echo-launcher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
echo-launcher.exe
Size 21.3MB
Sample261003-y2eabawfre
SHA256 a3224eb0e63be04c89f1a1f66af00fb5e0624c80fdc22c6e4849c70ae90d05e9
MD5 2f502eb7c14345e80b27410f83280496
SHA1 4d078efef74ab48dd3ea05a5edc3190930e5ccbd
SHA512 69e82348fadda35ac093e2c09f337255f3f9ad336372780a02140b258b6f8ded85a8f848446b26fe98d8a2932c7e4347c363b570c80017c41832b0ae61ab6fbf
SSDEEP 196608:o/RHoZJDh8xQEo30xouTc0JFK7J4sv0AeL1GHDySgwokh7JRXYVKUZXhrYINf:oSLQXokGuo0JR2031/fDkkXhUI
TLSH
T1FD37D083F79784D9D0AEC47883559133E633BCA9092472AB2B94FB212F3AE505B5D347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
echo-launcher.exe

File Explorer

echo-launcher.exe

.exe 21.3MB

echo-launcher.exe

IMPHASH 3e7f0d5df5fd0ba7c4459aa3acd315af
SHA256 a3224eb0e63be04c89f1a1f66af00fb5e0624c80fdc22c6e4849c70ae90d05e9
MD5 2f502eb7c14345e80b27410f83280496
SHA1 4d078efef74ab48dd3ea05a5edc3190930e5ccbd
SHA512 69e82348fadda35ac093e2c09f337255f3f9ad336372780a02140b258b6f8ded85a8f848446b26fe98d8a2932c7e4347c363b570c80017c41832b0ae61ab6fbf
SSDEEP 196608:o/RHoZJDh8xQEo30xouTc0JFK7J4sv0AeL1GHDySgwokh7JRXYVKUZXhrYINf:oSLQXokGuo0JR2031/fDkkXhUI
TLSH
T1FD37D083F79784D9D0AEC47883559133E633BCA9092472AB2B94FB212F3AE505B5D347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6062480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

echo_launcher.pdb

kernel32

ReadFile GetOverlappedResult CreateIoCompletionPort SetFileCompletionNotificationModes GetQueuedCompletionStatusEx CancelIoEx GetFinalPathNameByHandleW SetLastError SetFilePointerEx GetCurrentThreadId SetFileTime GlobalFree GlobalUnlock GlobalLock GlobalAlloc SetFileInformationByHandle GetSystemInfo DeviceIoControl CreateFileW GetVolumeInformationW QueryFullProcessImageNameW OpenProcess GetDiskFreeSpaceExW GetExitCodeProcess WaitForSingleObject GetCurrentProcessId GetProcessId GetSystemTimePreciseAsFileTime CreateMutexW ReleaseMutex FindClose ReleaseSRWLockExclusive LCIDToLocaleName GetUserDefaultUILanguage AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime IsDebuggerPresent GetModuleHandleW IsProcessorFeaturePresent SetEnvironmentVariableW GetCommandLineW LoadLibraryA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW RtlPcToFileHeader LoadLibraryW RaiseException RtlVirtualUnwind RtlCaptureContext AddVectoredExceptionHandler EncodePointer TlsAlloc TlsGetValue RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess CreateMutexA WideCharToMultiByte MultiByteToWideChar TlsSetValue ReadFileEx SleepEx WriteFileEx SetHandleInformation CreateThread GetFullPathNameW FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess WaitForMultipleObjects CreateEventW CancelIo TerminateProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetTempPathW RemoveDirectoryW DeleteFileW CopyFileExW MoveFileExW CreateWaitableTimerExW SetWaitableTimer FindNextFileW SwitchToThread lstrlenW TlsFree InitializeSListHead WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle HeapReAlloc GetCurrentThread InitializeCriticalSectionAndSpinCount SetThreadStackGuarantee GetModuleHandleA SetNamedPipeHandleState Sleep GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter RtlUnwindEx CreatePipe LoadLibraryExA FormatMessageW GetLastError PostQueuedCompletionStatus DeleteCriticalSection HeapAlloc LoadLibraryExW OutputDebugStringW OutputDebugStringA FreeLibrary CloseHandle HeapFree WriteFile GetProcessHeap

advapi32

RegQueryValueExW RegGetValueW RegCloseKey RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyTransactedW RegDeleteTreeW RegOpenKeyExW RegEnumKeyExW RegSetValueExW SystemFunction036 EventRegister EventUnregister EventSetInformation EventWriteTransfer

