epsilon | b56e537748f6b1c35ab9a4ef5e45191be683b0feb81114555dd9cc5f3ecfd532

Analysis

max time kernel
301s
max time network
307s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
18/03/2025, 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zadasd.exe
Size

168.4MB
MD5

2255529e3642bbe1fd72802505a054d0
SHA1

b1ef88ba4f076a5ace9ca06b14e5268b31913ce9
SHA256

6c364b190c38b2a86e05923431e0f9999e80639386ea70688a92039ba96b8c84
SHA512

98543ff588cfa39556fbe276c4a907c1319996ec5918ca0325831ea1b71b2c565f30ee12e6ffc7ebaad6df49effaa4f73c16062a27d80754ec07b1c35e64b8b3
SSDEEP

1572864:OFMGWm9AKuVLWFivYPZ9eNo6pIaIPbDjK14DTbGWeUVXIHzzx9dbF5Zwa80aSesY:BGFWZoNaKDTopXz

Score

10^/10

epsilon discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Epsilon Stealer
Information stealer.
stealer epsilon
Epsilon family
epsilon

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3342763580-2723508992-2885672917-1000\Control Panel\International\Geo\Nation	zadasd.exe

Loads dropped DLL 2 IoCs

pid	Process
2176	zadasd.exe
2176	zadasd.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ipinfo.io
8	ipinfo.io

