Overview

overview

10

Static

static

8

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

4

ฺฺฺK...ฺฺ

windows10_x64

7

ฺฺฺK...ฺฺ

windows10_x64

3

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

8

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺK...ฺฺ

windows10_x64

1

ฺฺฺK...ฺฺ

windows10_x64

3

Resubmissions

18-11-2020 14:18

201118-dj27sn3f52 10

18-11-2020 13:42

201118-1arz86e7w6 10

18-11-2020 13:38

201118-n8jh228ctn 10

Analysis

  • max time kernel
    1788s
  • max time network
    386s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    18-11-2020 14:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VPN/VyprVPN.exe

Score
10/10
persistencespywarestealer

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Executes dropped EXE 35 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 4 IoCs
    installer
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VPN\VyprVPN.exe
    "C:\Users\Admin\AppData\Local\Temp\VPN\VyprVPN.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3160
    • C:\Users\Admin\AppData\Roaming\1337\joinResult.exe
      "C:\Users\Admin\AppData\Roaming\1337\joinResult.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2868
      • C:\Users\Admin\AppData\Roaming\1337\1111.exe
        "C:\Users\Admin\AppData\Roaming\1337\1111.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3608
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C ping 1.1.1.1 -n 3 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\1337\1111.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2036
          • C:\Windows\SysWOW64\PING.EXE
            ping 1.1.1.1 -n 3 -w 3000
            5⤵
            • Runs ping.exe
            PID:2816
      • C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
        "C:\Users\Admin\AppData\Roaming\1337\Clipper.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Service" /tr "C:\Users\Admin\WinService.exe" /f
          4⤵
          • Creates scheduled task(s)
          PID:1176
        • C:\Users\Admin\WinService.exe
          "C:\Users\Admin\WinService.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4020
    • C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
      "C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe"
      2⤵
      • Executes dropped EXE
      PID:4004
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3060
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3216
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2652
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:992
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1964
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:764
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:204
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2264
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3180
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2488
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1340
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2500
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2768
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1108
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3736
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3928
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4080
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1100
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:312
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3452
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:4000
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2456
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3996
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2600
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1256
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1136
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1644
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3840
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2376
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:3648

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Winlogon Helper DLL

1
T1004

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\1337\1111.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\1337\1111.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
    Download Submit
  • C:\Users\Admin\AppData\Roaming\1337\joinResult.exe
    MD5

    79022fbafee9fe740a5230f87bd33171

    SHA1

    42bf0f7bf41009fd0009535a8b1162cbe60dce6f

    SHA256

    640c30cfa519be11c02c4e51bf18979a93266887cc9ef19076b3d0f1f20528b6

    SHA512

    48e0d4a18d99dce4398de73895a157e13293115b52ee5158f9ea6fc73c4d5f4133e1cebba14ff5482b8c4f7dfeebfe3b003df1caf351314f1cc16944818df4b3

    Download Submit
  • C:\Users\Admin\AppData\Roaming\1337\joinResult.exe
    MD5

    79022fbafee9fe740a5230f87bd33171

    SHA1

    42bf0f7bf41009fd0009535a8b1162cbe60dce6f

    SHA256

    640c30cfa519be11c02c4e51bf18979a93266887cc9ef19076b3d0f1f20528b6

    SHA512

    48e0d4a18d99dce4398de73895a157e13293115b52ee5158f9ea6fc73c4d5f4133e1cebba14ff5482b8c4f7dfeebfe3b003df1caf351314f1cc16944818df4b3

    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • C:\Users\Admin\WinService.exe
    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsa3ADE.tmp\System.dll
    Download Submit
  • \Users\Admin\AppData\Local\Temp\nsr3DFB.tmp\System.dll
    Download Submit
  • memory/204-62-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/312-110-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/764-58-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/992-50-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1100-106-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1108-90-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1136-138-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1176-26-0x0000000000000000-mapping.dmp
    Download
  • memory/1256-134-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1340-78-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1644-142-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/1964-54-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/2036-35-0x0000000000000000-mapping.dmp
    Download
  • memory/2104-10-0x0000000000000000-mapping.dmp
    Download
  • memory/2104-16-0x0000000000B70000-0x0000000000B71000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2104-14-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/2264-66-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/2376-150-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/2456-122-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/2488-74-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/2500-82-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/2600-130-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/2652-46-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/2768-86-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/2816-36-0x0000000000000000-mapping.dmp
    Download
  • memory/2868-1-0x0000000000000000-mapping.dmp
    Download
  • memory/3060-38-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/3180-70-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/3216-42-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/3452-114-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/3608-17-0x0000000002DC0000-0x0000000002DC1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3608-8-0x0000000000000000-mapping.dmp
    Download
  • memory/3608-19-0x0000000002DC0000-0x0000000002DC1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3608-20-0x0000000002FC0000-0x0000000002FC1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3648-154-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/3736-94-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/3840-146-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/3928-98-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/3996-126-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/4000-118-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/4004-32-0x0000000004E10000-0x0000000004E11000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4004-24-0x0000000005210000-0x0000000005211000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4004-15-0x0000000072770000-0x0000000072E5E000-memory.dmp
    Filesize

    6.9MB

    Download
  • memory/4004-31-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4004-25-0x0000000004D10000-0x0000000004D11000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4004-23-0x0000000004B30000-0x0000000004B31000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4004-21-0x0000000000020000-0x0000000000021000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4004-5-0x0000000000000000-mapping.dmp
    Download
  • memory/4020-27-0x0000000000000000-mapping.dmp
    Download
  • memory/4020-30-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download
  • memory/4080-102-0x00007FFFF2BF0000-0x00007FFFF35DC000-memory.dmp
    Filesize

    9.9MB

    Download