e862a4c024eb9c3df7442591bbf0700a3bb2b498fa80bc99296e9fb33defd120

Analysis

max time kernel
3s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 12:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
EpsilonSetup.exe
Size 147.0MB
Sample240119-p6yebaedel
SHA256 cf43804749edd21997f8bc987a0b90188a43bcd5b561572593f09d2647918a43
MD5 71cbb2a62b34a12c30b9c1c26b0e52a4
SHA1 d749dab0b72d81f1ef74a99bf8d7d3553b507057
SHA512 8a3e14c4f49251cf6c755514c5aca567fa85ed622766d258a6799ae0c7326b69968db8e9d512b0f605c5a141b61dc84e7d68a3f56204961c232be11b76b19b22
SSDEEP 1572864:groLm1cZ4K5MvHwpkeg9duXYFPEiFWITK886rc028B+yJwG5xmR:VCjwAI8xO
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2832	EpsilonSetup.exe
2832	EpsilonSetup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates processes with tasklist 1 TTPs 16 IoCs

Process Discovery

T1057

pid	Process
2296	tasklist.exe
2232	tasklist.exe
3156	tasklist.exe
3048	tasklist.exe
4100	tasklist.exe
3332	tasklist.exe
1612	tasklist.exe
3976	tasklist.exe
3156	tasklist.exe
3804	tasklist.exe
4364	tasklist.exe
1684	tasklist.exe
5084	tasklist.exe
2852	tasklist.exe
3920	tasklist.exe
1928	tasklist.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	tasklist.exe
Token: SeDebugPrivilege	2296	tasklist.exe
Token: SeDebugPrivilege	3976	tasklist.exe
Token: SeShutdownPrivilege	2832	EpsilonSetup.exe
Token: SeCreatePagefilePrivilege	2832	EpsilonSetup.exe
Token: SeDebugPrivilege	4100	tasklist.exe
Token: SeDebugPrivilege	3804	tasklist.exe
Token: SeDebugPrivilege	3332	tasklist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 1736	2832	EpsilonSetup.exe	128
PID 2832 wrote to memory of 1736	2832	EpsilonSetup.exe	128
PID 1736 wrote to memory of 3156	1736	cmd.exe	110
PID 1736 wrote to memory of 3156	1736	cmd.exe	110
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 4708	2832	EpsilonSetup.exe	76
PID 2832 wrote to memory of 3452	2832	EpsilonSetup.exe	78
PID 2832 wrote to memory of 3452	2832	EpsilonSetup.exe	78
PID 2832 wrote to memory of 3244	2832	EpsilonSetup.exe	79
PID 2832 wrote to memory of 3244	2832	EpsilonSetup.exe	79
PID 3244 wrote to memory of 2296	3244	cmd.exe	80
PID 3244 wrote to memory of 2296	3244	cmd.exe	80
PID 2832 wrote to memory of 3688	2832	EpsilonSetup.exe	84
PID 2832 wrote to memory of 3688	2832	EpsilonSetup.exe	84
PID 3688 wrote to memory of 3976	3688	cmd.exe	82
PID 3688 wrote to memory of 3976	3688	cmd.exe	82
PID 2832 wrote to memory of 4016	2832	EpsilonSetup.exe	93
PID 2832 wrote to memory of 4016	2832	EpsilonSetup.exe	93
PID 4016 wrote to memory of 4100	4016	cmd.exe	92
PID 4016 wrote to memory of 4100	4016	cmd.exe	92
PID 2832 wrote to memory of 3628	2832	EpsilonSetup.exe	90
PID 2832 wrote to memory of 3628	2832	EpsilonSetup.exe	90
PID 3628 wrote to memory of 3804	3628	cmd.exe	91
PID 3628 wrote to memory of 3804	3628	cmd.exe	91
PID 2832 wrote to memory of 3904	2832	EpsilonSetup.exe	115
PID 2832 wrote to memory of 3904	2832	EpsilonSetup.exe	115
PID 3904 wrote to memory of 3332	3904	cmd.exe	94
PID 3904 wrote to memory of 3332	3904	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\EpsilonSetup.exe
"C:\Users\Admin\AppData\Local\Temp\EpsilonSetup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Users\Admin\AppData\Local\Temp\EpsilonSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\EpsilonSetup.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1744,i,11795914305520127213,17058501618475977279,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:4708
- C:\Users\Admin\AppData\Local\Temp\EpsilonSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\EpsilonSetup.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --mojo-platform-channel-handle=1644 --field-trial-handle=1744,i,11795914305520127213,17058501618475977279,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
  2⤵
  PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3628
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:4452
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:8
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:2216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1600
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    PID:1612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:3288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- C:\Users\Admin\AppData\Local\Temp\EpsilonSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\EpsilonSetup.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1744,i,11795914305520127213,17058501618475977279,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
  2⤵
  PID:2956

