evelyn_stealer | f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29

General

Target
f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe
Size 433KB
Sample260122-scvm4set5e
SHA256 f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29
MD5 8867093d2d5c13f3e2b05af9060109ef
SHA1 a4e2aabbdd41606de784ee1a6180186486ee61ba
SHA512 f47087eb9c9207ba94d48f1432e2656abef987dc46e486e9b4bade37f135eba0882030f62b7b73c144fe586731bac9c023bc2f97681b93d2ccbfd9d1dae62e4e
SSDEEP 12288:ZiLe96QwyyYjV3xcetmXlWglgicFTXmV:ZiLE6JyzjV32umXlVgiMT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

browserkit evelyn_stealer loader stealer

Malware Config

Extracted

Credentials

Protocol
ftp
Host
paxfallow.ru
Port
21
Username
paxfallow
Password
7{;dn2,.CY0@Dc0H

Signatures

Detects Evelyn Stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/1836-2-0x00007FF767560000-0x00007FF7675A8000-memory.dmp	family_evelyn_stealer
behavioral2/memory/1836-0-0x00007FF767560000-0x00007FF7675A8000-memory.dmp	family_evelyn_stealer
behavioral2/memory/1836-3-0x00007FF767560000-0x00007FF7675A8000-memory.dmp	family_evelyn_stealer
behavioral2/memory/1836-4-0x00007FF767560000-0x00007FF7675A8000-memory.dmp	family_evelyn_stealer
behavioral2/memory/1836-8-0x00007FF767560000-0x00007FF7675A8000-memory.dmp	family_evelyn_stealer

EvelynStealer
Evelyn is a stealer targeting software developers via malicious Visual Studio Code extensions.
stealer loader browserkit evelyn_stealer
Evelyn_stealer family
evelyn_stealer

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	grpconv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Identifier	grpconv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	grpconv.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5152 set thread context of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe
1836	grpconv.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77
PID 5152 wrote to memory of 1836	5152	f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe	77

C:\Users\Admin\AppData\Local\Temp\f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe
"C:\Users\Admin\AppData\Local\Temp\f19eafacaaa51626c86152c1b5c38f865d3abbe112852f494b2cc099b1963f29.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5152
- C:\Windows\SYSTEM32\grpconv.exe
  grpconv.exe
  2⤵
  - Maps connected drives based on registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1836-2-0x00007FF767560000-0x00007FF7675A8000-memory.dmp

Download

memory/1836-0-0x00007FF767560000-0x00007FF7675A8000-memory.dmp

Download

memory/1836-3-0x00007FF767560000-0x00007FF7675A8000-memory.dmp

Download

memory/1836-4-0x00007FF767560000-0x00007FF7675A8000-memory.dmp

Download

memory/1836-8-0x00007FF767560000-0x00007FF7675A8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads