Analysis

  • max time kernel
    155s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-03-2024 12:10

General

  • Target

    Epsilon.exe

  • Size

    134.3MB

  • MD5

    128d442c123dbbeefecbffea681b591b

  • SHA1

    88eaf983ab17105eab1e399794f84f50f0ce6d43

  • SHA256

    a12809190b023bc9ea27d62ef20c705ecdfc59e93c081ee5af996c5b484c325b

  • SHA512

    779f1b557de61fbf9dad1fe04149c18c26a1cabf8beb2c57c2dd57a1a4be3a88187ffbef8657bcd948a0a6d40ea0f09c3381b290fd597210f039b854dec41eb1

  • SSDEEP

    1572864:XicLgaO9p7sMMcmhRhgBx/CyhwGKsME1:khTRsJE1

Malware Config

Signatures

  • Epsilon Stealer

    Information stealer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Kills process with taskkill 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Epsilon.exe
    "C:\Users\Admin\AppData\Local\Temp\Epsilon.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic CsProduct Get UUID
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3960
    • C:\Users\Admin\AppData\Local\Temp\Epsilon.exe
      "C:\Users\Admin\AppData\Local\Temp\Epsilon.exe" --type=gpu-process --field-trial-handle=1660,17441358116975432013,10653387638185122891,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Epsilon" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 /prefetch:2
      2⤵
        PID:840
      • C:\Users\Admin\AppData\Local\Temp\Epsilon.exe
        "C:\Users\Admin\AppData\Local\Temp\Epsilon.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1660,17441358116975432013,10653387638185122891,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Epsilon" --mojo-platform-channel-handle=1972 /prefetch:8
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:3380
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:972
        • C:\Windows\system32\taskkill.exe
          taskkill /IM chrome.exe /F
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4604
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4056
        • C:\Windows\system32\taskkill.exe
          taskkill /IM msedge.exe /F
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2864
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1768
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
          3⤵
            PID:4852
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4624
          • C:\Windows\system32\reg.exe
            C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
            3⤵
              PID:5092
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "tasklist"
            2⤵
              PID:3564
              • C:\Windows\system32\tasklist.exe
                tasklist
                3⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:3176
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
              2⤵
                PID:972
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4644
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                2⤵
                  PID:1896
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic path win32_VideoController get name
                    3⤵
                    • Detects videocard installed
                    PID:2860
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
                  2⤵
                    PID:4588
                    • C:\Windows\system32\cmd.exe
                      cmd /c chcp 65001
                      3⤵
                        PID:4564
                        • C:\Windows\system32\chcp.com
                          chcp 65001
                          4⤵
                            PID:652
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profiles
                          3⤵
                            PID:1600
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f"
                          2⤵
                            PID:4684
                            • C:\Windows\system32\reg.exe
                              C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsBootManager /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsBootManager.exe /f
                              3⤵
                              • Adds Run key to start application
                              PID:2028
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /d /s /c "tasklist"
                            2⤵
                              PID:4900
                              • C:\Windows\system32\tasklist.exe
                                tasklist
                                3⤵
                                • Enumerates processes with tasklist
                                PID:3260
                            • C:\Users\Admin\AppData\Local\Temp\Epsilon.exe
                              "C:\Users\Admin\AppData\Local\Temp\Epsilon.exe" --type=gpu-process --field-trial-handle=1660,17441358116975432013,10653387638185122891,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\Epsilon" --gpu-preferences=UAAAAAAAAADoAAAIAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=724 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:764
                          • C:\Windows\System32\CompPkgSrv.exe
                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                            1⤵
                              PID:3508

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Temp\2b0ac97a-e8d9-46c5-9042-7a2894975b3b.tmp.node

