Overview

overview

7

Static

static

3

2854e234da...12.exe

windows7-x64

7

2854e234da...12.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

d3dcompiler_47.dll

windows7-x64

1

d3dcompiler_47.dll

windows10-2004-x64

1

ffmpeg.dll

windows7-x64

1

ffmpeg.dll

windows10-2004-x64

1

libEGL.dll

windows7-x64

1

libEGL.dll

windows10-2004-x64

1

libGLESv2.dll

windows7-x64

1

libGLESv2.dll

windows10-2004-x64

1

resources/elevate.exe

windows7-x64

1

resources/elevate.exe

windows10-2004-x64

1

swiftshade...GL.dll

windows7-x64

1

swiftshade...GL.dll

windows10-2004-x64

1

swiftshade...v2.dll

windows7-x64

1

swiftshade...v2.dll

windows10-2004-x64

1

updater.exe

windows7-x64

7

updater.exe

windows10-2004-x64

7

vk_swiftshader.dll

windows7-x64

1

vk_swiftshader.dll

windows10-2004-x64

1

vulkan-1.dll

windows7-x64

1

vulkan-1.dll

windows10-2004-x64

1

$PLUGINSDI...7z.dll

windows7-x64

3

$PLUGINSDI...7z.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    191s
  • max time network
    203s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/01/2024, 23:07 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    updater.exe

  • Size

    140.1MB

  • MD5

    3db60378dae46b211045c4669998c1a5

  • SHA1

    487a891c4ea6a2f7ecf3f93f8b047f9e68f1f574

  • SHA256

    0dd66a537ead22c55bbd341c647341faaa260c499de26a0d398fb74240867c44

  • SHA512

    898a371da1da9fc717f9bcbf5793b2805d1f0ff741b31324b3d98594db4a5138a1a2bc8e304c76f3e723e86032d7785b561563b5c5219e29bc7a052d4c9f57e5

  • SSDEEP

    1572864:g2Cm7gJKfVjsPawuFHNwczWTeMkF7ZEk8bCkKbj:3aodJFek8+k

Score
7/10
persistencespywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\updater.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Users\Admin\AppData\Local\Temp\updater.exe
      "C:\Users\Admin\AppData\Local\Temp\updater.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1200 --field-trial-handle=1236,i,14135995835064569770,12443209955191738020,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      2⤵
        PID:2736
      • C:\Users\Admin\AppData\Local\Temp\updater.exe
        "C:\Users\Admin\AppData\Local\Temp\updater.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1680 --field-trial-handle=1236,i,14135995835064569770,12443209955191738020,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
        2⤵
        • Checks computer location settings
        PID:2628
      • C:\Users\Admin\AppData\Local\Temp\updater.exe
        "C:\Users\Admin\AppData\Local\Temp\updater.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --mojo-platform-channel-handle=1376 --field-trial-handle=1236,i,14135995835064569770,12443209955191738020,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
        2⤵
          PID:388
        • C:\Users\Admin\AppData\Local\Temp\updater.exe
          "C:\Users\Admin\AppData\Local\Temp\updater.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\updater" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1648 --field-trial-handle=1236,i,14135995835064569770,12443209955191738020,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
          2⤵
            PID:2424
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
            2⤵
              PID:2180
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
              2⤵
                PID:1660
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
                2⤵
                  PID:808
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
                  2⤵
                    PID:556
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
                    2⤵
                      PID:932
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                      2⤵
                        PID:3052
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f"
                        2⤵
                          PID:3048
                      • C:\Windows\system32\reg.exe
                        C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
                        1⤵
                          PID:2348
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic path win32_VideoController get name
                          1⤵
                          • Detects videocard installed
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1820
                        • C:\Windows\system32\chcp.com
                          chcp 65001
                          1⤵
                            PID:1700
                          • C:\Windows\system32\netsh.exe
                            netsh wlan show profiles
                            1⤵
                              PID:2912
                            • C:\Windows\system32\cmd.exe
                              cmd /c chcp 65001
                              1⤵
                                PID:2640
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
                                1⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2176
                              • C:\Windows\system32\reg.exe
                                C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
                                1⤵
                                  PID:2052
                                • C:\Windows\system32\reg.exe
                                  C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f
                                  1⤵
                                  • Adds Run key to start application
                                  PID:2264
                                • C:\Windows\system32\tasklist.exe
                                  tasklist
                                  1⤵
                                  • Enumerates processes with tasklist
                                  PID:2740

