epsilon | d7743de6297d389fe33c2323cda5cf6d9d4857e2dd201a571dccdf15100875f7

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25-03-2024 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

azkzkzz.exe
Size

134.3MB
MD5

d731a941b7e19d97e648a8814c2261b7
SHA1

7d4dab7356bcaad4b8ddfa9e1aa123e070453fc5
SHA256

3357e2751c152a44e9ec41d08205d70f9fc185d59ec0bf30b2e5a1009c917046
SHA512

9c634c9530232715bf8984cc1f51042891e049abd47a946257c098bfeca5b1755fb99be4a4928ca49e29cd8a86a212e7a35537b23c0f80c87bb7429e40a3aa5a
SSDEEP

1572864:XicLgaO9p7sMMcmhRhgBx/CyhwGKsME1:khTRsJE1

Score

10^/10

epsilon spyware stealer

Malware Config

Signatures

Epsilon Stealer
Information stealer.
stealer epsilon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\International\Geo\Nation	azkzkzz.exe

Loads dropped DLL 2 IoCs

pid	Process
1732	azkzkzz.exe
1732	azkzkzz.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ipinfo.io
3	ipinfo.io

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2316	WMIC.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2128	tasklist.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2280	azkzkzz.exe
1732	azkzkzz.exe
1732	azkzkzz.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2516	WMIC.exe
Token: SeSecurityPrivilege	2516	WMIC.exe
Token: SeTakeOwnershipPrivilege	2516	WMIC.exe
Token: SeLoadDriverPrivilege	2516	WMIC.exe
Token: SeSystemProfilePrivilege	2516	WMIC.exe
Token: SeSystemtimePrivilege	2516	WMIC.exe
Token: SeProfSingleProcessPrivilege	2516	WMIC.exe
Token: SeIncBasePriorityPrivilege	2516	WMIC.exe
Token: SeCreatePagefilePrivilege	2516	WMIC.exe
Token: SeBackupPrivilege	2516	WMIC.exe
Token: SeRestorePrivilege	2516	WMIC.exe
Token: SeShutdownPrivilege	2516	WMIC.exe
Token: SeDebugPrivilege	2516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2516	WMIC.exe
Token: SeRemoteShutdownPrivilege	2516	WMIC.exe
Token: SeUndockPrivilege	2516	WMIC.exe
Token: SeManageVolumePrivilege	2516	WMIC.exe
Token: 33	2516	WMIC.exe
Token: 34	2516	WMIC.exe
Token: 35	2516	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2516	WMIC.exe
Token: SeSecurityPrivilege	2516	WMIC.exe
Token: SeTakeOwnershipPrivilege	2516	WMIC.exe
Token: SeLoadDriverPrivilege	2516	WMIC.exe
Token: SeSystemProfilePrivilege	2516	WMIC.exe
Token: SeSystemtimePrivilege	2516	WMIC.exe
Token: SeProfSingleProcessPrivilege	2516	WMIC.exe
Token: SeIncBasePriorityPrivilege	2516	WMIC.exe
Token: SeCreatePagefilePrivilege	2516	WMIC.exe
Token: SeBackupPrivilege	2516	WMIC.exe
Token: SeRestorePrivilege	2516	WMIC.exe
Token: SeShutdownPrivilege	2516	WMIC.exe
Token: SeDebugPrivilege	2516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2516	WMIC.exe
Token: SeRemoteShutdownPrivilege	2516	WMIC.exe
Token: SeUndockPrivilege	2516	WMIC.exe
Token: SeManageVolumePrivilege	2516	WMIC.exe
Token: 33	2516	WMIC.exe
Token: 34	2516	WMIC.exe
Token: 35	2516	WMIC.exe
Token: SeDebugPrivilege	2128	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1624	WMIC.exe
Token: SeSecurityPrivilege	1624	WMIC.exe
Token: SeTakeOwnershipPrivilege	1624	WMIC.exe
Token: SeLoadDriverPrivilege	1624	WMIC.exe
Token: SeSystemProfilePrivilege	1624	WMIC.exe
Token: SeSystemtimePrivilege	1624	WMIC.exe
Token: SeProfSingleProcessPrivilege	1624	WMIC.exe
Token: SeIncBasePriorityPrivilege	1624	WMIC.exe
Token: SeCreatePagefilePrivilege	1624	WMIC.exe
Token: SeBackupPrivilege	1624	WMIC.exe
Token: SeRestorePrivilege	1624	WMIC.exe
Token: SeShutdownPrivilege	1624	WMIC.exe
Token: SeDebugPrivilege	1624	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1624	WMIC.exe
Token: SeRemoteShutdownPrivilege	1624	WMIC.exe
Token: SeUndockPrivilege	1624	WMIC.exe
Token: SeManageVolumePrivilege	1624	WMIC.exe
Token: 33	1624	WMIC.exe
Token: 34	1624	WMIC.exe
Token: 35	1624	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1624	WMIC.exe
Token: SeSecurityPrivilege	1624	WMIC.exe
Token: SeTakeOwnershipPrivilege	1624	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2592	1732	azkzkzz.exe	28
PID 1732 wrote to memory of 2592	1732	azkzkzz.exe	28
PID 1732 wrote to memory of 2592	1732	azkzkzz.exe	28
PID 2592 wrote to memory of 2516	2592	cmd.exe	30
PID 2592 wrote to memory of 2516	2592	cmd.exe	30
PID 2592 wrote to memory of 2516	2592	cmd.exe	30
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 2700	1732	azkzkzz.exe	31
PID 1732 wrote to memory of 1776	1732	azkzkzz.exe	33
PID 1732 wrote to memory of 1776	1732	azkzkzz.exe	33
PID 1732 wrote to memory of 1776	1732	azkzkzz.exe	33
PID 1732 wrote to memory of 2320	1732	azkzkzz.exe	35
PID 1732 wrote to memory of 2320	1732	azkzkzz.exe	35
PID 1732 wrote to memory of 2320	1732	azkzkzz.exe	35
PID 1732 wrote to memory of 1644	1732	azkzkzz.exe	37
PID 1732 wrote to memory of 1644	1732	azkzkzz.exe	37
PID 1732 wrote to memory of 1644	1732	azkzkzz.exe	37
PID 1776 wrote to memory of 1572	1776	cmd.exe	39
PID 1776 wrote to memory of 1572	1776	cmd.exe	39
PID 1776 wrote to memory of 1572	1776	cmd.exe	39
PID 1644 wrote to memory of 2128	1644	cmd.exe	40
PID 1644 wrote to memory of 2128	1644	cmd.exe	40
PID 1644 wrote to memory of 2128	1644	cmd.exe	40
PID 2320 wrote to memory of 1604	2320	cmd.exe	41
PID 2320 wrote to memory of 1604	2320	cmd.exe	41

