echelon | 8be13fe1e2423e025aa2689e6c9515f52b90d4e42a3b43e494c3811a1a11f365

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
16-01-2025 01:01

Target

8be13fe1e2423e025aa2689e6c9515f52b90d4e42a3b43e494c3811a1a11f365.exe
Size

581KB
MD5

633623d5934a3eca511a9c20d6f28bd7
SHA1

bab4b31329c1e9862579e45a6266faa6a0f8a17d
SHA256

8be13fe1e2423e025aa2689e6c9515f52b90d4e42a3b43e494c3811a1a11f365
SHA512

ee2519f73b09a2c541cc9763a8c2f6cdb1c8d6aab89c876465a6d81f069b066d20f1825d4d5ca57a5a1ce6a2a7a39be5f05a7e58b5905ab901dc13c5c0225e5c
SSDEEP

12288:KAlxP4NiGiABi5Nl4vZLJLUf9snBS4csPYae6qfzkAA:R0Q4vhhUF54clNf7kB

Score

10^/10

Detects Echelon Stealer payload 1 IoCs

resource	yara_rule
behavioral1/memory/2304-1-0x0000000000850000-0x00000000008E8000-memory.dmp	family_echelon

Echelon
Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.
stealer spyware echelon
Echelon family
echelon

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org
5	api.ipify.org

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2304	8be13fe1e2423e025aa2689e6c9515f52b90d4e42a3b43e494c3811a1a11f365.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2872	2304	8be13fe1e2423e025aa2689e6c9515f52b90d4e42a3b43e494c3811a1a11f365.exe	32
PID 2304 wrote to memory of 2872	2304	8be13fe1e2423e025aa2689e6c9515f52b90d4e42a3b43e494c3811a1a11f365.exe	32
PID 2304 wrote to memory of 2872	2304	8be13fe1e2423e025aa2689e6c9515f52b90d4e42a3b43e494c3811a1a11f365.exe	32

C:\Users\Admin\AppData\Local\Temp\8be13fe1e2423e025aa2689e6c9515f52b90d4e42a3b43e494c3811a1a11f365.exe
"C:\Users\Admin\AppData\Local\Temp\8be13fe1e2423e025aa2689e6c9515f52b90d4e42a3b43e494c3811a1a11f365.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2304 -s 1348
  2⤵
  PID:2872

memory/2304-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/2304-1-0x0000000000850000-0x00000000008E8000-memory.dmp

Filesize
608KB

Download
memory/2304-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2304-3-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download