                                Network

                                • flag-us
                                  DNS
                                  ipinfo.io
                                  updater.exe
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  ipinfo.io
                                  IN A
                                  Response
                                  ipinfo.io
                                  IN A
                                  34.117.186.192
                                • flag-us
                                  DNS
                                  redirector.gvt1.com
                                  updater.exe
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  redirector.gvt1.com
                                  IN A
                                  Response
                                  redirector.gvt1.com
                                  IN A
                                  209.85.202.139
                                  redirector.gvt1.com
                                  IN A
                                  209.85.202.100
                                  redirector.gvt1.com
                                  IN A
                                  209.85.202.113
                                  redirector.gvt1.com
                                  IN A
                                  209.85.202.101
                                  redirector.gvt1.com
                                  IN A
                                  209.85.202.138
                                  redirector.gvt1.com
                                  IN A
                                  209.85.202.102
                                • flag-us
                                  DNS
                                  r3---sn-aigzrnsz.gvt1.com
                                  updater.exe
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  r3---sn-aigzrnsz.gvt1.com
                                  IN A
                                  Response
                                  r3---sn-aigzrnsz.gvt1.com
                                  IN CNAME
                                  r3.sn-aigzrnsz.gvt1.com
                                  r3.sn-aigzrnsz.gvt1.com
                                  IN A
                                  74.125.175.168
                                • flag-us
                                  DNS
                                  3ps1l0n.life
                                  updater.exe
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  3ps1l0n.life
                                  IN A
                                  Response
                                  3ps1l0n.life
                                  IN A
                                  172.67.155.204
                                  3ps1l0n.life
                                  IN A
                                  104.21.72.222
                                • flag-us
                                  DNS
                                  3ps1l0n.life
                                  updater.exe
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  3ps1l0n.life
                                  IN A
                                • flag-us
                                  DNS
                                  dns.google
                                  updater.exe
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  dns.google
                                  IN A
                                  Response
                                  dns.google
                                  IN A
                                  8.8.4.4
                                  dns.google
                                  IN A
                                  8.8.8.8
                                • flag-us
                                  DNS
                                  dns.google
                                  updater.exe
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  dns.google
                                  IN A
                                  Response
                                  dns.google
                                  IN A
                                  8.8.8.8
                                  dns.google
                                  IN A
                                  8.8.4.4
                                • flag-us
                                  DNS
                                  cdn.discordapp.com
                                  updater.exe
                                  Remote address:
                                  8.8.8.8:53
                                  Request
                                  cdn.discordapp.com
                                  IN A
                                  Response
                                  cdn.discordapp.com
                                  IN A
                                  162.159.135.233
                                  cdn.discordapp.com
                                  IN A
                                  162.159.134.233
                                  cdn.discordapp.com
                                  IN A
                                  162.159.133.233
                                  cdn.discordapp.com
                                  IN A
                                  162.159.130.233
                                  cdn.discordapp.com
                                  IN A
                                  162.159.129.233
                                • 34.117.186.192:443
                                  ipinfo.io
                                  tls
                                  updater.exe
                                  893 B
                                   6.2kB
                                   9
                                  10
                                • 209.85.202.139:443
                                  redirector.gvt1.com
                                  tls
                                  updater.exe
                                  1.9kB
                                   10.1kB
                                   19
                                  21
                                • 74.125.175.168:443
                                  r3---sn-aigzrnsz.gvt1.com
                                  tls
                                  updater.exe
                                  1.1kB
                                   5.6kB
                                   11
                                  10
                                • 172.67.155.204:443
                                  3ps1l0n.life
                                  tls
                                  updater.exe
                                  2.9kB
                                   6.0kB
                                   12
                                  12
                                • 8.8.8.8:443
                                  dns.google
                                  tls
                                  updater.exe
                                  2.2kB
                                   2.7kB
                                   12
                                  10
                                • 8.8.4.4:443
                                  dns.google
                                  tls
                                  updater.exe
                                  2.1kB
                                   1.7kB
                                   11
                                  8
                                • 8.8.4.4:443
                                  dns.google
                                  tls
                                  updater.exe
                                  1.7kB
                                   7.1kB
                                   16
                                  15
                                • 8.8.8.8:443
                                  dns.google
                                  tls
                                  updater.exe
                                  1.7kB
                                   7.1kB
                                   16
                                  15
                                • 172.67.155.204:443
                                  3ps1l0n.life
                                  tls
                                  updater.exe
                                  2.1kB
                                   1.9kB
                                   10
                                  9
                                • 172.67.155.204:443
                                  3ps1l0n.life
                                  tls
                                  updater.exe
                                  1.4kB
                                   1.7kB
                                   10
                                  8
                                • 172.67.155.204:443
                                  3ps1l0n.life
                                  tls
                                  updater.exe
                                  1.2kB
                                   1.9kB
                                   10
                                  9
                                • 162.159.135.233:443
                                  cdn.discordapp.com
                                  tls
                                  updater.exe
                                  2.2MB
                                   50.6MB
                                   32351
                                  36293
                                • 8.8.8.8:53
                                  ipinfo.io
                                  dns
                                  updater.exe
                                  55 B
                                   71 B
                                   1
                                  1

                                  DNS Request

                                  ipinfo.io

                                  DNS Response

                                  34.117.186.192

                                • 8.8.8.8:53
                                  redirector.gvt1.com
                                  dns
                                  updater.exe
                                  65 B
                                   161 B
                                   1
                                  1