oleaut32

SysFreeString GetErrorInfo SetErrorInfo SysStringLen

bcryptprimitives

ProcessPrng

ntdll

NtReadFile RtlNtStatusToDosError NtCreateNamedPipeFile NtDeviceIoControlFile NtCancelIoFileEx NtCreateFile RtlGetVersion NtWriteFile NtOpenFile

shell32

ShellExecuteW SHGetKnownFolderPath DragFinish DragQueryFileW SHAppBarMessage SHCreateItemFromParsingName Shell_NotifyIconW ShellExecuteExW Shell_NotifyIconGetRect SHOpenFolderAndSelectItems ord155 ord190

ole32

CoTaskMemFree RevokeDragDrop CoInitializeEx CoCreateInstance CoInitialize CoIncrementMTAUsage OleInitialize RegisterDragDrop CoUninitialize CoCreateFreeThreadedMarshaler CoTaskMemAlloc

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

user32

SetWindowTextW GetWindowTextW GetWindowTextLengthW ReleaseCapture RegisterRawInputDevices RegisterTouchWindow FindWindowExW ShowCursor FlashWindowEx GetSystemMetrics ClipCursor GetParent ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW KillTimer SystemParametersInfoW MonitorFromRect GetClipCursor SetPropW TrackMouseEvent MonitorFromPoint GetKeyboardState EnableWindow IsWindowEnabled DestroyIcon SetParent GetWindowPlacement EnumDisplayMonitors AdjustWindowRect SetWindowPlacement ChangeDisplaySettingsExW AdjustWindowRectEx CloseTouchInputHandle GetMenu RedrawWindow PostMessageW GetTouchInputInfo SetCapture ScreenToClient RegisterClassExW CreateWindowExW SetWindowPos GetWindowLongW SetWindowLongW GetMessageA SetFocus InvalidateRgn RegisterWindowMessageA GetWindow GetKeyState LoadCursorW GetAsyncKeyState UpdateWindow IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SendInput DrawTextW FillRect GetWindowDC OffsetRect GetWindowRect InvalidateRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu CreateIcon CheckMenuItem EnableMenuItem DrawMenuBar CreatePopupMenu CreateMenu DrawIconEx ReleaseDC GetDC VkKeyScanW SetMenuItemInfoW AppendMenuW InsertMenuW CreateAcceleratorTableW DestroyAcceleratorTable DestroyMenu TranslateAcceleratorW RemoveMenu GetSystemMenu SetCursorPos ChangeWindowMessageFilterEx RegisterClassW GetMenuItemInfoW MapVirtualKeyW GetUpdateRect ValidateRect GetRawInputData IsWindow GetForegroundWindow MsgWaitForMultipleObjectsEx DispatchMessageW GetMessageW PeekMessageW PostThreadMessageW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetWindowThreadProcessId GetWindowInfo IsIconic IsWindowVisible SetWindowDisplayAffinity EnumWindows SetTimer DefWindowProcW SetWindowLongPtrW SendMessageW FindWindowW DestroyWindow SetWindowRgn SetCursor GetWindowLongPtrW EnumChildWindows DispatchMessageA TranslateMessage GetMonitorInfoW

comctl32

RemoveWindowSubclass DefSubclassProc SetWindowSubclass TaskDialogIndirect

shlwapi

SHCreateMemStream

gdi32

SetBkMode CreateCompatibleDC GetDeviceCaps SelectObject DeleteDC DeleteObject CreateDIBSection SetTextColor CreateSolidBrush CreateRectRgn CombineRgn BitBlt

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

crypt32

CertFreeCertificateContext CertCloseStore CertDuplicateCertificateContext CertGetCertificateChain CertDuplicateStore CertFreeCertificateChain CertEnumCertificatesInStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertOpenStore CertVerifyCertificateChainPolicy

bcrypt

BCryptGenRandom

ws2_32

shutdown send freeaddrinfo getaddrinfo WSACleanup WSAStartup setsockopt bind WSASend connect ioctlsocket WSASocketW recv closesocket WSAIoctl getsockname WSAGetLastError getpeername getsockopt

secur32

QueryContextAttributesW EncryptMessage FreeContextBuffer AcquireCredentialsHandleA DeleteSecurityContext FreeCredentialsHandle DecryptMessage ApplyControlToken AcceptSecurityContext InitializeSecurityContextW

api-ms-win-crt-string-l1-1-0

wcslen wcscmp _wcsicmp strcmp strcpy_s strlen wcsncmp

api-ms-win-crt-math-l1-1-0

floorf pow sinf roundf ceilf round floor __setusermatherr fmod trunc

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

__p___argv _initterm _set_app_type _seh_filter_exe _register_onexit_function _configure_narrow_argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _initialize_onexit_table exit terminate _crt_atexit _get_initial_narrow_environment abort _exit __p___argc _initterm_e

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc calloc