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4980	tasklist.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3848	cmd.exe
1020	netsh.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3400	WMIC.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2432	zadasd.exe
2432	zadasd.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5380	WMIC.exe
Token: SeSecurityPrivilege	5380	WMIC.exe
Token: SeTakeOwnershipPrivilege	5380	WMIC.exe
Token: SeLoadDriverPrivilege	5380	WMIC.exe
Token: SeSystemProfilePrivilege	5380	WMIC.exe
Token: SeSystemtimePrivilege	5380	WMIC.exe
Token: SeProfSingleProcessPrivilege	5380	WMIC.exe
Token: SeIncBasePriorityPrivilege	5380	WMIC.exe
Token: SeCreatePagefilePrivilege	5380	WMIC.exe
Token: SeBackupPrivilege	5380	WMIC.exe
Token: SeRestorePrivilege	5380	WMIC.exe
Token: SeShutdownPrivilege	5380	WMIC.exe
Token: SeDebugPrivilege	5380	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5380	WMIC.exe
Token: SeRemoteShutdownPrivilege	5380	WMIC.exe
Token: SeUndockPrivilege	5380	WMIC.exe
Token: SeManageVolumePrivilege	5380	WMIC.exe
Token: 33	5380	WMIC.exe
Token: 34	5380	WMIC.exe
Token: 35	5380	WMIC.exe
Token: 36	5380	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5380	WMIC.exe
Token: SeSecurityPrivilege	5380	WMIC.exe
Token: SeTakeOwnershipPrivilege	5380	WMIC.exe
Token: SeLoadDriverPrivilege	5380	WMIC.exe
Token: SeSystemProfilePrivilege	5380	WMIC.exe
Token: SeSystemtimePrivilege	5380	WMIC.exe
Token: SeProfSingleProcessPrivilege	5380	WMIC.exe
Token: SeIncBasePriorityPrivilege	5380	WMIC.exe
Token: SeCreatePagefilePrivilege	5380	WMIC.exe
Token: SeBackupPrivilege	5380	WMIC.exe
Token: SeRestorePrivilege	5380	WMIC.exe
Token: SeShutdownPrivilege	5380	WMIC.exe
Token: SeDebugPrivilege	5380	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5380	WMIC.exe
Token: SeRemoteShutdownPrivilege	5380	WMIC.exe
Token: SeUndockPrivilege	5380	WMIC.exe
Token: SeManageVolumePrivilege	5380	WMIC.exe
Token: 33	5380	WMIC.exe
Token: 34	5380	WMIC.exe
Token: 35	5380	WMIC.exe
Token: 36	5380	WMIC.exe
Token: SeDebugPrivilege	4980	tasklist.exe
Token: SeShutdownPrivilege	2176	zadasd.exe
Token: SeCreatePagefilePrivilege	2176	zadasd.exe
Token: SeIncreaseQuotaPrivilege	4524	WMIC.exe
Token: SeSecurityPrivilege	4524	WMIC.exe
Token: SeTakeOwnershipPrivilege	4524	WMIC.exe
Token: SeLoadDriverPrivilege	4524	WMIC.exe
Token: SeSystemProfilePrivilege	4524	WMIC.exe
Token: SeSystemtimePrivilege	4524	WMIC.exe
Token: SeProfSingleProcessPrivilege	4524	WMIC.exe
Token: SeIncBasePriorityPrivilege	4524	WMIC.exe
Token: SeCreatePagefilePrivilege	4524	WMIC.exe
Token: SeBackupPrivilege	4524	WMIC.exe
Token: SeRestorePrivilege	4524	WMIC.exe
Token: SeShutdownPrivilege	4524	WMIC.exe
Token: SeDebugPrivilege	4524	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4524	WMIC.exe
Token: SeRemoteShutdownPrivilege	4524	WMIC.exe
Token: SeUndockPrivilege	4524	WMIC.exe
Token: SeManageVolumePrivilege	4524	WMIC.exe
Token: 33	4524	WMIC.exe
Token: 34	4524	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 4304	2176	zadasd.exe	85
PID 2176 wrote to memory of 4304	2176	zadasd.exe	85
PID 4304 wrote to memory of 5380	4304	cmd.exe	87
PID 4304 wrote to memory of 5380	4304	cmd.exe	87
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 388	2176	zadasd.exe	88
PID 2176 wrote to memory of 3164	2176	zadasd.exe	89
PID 2176 wrote to memory of 3164	2176	zadasd.exe	89
PID 2176 wrote to memory of 4688	2176	zadasd.exe	91
PID 2176 wrote to memory of 4688	2176	zadasd.exe	91
PID 2176 wrote to memory of 1468	2176	zadasd.exe	92
PID 2176 wrote to memory of 1468	2176	zadasd.exe	92
PID 2176 wrote to memory of 4912	2176	zadasd.exe	95
PID 2176 wrote to memory of 4912	2176	zadasd.exe	95
PID 1468 wrote to memory of 4712	1468	cmd.exe	97
PID 1468 wrote to memory of 4712	1468	cmd.exe	97
PID 4688 wrote to memory of 4960	4688	cmd.exe	98
PID 4688 wrote to memory of 4960	4688	cmd.exe	98
PID 4912 wrote to memory of 4980	4912	cmd.exe	99
PID 4912 wrote to memory of 4980	4912	cmd.exe	99
PID 2176 wrote to memory of 4852	2176	zadasd.exe	100
PID 2176 wrote to memory of 4852	2176	zadasd.exe	100
PID 4852 wrote to memory of 4524	4852	cmd.exe	102
PID 4852 wrote to memory of 4524	4852	cmd.exe	102
PID 2176 wrote to memory of 4844	2176	zadasd.exe	103
PID 2176 wrote to memory of 4844	2176	zadasd.exe	103
PID 4844 wrote to memory of 3400	4844	cmd.exe	105
PID 4844 wrote to memory of 3400	4844	cmd.exe	105
PID 2176 wrote to memory of 3848	2176	zadasd.exe	106
PID 2176 wrote to memory of 3848	2176	zadasd.exe	106
PID 3848 wrote to memory of 996	3848	cmd.exe	108
PID 3848 wrote to memory of 996	3848	cmd.exe	108
PID 996 wrote to memory of 5012	996	cmd.exe	109
PID 996 wrote to memory of 5012	996	cmd.exe	109
PID 3848 wrote to memory of 1020	3848	cmd.exe	110
PID 3848 wrote to memory of 1020	3848	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\zadasd.exe
"C:\Users\Admin\AppData\Local\Temp\zadasd.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic CsProduct Get UUID
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5380
- C:\Users\Admin\AppData\Local\Temp\zadasd.exe
  "C:\Users\Admin\AppData\Local\Temp\zadasd.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\zadasd" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1760,i,64380088038567234,12389335989735553156,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  PID:388
- C:\Users\Admin\AppData\Local\Temp\zadasd.exe
  "C:\Users\Admin\AppData\Local\Temp\zadasd.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\zadasd" --mojo-platform-channel-handle=1936 --field-trial-handle=1760,i,64380088038567234,12389335989735553156,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
  2⤵
  PID:3164
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"
    3⤵
    PID:4960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\system32\reg.exe
    C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:4712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\system32\cmd.exe
    cmd /c chcp 65001
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:5012
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:1020
- C:\Users\Admin\AppData\Local\Temp\zadasd.exe
  "C:\Users\Admin\AppData\Local\Temp\zadasd.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\zadasd" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2984 --field-trial-handle=1760,i,64380088038567234,12389335989735553156,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9659b4c1-2a50-4444-a243-ca2245810405.tmp.node

