Overview
overview
10Static
static
3EpsilonClassic.exe
windows7-x64
10EpsilonClassic.exe
windows10-2004-x64
10$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3EpsilonClassic.exe
windows7-x64
10EpsilonClassic.exe
windows10-2004-x64
10LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3demo/CMakeLists.vbs
windows7-x64
1demo/CMakeLists.vbs
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 16:53
Static task
static1
Behavioral task
behavioral1
Sample
EpsilonClassic.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
EpsilonClassic.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
EpsilonClassic.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral8
Sample
EpsilonClassic.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
LICENSES.chromium.html
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
LICENSES.chromium.html
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
resources/elevate.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral19
Sample
resources/elevate.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
swiftshader/libEGL.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral21
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
swiftshader/libGLESv2.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral23
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
vk_swiftshader.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral25
Sample
vk_swiftshader.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
vulkan-1.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral27
Sample
vulkan-1.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
demo/CMakeLists.vbs
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral31
Sample
demo/CMakeLists.vbs
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
EpsilonClassic.exe
-
Size
140.1MB
-
MD5
d60aed1b86f5ce34c81ffacaf4c2635a
-
SHA1
f0caed459f1c85f653d11cf4510d0f3cf9b82179
-
SHA256
532b43f7e8e9f89b203e8198792383395b9e47767db0e5d91779d918722a710f
-
SHA512
01f789d5ac3526a73b578ed559109eb26df543f7ce45c9b0a41803c929b5cb3db392c324cd1ad0da059e919b6ca5d3785801836f39e164eec81a463ac09bf98a
-
SSDEEP
1572864:42Cm7gJKfVjsPawuFHNwczWTeMkF7ZEk8bCkKbj:/aodJFek8+k
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation EpsilonClassic.exe Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation EpsilonClassic.exe -
Loads dropped DLL 2 IoCs
pid Process 2360 EpsilonClassic.exe 2360 EpsilonClassic.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 ipinfo.io 24 ipinfo.io -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1568 tasklist.exe 1772 tasklist.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 EpsilonClassic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C EpsilonClassic.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 EpsilonClassic.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3196 EpsilonClassic.exe 3196 EpsilonClassic.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1568 tasklist.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeDebugPrivilege 1772 tasklist.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe Token: SeShutdownPrivilege 2360 EpsilonClassic.exe Token: SeCreatePagefilePrivilege 2360 EpsilonClassic.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 EpsilonClassic.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 1060 2360 EpsilonClassic.exe 85 PID 2360 wrote to memory of 4312 2360 EpsilonClassic.exe 86 PID 2360 wrote to memory of 4312 2360 EpsilonClassic.exe 86 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87 PID 2360 wrote to memory of 3672 2360 EpsilonClassic.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\EpsilonClassic.exe"C:\Users\Admin\AppData\Local\Temp\EpsilonClassic.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\EpsilonClassic.exe"C:\Users\Admin\AppData\Local\Temp\EpsilonClassic.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\EpsilonClassic" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1884,i,17992284727472572320,13672210869366554518,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:1060
-
-
C:\Users\Admin\AppData\Local\Temp\EpsilonClassic.exe"C:\Users\Admin\AppData\Local\Temp\EpsilonClassic.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\EpsilonClassic" --mojo-platform-channel-handle=2160 --field-trial-handle=1884,i,17992284727472572320,13672210869366554518,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵PID:4312
-
-
C:\Users\Admin\AppData\Local\Temp\EpsilonClassic.exe"C:\Users\Admin\AppData\Local\Temp\EpsilonClassic.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\EpsilonClassic" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2416 --field-trial-handle=1884,i,17992284727472572320,13672210869366554518,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
PID:3672
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryla\WinSCP 2\Sessions"2⤵PID:4900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4272
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1568
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4456
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
-
-
C:\Users\Admin\AppData\Local\Temp\EpsilonClassic.exe"C:\Users\Admin\AppData\Local\Temp\EpsilonClassic.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\EpsilonClassic" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2872 --field-trial-handle=1884,i,17992284727472572320,13672210869366554518,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5083fd9f2e3e93e1f2c599a2b609c9e5e
SHA16db2b6ce3e60d828ca32a6000c270c09224f3139
SHA2565800c926c34c7ef38a45840c30e8855c1b3a6ec1ec8f37ffc6ce2d402728eabd
SHA51208206b13d7e91f36d65de545b483d5fa446c2a1d8baab4c2fb19aa711af10cbfd98da3811d34a16033b5c09eb297fdcfaf09a186b4dcf69e84bb4dfcc11d96b2
-
Filesize
642KB
MD5ab4a1c882f829aaeb65be643caa4e88a
SHA1a5ebfe571aa30feae9ff52cbf18f7b0ae3cccb12
SHA2569e29441fc2b83a9f2457f7e4e4c829970883b34a891533228c85fdff3e703db8
SHA512548055c6eaddaf2aa66abc53ede4e311aa942d2d33ee6bf47e694e32b4c54bde73322f5d88b3192fde4f9226f265dd0d156573b2434ace8af5d6e36af182a880
-
Filesize
231B
MD5dec2be4f1ec3592cea668aa279e7cc9b
SHA1327cf8ab0c895e10674e00ea7f437784bb11d718
SHA256753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc
SHA51281728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66
-
Filesize
296B
MD50157796824da1e3e67078937e4ff3d19
SHA1b233d24a6de6e3b1f94cfa8c101c9296b10c9915
SHA256b0551afe82304f318f9a2fb3bfe47975677ee4d79dd3be91d54694a42612b6ca
SHA51213c3e953349159a0feb58240727ec8532977266d39977612d84f762caf999b85db5fb7d49d4eec83818c77b9a3eaf94e3c043effa512cbe10d52b05be0cb95aa
-
Filesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84