                              Filesize

                              2.7MB

                              MD5

                              dfd9fc878f9ba46103152b652f6d9a5b

                              SHA1

                              ab91f928efeea38b2cffb3bedccd7b5bf36d0a5e

                              SHA256

                              15e367a1de229135c65b6099dc5e1f0022d7bac833f8594d04beff5b7d37de3a

                              SHA512

                              1749bb2a8e7f8c8057c47067c71c1b27500e1f8a01f8f08c02c41f94b2b17846f4a67741c6401332ec445f667169b3220c4a23a58e8f2d2168d4001328f8fc1b

                            • C:\Users\Admin\AppData\Local\Temp\812ee495-1fa9-4494-a704-54aa019b771a.tmp.node

                              Filesize

                              652KB

                              MD5

                              23d27ff28c534e279752e78228ea7c86

                              SHA1

                              dffb31b6af27de08bebe66b6cd2a4cbc785c123a

                              SHA256

                              713479673dfb53cd041ed377ae4fb9e06ad2c897de4e9de49e4d5d79d76361fe

                              SHA512

                              5f89ef8cd837e713c160ed5f04eef7f19d998abc100c499aa946a1ea615bc1aee526d3055917c6bf16d0e2e487d38269fb832c186880978b1ef6d75723092538

                            • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt

                              Filesize

                              240B

                              MD5

                              810ae82f863a5ffae14d3b3944252a4e

                              SHA1

                              5393e27113753191436b14f0cafa8acabcfe6b2a

                              SHA256

                              453478914b72d9056472fb1e44c69606c62331452f47a1f3c02190f26501785c

                              SHA512

                              2421a397dd2ebb17947167addacd3117f666ddab388e3678168075f58dc8eee15bb49a4aac2290140ae5102924852d27b538740a859d0b35245f505b20f29112

                            • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Cookies\Google Chrome_Default.txt

                              Filesize

                              273B

                              MD5

                              76b15962038ddc53a535e77abeed6928

                              SHA1

                              b2225b888132fec7fbe1cb004c27804d339dbdeb

                              SHA256

                              12c86c7f376d7fc4d14af18418043e84bde83d7a48cd7f4468dc976e230537c6

                              SHA512

                              77ac68c8a671d098777ddbbd0ac6c3c1740b2425d27f246c983a3d93c41d2fe5f8582651c3c3287c166cd3f374c52f29c7263c3ec6f675177b2de9ba304fd497

                            • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt

                              Filesize

                              231B

                              MD5

                              dec2be4f1ec3592cea668aa279e7cc9b

                              SHA1

                              327cf8ab0c895e10674e00ea7f437784bb11d718

                              SHA256

                              753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

                              SHA512

                              81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

                            • memory/764-82-0x00000268AF080000-0x00000268AF081000-memory.dmp

                              Filesize

                              4KB

                            • memory/764-80-0x00000268AF080000-0x00000268AF081000-memory.dmp

                              Filesize

                              4KB

                            • memory/764-81-0x00000268AF080000-0x00000268AF081000-memory.dmp

                              Filesize

                              4KB

                            • memory/764-86-0x00000268AF080000-0x00000268AF081000-memory.dmp

                              Filesize

                              4KB

                            • memory/764-89-0x00000268AF080000-0x00000268AF081000-memory.dmp

                              Filesize

                              4KB

                            • memory/764-87-0x00000268AF080000-0x00000268AF081000-memory.dmp

                              Filesize

                              4KB

                            • memory/764-88-0x00000268AF080000-0x00000268AF081000-memory.dmp

                              Filesize

                              4KB

                            • memory/764-91-0x00000268AF080000-0x00000268AF081000-memory.dmp

                              Filesize

                              4KB

                            • memory/764-90-0x00000268AF080000-0x00000268AF081000-memory.dmp

                              Filesize

                              4KB

                            • memory/764-92-0x00000268AF080000-0x00000268AF081000-memory.dmp

                              Filesize

                              4KB

                            • memory/840-6-0x00007FFA7E510000-0x00007FFA7E511000-memory.dmp

                              Filesize

                              4KB