Filesize
126KB

MD5
1ca6e9085852bc3dba34ba35a39692de

SHA1
3154b90a17f7a1a67c98078c4e47f57dc7271d87

SHA256
6b2bfc6cf087208dbba6eae1672aa60b981fb1aab5f02ecd3c9b97942e16f913

SHA512
eaf2ba60bd900049ac31552561ce7f0cc91cee07400bc2460b4731a969dea62c3115fd3e5d509302285162bca2bbeaaa12822f8acca25f0720bfb5e01079caba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Web Data

Filesize
228KB

MD5
ee463e048e56b687d02521cd12788e2c

SHA1
ee26598f8e8643df84711960e66a20ecbc6321b8

SHA256
3a07b3003758a79a574aa73032076567870389751f2a959537257070da3a10d8

SHA512
42b395bf6bd97da800385b9296b63a4b0edd7b3b50dc92f19e61a89235a42d37d204359b57d506e6b25ab95f16625cce035ed3b55ef2d54951c82332498dab0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\a555c22f-ade3-49b9-8837-719e9cd88029.tmp.node

Filesize
1.6MB

MD5
9e6a91d0e8ab5d97e4ff8622c83a9da5

SHA1
f157b7cda8b59fb17dc86cdbca7268e35a2cd16b

SHA256
1961ae8783a767ad6c9ea2a4c21e3c7e38105195fd6ac6ba7dc7528d6161beeb

SHA512
a9860de3a5e4e3f47672e001941a1678fe6b8ef4ce19bd43a17c8dafa8bf16606e0e4cafd8fcefa7532fb53bec73531bb0e68367fd3b85ba1c00b05f882c670c

Download Submit
C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Antivirus.txt

Filesize
231B

MD5
dec2be4f1ec3592cea668aa279e7cc9b

SHA1
327cf8ab0c895e10674e00ea7f437784bb11d718

SHA256
753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc

SHA512
81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66

Download Submit
memory/2432-57-0x00000249FA100000-0x00000249FA101000-memory.dmp

Filesize
4KB

Download
memory/2432-58-0x00000249FA100000-0x00000249FA101000-memory.dmp

Filesize
4KB

Download
memory/2432-59-0x00000249FA100000-0x00000249FA101000-memory.dmp

Filesize
4KB

Download
memory/2432-63-0x00000249FA100000-0x00000249FA101000-memory.dmp

Filesize
4KB

Download
memory/2432-69-0x00000249FA100000-0x00000249FA101000-memory.dmp

Filesize
4KB

Download
memory/2432-68-0x00000249FA100000-0x00000249FA101000-memory.dmp

Filesize
4KB

Download
memory/2432-67-0x00000249FA100000-0x00000249FA101000-memory.dmp

Filesize
4KB

Download
memory/2432-66-0x00000249FA100000-0x00000249FA101000-memory.dmp

Filesize
4KB

Download
memory/2432-64-0x00000249FA100000-0x00000249FA101000-memory.dmp

Filesize
4KB

Download
memory/2432-65-0x00000249FA100000-0x00000249FA101000-memory.dmp

Filesize
4KB

Download