d588dbd2b761c92b00e7ba4ea0bae7a1be8a3379757ea26eee28c3cfaffa3f26

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d588dbd2b761c92b00e7ba4ea0bae7a1be8a3379757ea26eee28c3cfaffa3f26.exe
Size 1.0MB
Sample260827-slphfswsgx
SHA256 d588dbd2b761c92b00e7ba4ea0bae7a1be8a3379757ea26eee28c3cfaffa3f26
MD5 a1e9bfdd80888c2860089759bb441231
SHA1 480ad55fc0fd7686087874d84b19f5f7b168a71a
SHA512 f3f3c053f453495250cfcf105f6cbec14031fd7eafadb8c2f96be3f6404ca9ed093fb0124e4fe9363b83cbd810fc4dd3582b23eaf2ac8794959b3fd246805ace
SSDEEP 24576:5uMh6yS4sVYnVtV9WUx/Io2RnKNj64rNh:cySEVx/T2JKh5Nh
TLSH
T17F35D090BBC47F2CDE12183041AEA3D363BCAE61ED3F8F99AB5DCB59AC610705535216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4968	_Epea.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgpijnfepiooggbnejfodjfhdomniidd\3.9\manifest.json	_Epea.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgpijnfepiooggbnejfodjfhdomniidd\3.9\manifest.json	_Epea.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgpijnfepiooggbnejfodjfhdomniidd\3.9\manifest.json	_Epea.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgpijnfepiooggbnejfodjfhdomniidd\3.9\manifest.json	_Epea.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dgpijnfepiooggbnejfodjfhdomniidd\3.9\manifest.json	_Epea.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	_Epea.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	_Epea.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	_Epea.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	_Epea.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	_Epea.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d588dbd2b761c92b00e7ba4ea0bae7a1be8a3379757ea26eee28c3cfaffa3f26.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4968	_Epea.exe
4968	_Epea.exe
4968	_Epea.exe
4968	_Epea.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 4968	3036	d588dbd2b761c92b00e7ba4ea0bae7a1be8a3379757ea26eee28c3cfaffa3f26.exe	87

C:\Users\Admin\AppData\Local\Temp\d588dbd2b761c92b00e7ba4ea0bae7a1be8a3379757ea26eee28c3cfaffa3f26.exe
"C:\Users\Admin\AppData\Local\Temp\d588dbd2b761c92b00e7ba4ea0bae7a1be8a3379757ea26eee28c3cfaffa3f26.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\12bf5b61\_Epea.exe
  "C:\Users\Admin\AppData\Local\Temp/12bf5b61/_Epea.exe"
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lsdb.js

Path C:\Users\Admin\AppData\Local\Chromatic Browser\User Data\Default\Extensions\dgpijnfepiooggbnejfodjfhdomniidd\3.9\lsdb.js
Size 8KB
SHA256 feff1b9a2ddc72c8dfce8eedf8f9cad3f2f7d3605af928ab2cb7b19e39847f56
MD5 23552ec7cd64a5232962b84226c190e5
SHA1 37765b92d95058ca2e1051bba2ab976c2032c1a0
SHA512 f828a2a4701b5b8b93e615263211592480e3ed4cb08dae5631e17ea9004595a9a8a7ce7b8206bd0c0aebfa534a491eee998804e4396d4a7fd53cf280db400268
SSDEEP 192:jYcqk4Ooq1qYOfXZNykcTNULiN7oxvZ9Y3JDK96ZMMCu:jDq7Oj1BTyLY7oxvfoJc7e
TLSH
T12902D84FB6CCE085C25ADAB89AC6E892E2761ADC5470438CF1076D62EDD45F0F3F9940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\12bf5b61\[email protected]\bootstrap.js
Size 2KB
SHA256 6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
MD5 df13f711e20e9c80171846d4f2f7ae06
SHA1 56d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA512 6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
TLSH
T1F951C18BE5FE141004793D646A1FE7E535838672398D4A462BA54284FFE4C9BD782DC8
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\12bf5b61\[email protected]\chrome.manifest
Size 25B
SHA256 fd87c974ad51d8d288a2a90cd5d0698a69397fb00650877041b92548c564fb8b
MD5 238292d79974d312a7ebd6eb5e5de478
SHA1 adef4e91d04b9adab96137db5169a52c0f258e69
SHA512 94a904d11877c799611ec818546a7c026b8cda8ff06e370e5605c747a30c80bb83e7464ececc025436510ad807a75d1220e91a97da7ff1f13d49cf0f7725a2ab
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\12bf5b61\[email protected]\content\bg.js
Size 27KB
SHA256 0af1c76d3178645ca0c678f84e8c43266a805c1515b279d6b31d27036ea7bd00
MD5 ded48c509169cf129ff36048dd547ca3
SHA1 5bb19b19640dd84c887ca25f988a767d6a5618f2
SHA512 1e6ba586f69e85de9173de55dd4d3e2afd938e6563f9a60471e13a5b61f975ae23804969ac8e463af17b57a99dc6a00676f65ae6cea0cc59969228771a11d4ed
SSDEEP 384:ECqBM8nKbyHmHVBY9XV7iYMKJ/Ocp9npu/tGfIs/DiGfIpY09JCke4u467pQv:ipMzDYT7F3QGXWGroms
TLSH
T143C2D549F58CE5684EA3E6A1158F9C53E12730D9205CC274B9DAFC81EACC27BD3D9A70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\12bf5b61\[email protected]\install.rdf
Size 607B
SHA256 7bbd128b28e5ac11e1985ad0ced77284c610ad7fbae1e57b7a1cf7682496d56e
MD5 ce59ae1c080d393eb73ac60d2cf90940
SHA1 69ad875a8d30be63e6c32824c6ce4c4aaf145b9b
SHA512 56cdc108eeb0e6016edcb61336549f44fedd7f5f0f192e01162d63d9d359f7a5ac07bc162e3842e9574ef5bf0e095b5df4268a9f9ed59411b9350f975dae4b7a
TLSH
T1AFF02815CE41FE55E177CB262C708144B6B917AE85829048FC9F1E138B9C6EE51B7643
MD5 SHA1 SHA512 TLSH