C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe
"C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic CsProduct Get UUID
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe
  "C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe" --type=gpu-process --field-trial-handle=964,2867470694700995589,4765887767353777288,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\azkzkzz" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=972 /prefetch:2
  2⤵
  PID:2700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
    3⤵
    PID:1572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:1604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
  2⤵
  PID:1728
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  PID:1464
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:2316
- C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe
  "C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe" --type=gpu-process --field-trial-handle=964,2867470694700995589,4765887767353777288,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\azkzkzz" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1264 /prefetch:2
  2⤵
  PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
  2⤵
  PID:2748
- - C:\Windows\system32\cmd.exe
    cmd /c chcp 65001
    3⤵
    PID:716
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:480
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    PID:1156
- C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe
  "C:\Users\Admin\AppData\Local\Temp\azkzkzz.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=964,2867470694700995589,4765887767353777288,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\azkzkzz" --mojo-platform-channel-handle=1520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt

Filesize
231B

MD5
dec2be4f1ec3592cea668aa279e7cc9b

SHA1
327cf8ab0c895e10674e00ea7f437784bb11d718

SHA256
753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

SHA512
81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

Download Submit
\Users\Admin\AppData\Local\Temp\13a2ccf1-b774-461c-9b92-2aacafbe89ad.tmp.node

Filesize
2.7MB

MD5
e0ff0b488af11e33ee8016f7f0cffeae

SHA1
1c9d8c97db2bb7f163aa30caddd4a4a3c870cf9e

SHA256
70bcf19069421a1ebb01f7adc10cca544c8960a4575bd37f80e79762b9b9be81

SHA512
a0e0cf3dd68bae4d7e20f19411e65603900c87788b3ea146f53d2f8bf9bb1deb214b4f0bad6e26c35392d1899f002789668203ed148b95ff74a269c07f94f0d8

Download Submit
\Users\Admin\AppData\Local\Temp\60a26e05-646b-4166-96a4-b7eb485fc436.tmp.node

Filesize
652KB

MD5
c5c6631f2706203785a1880d748869e9

SHA1
5f80f6e68168b19d5bdca53e568b3e0584688383

SHA256
60932f76ed62a1ab950663dda8ba07ca47e2ba6b7c2caf29884c42e0901ce8c8

SHA512
58b65a7063d990b0becb7e9dbebe56cf16d8d626e0be175be59c52fe8718d2646b9e3318c11261c133a85e0006de59238430c843e244093f32a894244d8400b4

Download Submit
memory/2700-5-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2700-39-0x0000000077600000-0x0000000077601000-memory.dmp

Filesize
4KB

Download