evelyn_stealer | f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20251231-en
resource tags

arch:x64arch:x86image:win10v2004-20251231-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe
Size 433KB
Sample260122-scvm4set5e
SHA256 f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29
MD5 8867093d2d5c13f3e2b05af9060109ef
SHA1 a4e2aabbdd41606de784ee1a6180186486ee61ba
SHA512 f47087eb9c9207ba94d48f1432e2656abef987dc46e486e9b4bade37f135eba0882030f62b7b73c144fe586731bac9c023bc2f97681b93d2ccbfd9d1dae62e4e
SSDEEP 12288:ZiLe96QwyyYjV3xcetmXlWglgicFTXmV:ZiLE6JyzjV32umXlVgiMT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

browserkit evelyn_stealer loader stealer

Malware Config

Extracted

Credentials

Protocol
ftp
Host
paxfallow.ru
Port
21
Username
paxfallow
Password
7{;dn2,.CY0@Dc0H

Signatures

Detects Evelyn Stealer payload 5 IoCs

resource	yara_rule
behavioral1/memory/4152-0-0x00007FF7076E0000-0x00007FF707728000-memory.dmp	family_evelyn_stealer
behavioral1/memory/4152-2-0x00007FF7076E0000-0x00007FF707728000-memory.dmp	family_evelyn_stealer
behavioral1/memory/4152-3-0x00007FF7076E0000-0x00007FF707728000-memory.dmp	family_evelyn_stealer
behavioral1/memory/4152-4-0x00007FF7076E0000-0x00007FF707728000-memory.dmp	family_evelyn_stealer
behavioral1/memory/4152-8-0x00007FF7076E0000-0x00007FF707728000-memory.dmp	family_evelyn_stealer

EvelynStealer
Evelyn is a stealer targeting software developers via malicious Visual Studio Code extensions.
stealer loader browserkit evelyn_stealer
Evelyn_stealer family
evelyn_stealer

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	grpconv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Identifier	grpconv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	grpconv.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4144 set thread context of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe
4152	grpconv.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86
PID 4144 wrote to memory of 4152	4144	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	86

C:\Users\Admin\AppData\Local\Temp\f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe
"C:\Users\Admin\AppData\Local\Temp\f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\SYSTEM32\grpconv.exe
  grpconv.exe
  2⤵
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4152-0-0x00007FF7076E0000-0x00007FF707728000-memory.dmp

Download

memory/4152-2-0x00007FF7076E0000-0x00007FF707728000-memory.dmp

Download

memory/4152-3-0x00007FF7076E0000-0x00007FF707728000-memory.dmp

Download

memory/4152-4-0x00007FF7076E0000-0x00007FF707728000-memory.dmp

Download

memory/4152-8-0x00007FF7076E0000-0x00007FF707728000-memory.dmp

Download