Submit Download

_Epea.dat

Path C:\Users\Admin\AppData\Local\Temp\12bf5b61\_Epea.dat
Size 1KB
SHA256 61dc7a30791b512c9f35effab34c3a38455a71f56953a557d2e9d3584ccf16f6
MD5 4ef553aa508e9835f7865bc966f9998c
SHA1 af36393a00ddb15e79157a621139ec8f0cc93640
SHA512 6f3edf828fd2e18254b843ad6bddcea49217222e8405d0f3c440fb2023e7369f31076f60914d65ce436fa5d3c102f6ed28cc23a6cd8e5ba95a68cc04738f35e0
TLSH
T18C21862053DE72F018A58E9146A523E068D1CA6CB4B949B6C58DDFE025D88E19D707BC
MD5 SHA1 SHA512 TLSH

Submit Download

_Epea.exe

Path C:\Users\Admin\AppData\Local\Temp\12bf5b61\_Epea.exe
Size 636KB
SHA256 e9c1bdfe6f660073e6466851df89ce3cefcc59f034b9d4381a284251353a7bda
MD5 70e0929e823a6c67b9ca012805c0d253
SHA1 d32f7377cf15f837cc74346e721312fb3390631a
SHA512 f7c753cc0269e41203de1cc8701d9bb7b0a861faa28f14f74e04534382b974a46d8f7e69316c5232a1a4eb8beee2d747e08347f1542ffaafd7afa37c650636c5
SSDEEP 12288:2EJVVIFJIeGxO2BAYG3H4d3f/VDgOW+RANQA153fl8C5TMv:2EJVVIFJIeGxO2BAYGS3f/VcOWCAP5P8
TLSH
T195D48E5175A0FC3BCB6246B64BAFFFE06DF9B5E60971141733D4009C296E682E026B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