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:3156

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4100

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3332

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:1684

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:2852

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:2232

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3156

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:3048

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:3920

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:5084

C:\Windows\system32\tasklist.exe
tasklist
1⤵
- Enumerates processes with tasklist
PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0c7fbaba-d589-4a60-b38c-3b277eb4adb2.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\0c7fbaba-d589-4a60-b38c-3b277eb4adb2.tmp.node
Size 52KB
SHA256 ce05c3dcafbd480befb68b28b79a7ef9c8274ac822b530846ac8fbc38136c806
MD5 96ddaf34c6620fa958510e3aba7fa17e
SHA1 faba488e505de3c3df7c54e7c8eb44d2b5fd2f41
SHA512 d75d63eac0dc26fba1474f5db85fff8bcc9ba5f27e6a47f43b4808eaa2501d11db027508684149c6e61968e057aca821dbe1e401b27c5175818dee7f5671d839
SSDEEP 768:RNTRcI0/IVQ8uPnvqvcgtW6e6PrbNlYaMZicfxxSukOkE7G9Jw7xVzd789fRXWXg:nTRLGvPGta698ioGLSnBXg
MD5 SHA1 SHA512 SSDEEP

Submit Download

aa63c6d8-71a4-4eb0-8f18-d21ff87c6c55.tmp.node

Path C:\Users\Admin\AppData\Local\Temp\aa63c6d8-71a4-4eb0-8f18-d21ff87c6c55.tmp.node
Size 84KB
SHA256 cc85f2e51836043eb53a6451efbb129fff29b2d56da9b1afd1a2999f30a6750b
MD5 a97522b02aff5ab4fef5ac57000926c5
SHA1 afe3694827a32bdfaba8511150a69cf60d669a6f
SHA512 02c2d8943fe9a9eb8ebaaf6db3ab7b4e1fec7c8b65be6c070f24878256931950b4a1af21f42a24b32d87a1415b579877e60270560af4a352a1de8814ba659a66
SSDEEP 1536:Ri6e4Hv+KNm3J9SvsRAYXhzck/dOXiK4+:RiCHv+KNmVu8dng
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2956-64-0x0000021B27DD0000-0x0000021B27DD1000-memory.dmp

Download

memory/2956-67-0x0000021B27DD0000-0x0000021B27DD1000-memory.dmp

Download

memory/2956-69-0x0000021B27DD0000-0x0000021B27DD1000-memory.dmp

Download

memory/2956-68-0x0000021B27DD0000-0x0000021B27DD1000-memory.dmp

Download

memory/2956-66-0x0000021B27DD0000-0x0000021B27DD1000-memory.dmp

Download

memory/2956-65-0x0000021B27DD0000-0x0000021B27DD1000-memory.dmp

Download

memory/2956-63-0x0000021B27DD0000-0x0000021B27DD1000-memory.dmp

Download

memory/2956-59-0x0000021B27DD0000-0x0000021B27DD1000-memory.dmp

Download

memory/2956-58-0x0000021B27DD0000-0x0000021B27DD1000-memory.dmp

Download

memory/2956-57-0x0000021B27DD0000-0x0000021B27DD1000-memory.dmp

Download

memory/4708-46-0x000002B6FA1E0000-0x000002B6FA24B000-memory.dmp

Download

memory/4708-10-0x00007FFB2A940000-0x00007FFB2A941000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads