Overview
overview
3Static
static
1epigrass-2...ut4.py
windows7-x64
3epigrass-2...ut4.py
windows10-2004-x64
3epigrass-2...new.py
windows7-x64
3epigrass-2...new.py
windows10-2004-x64
3epigrass-2...lay.py
windows7-x64
3epigrass-2...lay.py
windows10-2004-x64
3epigrass-2...tor.py
windows7-x64
3epigrass-2...tor.py
windows10-2004-x64
3epigrass-2...t__.py
windows7-x64
3epigrass-2...t__.py
windows10-2004-x64
3epigrass-2...n__.py
windows7-x64
3epigrass-2...n__.py
windows10-2004-x64
3epigrass-2...out.py
windows7-x64
3epigrass-2...out.py
windows10-2004-x64
3epigrass-2...nel.py
windows7-x64
3epigrass-2...nel.py
windows10-2004-x64
3epigrass-2...ect.py
windows7-x64
3epigrass-2...ect.py
windows10-2004-x64
3epigrass-2..._io.py
windows7-x64
3epigrass-2..._io.py
windows10-2004-x64
3epigrass-2...aph.py
windows7-x64
3epigrass-2...aph.py
windows10-2004-x64
3epigrass-2...des.py
ubuntu-18.04-amd64
3epigrass-2...des.py
debian-9-armhf
3epigrass-2...des.py
debian-9-mips
3epigrass-2...des.py
debian-9-mipsel
3epigrass-2...tor.py
ubuntu-18.04-amd64
3epigrass-2...tor.py
debian-9-armhf
3epigrass-2...tor.py
debian-9-mips
3epigrass-2...tor.py
debian-9-mipsel
3epigrass-2...lay.py
ubuntu-18.04-amd64
3epigrass-2...lay.py
debian-9-armhf
3Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15-09-2024 16:53
Static task
static1
Behavioral task
behavioral1
Sample
epigrass-2.0b1/Epigrass/Ui_about4.py
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
epigrass-2.0b1/Epigrass/Ui_about4.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
epigrass-2.0b1/Epigrass/Ui_cpanel4new.py
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
epigrass-2.0b1/Epigrass/Ui_cpanel4new.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
epigrass-2.0b1/Epigrass/Ui_display.py
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
epigrass-2.0b1/Epigrass/Ui_display.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
epigrass-2.0b1/Epigrass/Ui_epgeditor.py
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
epigrass-2.0b1/Epigrass/Ui_epgeditor.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
epigrass-2.0b1/Epigrass/__init__.py
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
epigrass-2.0b1/Epigrass/__init__.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
epigrass-2.0b1/Epigrass/__version__.py
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
epigrass-2.0b1/Epigrass/__version__.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
epigrass-2.0b1/Epigrass/about.py
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
epigrass-2.0b1/Epigrass/about.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
epigrass-2.0b1/Epigrass/cpanel.py
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
epigrass-2.0b1/Epigrass/cpanel.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
epigrass-2.0b1/Epigrass/dataObject.py
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
epigrass-2.0b1/Epigrass/dataObject.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
epigrass-2.0b1/Epigrass/data_io.py
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
epigrass-2.0b1/Epigrass/data_io.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
epigrass-2.0b1/Epigrass/dgraph.py
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
epigrass-2.0b1/Epigrass/dgraph.py
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
epigrass-2.0b1/Epigrass/elasticnodes.py
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral24
Sample
epigrass-2.0b1/Epigrass/elasticnodes.py
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral25
Sample
epigrass-2.0b1/Epigrass/elasticnodes.py
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral26
Sample
epigrass-2.0b1/Epigrass/elasticnodes.py
Resource
debian9-mipsel-20240611-en
Behavioral task
behavioral27
Sample
epigrass-2.0b1/Epigrass/epgeditor.py
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral28
Sample
epigrass-2.0b1/Epigrass/epgeditor.py
Resource
debian9-armhf-20240729-en
Behavioral task
behavioral29
Sample
epigrass-2.0b1/Epigrass/epgeditor.py
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral30
Sample
epigrass-2.0b1/Epigrass/epgeditor.py
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral31
Sample
epigrass-2.0b1/Epigrass/epiRTplay.py
Resource
ubuntu1804-amd64-20240729-en
Behavioral task
behavioral32
Sample
epigrass-2.0b1/Epigrass/epiRTplay.py
Resource
debian9-armhf-20240611-en
General
-
Target
epigrass-2.0b1/Epigrass/__version__.py
-
Size
18B
-
MD5
0127eedf06af365b03d618960b9e516c
-
SHA1
247add0d66ceef9e2573ccf545ccd303ef559560
-
SHA256
a6cc52c7fec0ad3abb6110235cf50e92b3d5c0bd4cb1abf18eac6e9868402877
-
SHA512
8044cf0b41c58d37c14155cec3933d6947a5817c7d143beffddbb9ba257e6ba43442c7cead5b133ff67cb531415c63527b1cafd99b4cca36e3263698950e272b
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\py_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\.py rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2744 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2744 AcroRd32.exe 2744 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2568 3012 cmd.exe 31 PID 3012 wrote to memory of 2568 3012 cmd.exe 31 PID 3012 wrote to memory of 2568 3012 cmd.exe 31 PID 2568 wrote to memory of 2744 2568 rundll32.exe 32 PID 2568 wrote to memory of 2744 2568 rundll32.exe 32 PID 2568 wrote to memory of 2744 2568 rundll32.exe 32 PID 2568 wrote to memory of 2744 2568 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\epigrass-2.0b1\Epigrass\__version__.py1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\epigrass-2.0b1\Epigrass\__version__.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\epigrass-2.0b1\Epigrass\__version__.py"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2744
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53ba8c43bd2af82e9f39550e43b96b347
SHA15246036b77db41c0de89b6f74de310b62c8591d5
SHA256bc87eb3fb72d9835851567976e807ba32d9c96b554041401c7e2e81795a1456f
SHA512222c2cfb07f8976d7c8677151e441e840d677f2b562c1d52f11241965c7475dbf5019c126aeb6823b30ad3e8d7f29411b01444cc3199f55a2fdfa5031281d93a