Analysis

  • max time kernel
    152s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20240319-en
  • resource tags

    arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
  • submitted
    28-03-2024 02:15

General

  • Target

    Epsilon.exe

  • Size

    134.3MB

  • MD5

    128d442c123dbbeefecbffea681b591b

  • SHA1

    88eaf983ab17105eab1e399794f84f50f0ce6d43

  • SHA256

    a12809190b023bc9ea27d62ef20c705ecdfc59e93c081ee5af996c5b484c325b

  • SHA512

    779f1b557de61fbf9dad1fe04149c18c26a1cabf8beb2c57c2dd57a1a4be3a88187ffbef8657bcd948a0a6d40ea0f09c3381b290fd597210f039b854dec41eb1

  • SSDEEP

    1572864:XicLgaO9p7sMMcmhRhgBx/CyhwGKsME1:khTRsJE1

Score
10/10

Malware Config

Signatures

  • Epsilon Stealer

    Information stealer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Epsilon.exe
    "C:\Users\Admin\AppData\Local\Temp\Epsilon.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1764
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic CsProduct Get UUID
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2944
    • C:\Users\Admin\AppData\Local\Temp\Epsilon.exe
      "C:\Users\Admin\AppData\Local\Temp\Epsilon.exe" --type=gpu-process --field-trial-handle=1088,11716050505130814434,6172186780451195855,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Epsilon" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1092 /prefetch:2
      2⤵
        PID:2492
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2760
        • C:\Windows\system32\reg.exe
          C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
          3⤵
            PID:1800
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2720
          • C:\Windows\system32\reg.exe
            C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
            3⤵
              PID:1080
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /d /s /c "tasklist"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2708
            • C:\Windows\system32\tasklist.exe
              tasklist
              3⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:2032
          • C:\Users\Admin\AppData\Local\Temp\Epsilon.exe
            "C:\Users\Admin\AppData\Local\Temp\Epsilon.exe" --type=gpu-process --field-trial-handle=1088,11716050505130814434,6172186780451195855,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\Epsilon" --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1212 /prefetch:2
            2⤵
              PID:792
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
              2⤵
                PID:1588
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1696
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
                2⤵
                  PID:2692
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic path win32_VideoController get name
                    3⤵
                    • Detects videocard installed
                    PID:564
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
                  2⤵
                    PID:1224
                    • C:\Windows\system32\cmd.exe
                      cmd /c chcp 65001
                      3⤵
                        PID:2824
                        • C:\Windows\system32\chcp.com
                          chcp 65001
                          4⤵
                            PID:2820
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show profiles
                          3⤵
                            PID:1392
                        • C:\Users\Admin\AppData\Local\Temp\Epsilon.exe
                          "C:\Users\Admin\AppData\Local\Temp\Epsilon.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1088,11716050505130814434,6172186780451195855,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Epsilon" --mojo-platform-channel-handle=956 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:824

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt

                        Filesize

                        231B

                        MD5

                        dec2be4f1ec3592cea668aa279e7cc9b

                        SHA1

                        327cf8ab0c895e10674e00ea7f437784bb11d718

                        SHA256

                        753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

                        SHA512

                        81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

                      • \Users\Admin\AppData\Local\Temp\cb1d90d0-4f57-48f6-a79d-d8300040d0f2.tmp.node

                        Filesize

                        2.2MB

                        MD5

                        21c0c86fc97746243dbfed6184130595

                        SHA1

                        f9070ff18fc58233064e38afa268b7667c81f27a

                        SHA256

                        b52834c2a3a3606a20d59249561e45d64f125188113bb559fdace34c600784a3

                        SHA512

                        507426244218bc32bc765fc68692cb2b3e7ab666adf2e52f3dd0939e97cb27d55bc1283b1c4c4575470fe1b3371e7d978fbe7c8efcb9e1f9836b0059f7fd7ae4

                      • \Users\Admin\AppData\Local\Temp\d2399590-cabb-465f-a9d5-a41f4ae033c8.tmp.node

                        Filesize

                        652KB

                        MD5

                        7f9b96ba7cbbb0c88d2005ccb669b54c

                        SHA1

                        c3aea9f1075493deb74c1a05f73f609a8086a8d9

                        SHA256

                        8c60efec7940e69a083350640ec5f42d43d8b979711080f1aef3bda825a9928b

                        SHA512

                        306aa838d928fc98b0d7429d984cf32d4814d9312445f4745bcf7f920d63223f8e1965bb36f7bf6518228f4541c5c5aa74fc28aa358055f1f893b0edd7216d82

                      • memory/2492-5-0x0000000000060000-0x0000000000061000-memory.dmp

                        Filesize

                        4KB

                      • memory/2492-38-0x0000000076BE0000-0x0000000076BE1000-memory.dmp

                        Filesize

                        4KB