                                  DNS Request

                                  redirector.gvt1.com

                                  DNS Response

                                  209.85.202.139
                                  209.85.202.100
                                  209.85.202.113
                                  209.85.202.101
                                  209.85.202.138
                                  209.85.202.102

                                • 8.8.8.8:53
                                  r3---sn-aigzrnsz.gvt1.com
                                  dns
                                  updater.exe
                                  71 B
                                   116 B
                                   1
                                  1

                                  DNS Request

                                  r3---sn-aigzrnsz.gvt1.com

                                  DNS Response

                                  74.125.175.168

                                • 74.125.175.168:443
                                  r3---sn-aigzrnsz.gvt1.com
                                  https
                                  updater.exe
                                  7.7kB
                                   480.7kB
                                   94
                                  382
                                • 8.8.8.8:53
                                  3ps1l0n.life
                                  dns
                                  updater.exe
                                  116 B
                                   90 B
                                   2
                                  1

                                  DNS Request

                                  3ps1l0n.life

                                  DNS Request

                                  3ps1l0n.life

                                  DNS Response

                                  172.67.155.204
                                  104.21.72.222

                                • 8.8.8.8:53
                                  dns.google
                                  dns
                                  updater.exe
                                  56 B
                                   88 B
                                   1
                                  1

                                  DNS Request

                                  dns.google

                                  DNS Response

                                  8.8.4.4
                                  8.8.8.8

                                • 8.8.8.8:53
                                  dns.google
                                  dns
                                  updater.exe
                                  56 B
                                   88 B
                                   1
                                  1

                                  DNS Request

                                  dns.google

                                  DNS Response

                                  8.8.8.8
                                  8.8.4.4

                                • 8.8.8.8:53
                                  cdn.discordapp.com
                                  dns
                                  updater.exe
                                  64 B
                                   144 B
                                   1
                                  1

                                  DNS Request

                                  cdn.discordapp.com

                                  DNS Response

                                  162.159.135.233
                                  162.159.134.233
                                  162.159.133.233
                                  162.159.130.233
                                  162.159.129.233

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Antivirus.txt
                                  Filesize

                                  231B

                                  MD5

                                  dec2be4f1ec3592cea668aa279e7cc9b

                                  SHA1

                                  327cf8ab0c895e10674e00ea7f437784bb11d718

                                  SHA256

                                  753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

                                  SHA512

                                  81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt
                                  Filesize

                                  249B

                                  MD5

                                  cf7e4a12f932a3fddddacc8b10e1f1b0

                                  SHA1

                                  db6f9bc2be5e0905086b7b7b07109ef8d67b24ee

                                  SHA256

                                  1b6d3f6ad849e115bf20175985bed9bcfc6ec206e288b97ac14c3a23b5d28a4b

                                  SHA512

                                  fab79f26c1841310cc61e2f8336ca05281a9252a34a3c240e500c8775840374edb0a42094c64aa38a29ca79e1cafa114d6f1bbe3009060d32f8c1df9f088c12c

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\updater\Local Storage\leveldb\CURRENT~RFf770a5d.TMP
                                  Filesize

                                  16B

                                  MD5

                                  46295cac801e5d4857d09837238a6394

                                  SHA1

                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                  SHA256

                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                  SHA512

                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                  Download Submit

                                • \Users\Admin\AppData\Local\Temp\b086a55f-1f3e-4487-b023-3a7e721558c7.tmp.node
                                  Filesize

                                  301KB

                                  MD5

                                  df09b5dc1c2b23c6caeb0994295130fb

                                  SHA1

                                  99eacd989e46ea7a2d758f068b008dbdc45f7976

                                  SHA256

                                  a9e11a8720826c7db276afaa8380be91e53f7f31e96bc3c6da7f2a94cca71d17

                                  SHA512

                                  92e437fa8db3e1b936abd89ab2bbea4486353043078720c9e8e59a4c776ee13448b37f29cd6d8a119e4af0f8c691d0475159d3525fb3329bc66ca30b5b443e33

                                  Download Submit

                                • \Users\Admin\AppData\Local\Temp\b65becc1-4edc-4b24-a5f4-096ce768de60.tmp.node
                                  Filesize

                                  93KB

                                  MD5

                                  eb0daa1f202df3fbaa9b733f5b6e70da

                                  SHA1

                                  de0c14d30225f74f935dd01d99b67287aa0ee070

                                  SHA256

                                  0ba9bd4d3f7092375085a33079b78f99e6ca71a09a4209c2870bf7250e4dd1bb

                                  SHA512

                                  06fd500f101b3409bbd25b0a6358493f9b9f48ed3f869b5f09520fb789d8e96f31158a8112af021c20407b64eb9735865eabe27492550f1e0c4f4533496fa79e

                                  Download Submit

                                • memory/2736-5-0x0000000000060000-0x0000000000061000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/2736-43-0x0000000077430000-0x0000000077431000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/2916-48-0x0000000002B70000-0x0000000002B71000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                We care about your privacy.

                                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.