473b19a649

SHA512
dd44127d21fdcd5d8240fe3b103301d9f6e9c9512f8af560fd0b553c07ff3d1bf0de4fcb3882a64fd1e82d3e142d6294bd21ccef656c9f96d6ebca36dae9dbb3

Download Submit
memory/32-0-0x00007FFCBD1D3000-0x00007FFCBD1D5000-memory.dmp

Filesize
8KB

Download
memory/32-1-0x0000000000940000-0x0000000000A66000-memory.dmp

Filesize
1.1MB

Download
memory/32-2-0x000000001D9D0000-0x000000001DA46000-memory.dmp

Filesize
472KB

Download
memory/32-3-0x00007FFCBD1D0000-0x00007FFCBDC91000-memory.dmp

Filesize
10.8MB

Download
memory/32-68-0x00007FFCBD1D3000-0x00007FFCBD1D5000-memory.dmp

Filesize
8KB

Download
memory/32-69-0x00007FFCBD1D0000-0x00007FFCBDC91000-memory.dmp

Filesize
10.8MB

Download
memory/32-79-0x00007FFCBD1D0000-0x00007FFCBDC91000-memory.dmp

Filesize
10.8MB

Download