J1C.js

Path C:\Users\Admin\AppData\Local\Temp\12bf5b61\dgpijnfepiooggbnejfodjfhdomniidd\J1C.js
Size 26KB
SHA256 d6406db268aa51b33b00f823431747ec5406b417d1bd11a1a7d0919738b98381
MD5 7b311bef0cd6cacb84423136f4b835ee
SHA1 ac9f848d392e34fb422c0d8d4c144d5865612e5c
SHA512 1f36f699653acfc8febbc9b94782b610881b6188017f5e192f45cd6a4018aeb44a5f802c5c4ad7de7fd1d240f4d3e9ce4ccb09c9661141ab0dd975b421f590e8
SSDEEP 768:vkeOngW8Tms0iPQ9rKNEHEZPXcGGXWGQRvxs:vfOngQ+PUkOmXSyRps
TLSH
T154C2C5CC39CD2D50854693A35B475663F13B38892C589C89FC1EBF52AF4F2E582D9E60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\12bf5b61\dgpijnfepiooggbnejfodjfhdomniidd\background.html
Size 140B
SHA256 5faa76b0986b1227ea923832f69c70265fd91ce3e894432749057b149e3d6039
MD5 b15e8f1cabbd1769c31a8c7dc4823aed
SHA1 5b0dc3a57a49379494d0c97ff26c6d9ac329dd75
SHA512 aaf2bb1ebd18b6081d674c5d68e35e86744047f6f08d43a9d031e5f946ffc42f2db1d33b6fdaff54b45848a38f3f8ab1a0b8c1b46c89ee4ceb9d9b6547c05e6e
TLSH
T171C09BD9AD55906CAD513DD40DF1B25C4C4CC515B451CD381DF93439494139D8C17751
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\12bf5b61\dgpijnfepiooggbnejfodjfhdomniidd\content.js
Size 5KB
SHA256 6d52235edf47b188b3eb3391089944d19c2cf41c8fa3d13938dae15606e1b368
MD5 0e403d5dcdc74be5037b3099b8572819
SHA1 6f6a28d3916031cfd4a9a1a5b4555a127882b707
SHA512 37c9659c207328837e4ee54c15fc39dee06c9d34217fc2198ccb433a144f4f89efdf66dd15cd3f1bbbe85fd7d545d8f841e7a18c406228e766f81509cad7ac32
SSDEEP 96:uoKBByZc3xqigL0HXu3OXWXuBCzslST+9/TTO2LqmyLK6mVQacrWc3sJXT:uosBHx5I2XtCqkMe2LusVMwT
TLSH
T10BC1D89F390E30D99696EBA8D382C4D2E0735CC968B0428CF90F5CA0DDD99B0D4DDEA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\12bf5b61\dgpijnfepiooggbnejfodjfhdomniidd\lsdb.js
Size 8KB
SHA256 8394d7fd40761852ef3fb03d7b3a51e0f3a641987cfa0976978e3fbc05df0db5
MD5 f003b83b49ebd6657b4c1fef376b9bef
SHA1 72240710da49454f7234b4c467853fbbdb3a6d3e
SHA512 057726520434695ebbfc30de941192b7d51fad7487f52c9e3853f91c38f76374869f11f93ce4a45414405330b7ef30f19b9f38426aa734b63b2e84c0d4e5db3b
SSDEEP 192:wYcqk4Ooq1qYOfXZNykcTNULiN7oxvZ9Y3JDK96ZMMCu:wDq7Oj1BTyLY7oxvfoJc7e
TLSH
T1AE02D84FB6CCE485825AD6A89AC6E4A2F2761AEC5470838CF1076D61EDD45F0F3FA940
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\12bf5b61\dgpijnfepiooggbnejfodjfhdomniidd\manifest.json
Size 503B
SHA256 13005929a59ef595fac2f9ccac4a99317e0170a1bf1461efe0a1682ce5faf8e0
MD5 4552641e4c8245588174b112bee887e9
SHA1 f6ee76d05d67479edae13359ab1c0c73523dffeb
SHA512 028d677521a465d94d6c47dec647dc06a39d09846798a73eeab76cb595570f1b7742bfe0e7ed0121296fc4ffe4a658b428baa931fd686d103123f1a669463fde
TLSH
T117F0E273FC44483622F9AB6568B4A243FA62178F20D00C0FB93E645C0BB0AB61062325
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Administrator\AppData\Local\Chromatic Browser\User Data\Default\Extensions\dgpijnfepiooggbnejfodjfhdomniidd\3.9\manifest.json
Size 503B
SHA256 e8460c726f0ec51998042a1ff5f54b8f6eec3c450022b471cfcff2a88c3a27e3
MD5 da416e8ca04680fa8e4f520ecfbbdadf
SHA1 e31b669481d80621ceaaa00839f544d8f5480635
SHA512 844989d336492f1d9e3a81216e2d02cdc52993e3daf36221a68d9adad3e5534ef8473b31b76a5c0fb7f6aacf2f33feb81a5059d63b44c5b06668e3239a05b842
TLSH
T159F01777E0444D24C5BD9E3A25B05142FA62538F2480480FB439441C0F708662112205
MD5 SHA1 SHA512 TLSH

Submit Download

J1C.js

Path C:\Users\WDAGUtilityAccount\AppData\Local\Chromatic Browser\User Data\Default\Extensions\dgpijnfepiooggbnejfodjfhdomniidd\3.9\J1C.js
Size 26KB
SHA256 35df6208a766ef9898bf6bdb8b35b2cf3e14303d298ecaa4028ff3538b5f519b
MD5 7f312190bac5e8c3c89b639a40978dcd
SHA1 e1f45d72a4071392aac3a232b11749cc14ed7661
SHA512 0b5a2614d596e26042bbefad9aaea31c9d31b3e07bc6bc7b48f6e6c042cb7ce173f8087d8453b98bb00ada09105e7715697f5d03264ff12a1956007f6770169a
SSDEEP 768:beOngW8Tms0iPQ9rKNEHEZPXcGGXWGQRvxs:qOngQ+PUkOmXSyRps
TLSH
T178C2A38839CD2D50C54693B39B475663F13B38892C589C89FC1EBF12AF4E2E582D9E60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download