Analysis

  • max time kernel
    1794s
  • max time network
    1809s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    20-11-2020 14:34

General

  • Target

    VyprVPN.exe

Malware Config

Signatures

  • Modifies WinLogon for persistence ⋅ 2 TTPs 2 IoCs
  • Executes dropped EXE ⋅ 6 IoCs
  • Checks computer location settings ⋅ 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL ⋅ 2 IoCs
  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of NtSetInformationThreadHideFromDebugger ⋅ 1 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer ⋅ 4 IoCs
  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe ⋅ 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VyprVPN.exe
    "C:\Users\Admin\AppData\Local\Temp\VyprVPN.exe"
    Loads dropped DLL
    Suspicious use of WriteProcessMemory
    PID:540
    • C:\Users\Admin\AppData\Roaming\1337\joinResult.exe
      "C:\Users\Admin\AppData\Roaming\1337\joinResult.exe"
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Users\Admin\AppData\Roaming\1337\1111.exe
        "C:\Users\Admin\AppData\Roaming\1337\1111.exe"
        Executes dropped EXE
        Checks computer location settings
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        PID:3304
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C ping 1.1.1.1 -n 3 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\1337\1111.exe"
          Suspicious use of WriteProcessMemory
          PID:3628
          • C:\Windows\SysWOW64\PING.EXE
            ping 1.1.1.1 -n 3 -w 3000
            Runs ping.exe
            PID:1896
      • C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
        "C:\Users\Admin\AppData\Roaming\1337\Clipper.exe"
        Modifies WinLogon for persistence
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Service" /tr "C:\Users\Admin\WinService.exe" /f
          Creates scheduled task(s)
          PID:1920
        • C:\Users\Admin\WinService.exe
          "C:\Users\Admin\WinService.exe"
          Executes dropped EXE
          Suspicious use of AdjustPrivilegeToken
          PID:492
    • C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
      "C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe"
      Executes dropped EXE
      PID:3120
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    Executes dropped EXE
    Suspicious use of AdjustPrivilegeToken
    PID:2024

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Privilege Escalation

                Replay Monitor

                00:00 00:00

                Downloads

                • C:\Users\Admin\AppData\Roaming\1337\1111.exe
                • C:\Users\Admin\AppData\Roaming\1337\1111.exe
                • C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
                • C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
                • C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
                • C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
                • C:\Users\Admin\AppData\Roaming\1337\joinResult.exe
                  MD5

                  79022fbafee9fe740a5230f87bd33171

                  SHA1

                  42bf0f7bf41009fd0009535a8b1162cbe60dce6f

                  SHA256

                  640c30cfa519be11c02c4e51bf18979a93266887cc9ef19076b3d0f1f20528b6

                  SHA512

                  48e0d4a18d99dce4398de73895a157e13293115b52ee5158f9ea6fc73c4d5f4133e1cebba14ff5482b8c4f7dfeebfe3b003df1caf351314f1cc16944818df4b3

                • C:\Users\Admin\AppData\Roaming\1337\joinResult.exe
                  MD5

                  79022fbafee9fe740a5230f87bd33171

                  SHA1

                  42bf0f7bf41009fd0009535a8b1162cbe60dce6f

                  SHA256

                  640c30cfa519be11c02c4e51bf18979a93266887cc9ef19076b3d0f1f20528b6

                  SHA512

                  48e0d4a18d99dce4398de73895a157e13293115b52ee5158f9ea6fc73c4d5f4133e1cebba14ff5482b8c4f7dfeebfe3b003df1caf351314f1cc16944818df4b3

                • C:\Users\Admin\WinService.exe
                • C:\Users\Admin\WinService.exe
                • C:\Users\Admin\WinService.exe
                • \Users\Admin\AppData\Local\Temp\nsqA0CC.tmp\System.dll
                • \Users\Admin\AppData\Local\Temp\nsz9DAF.tmp\System.dll
                • memory/492-25-0x00007FF9A7730000-0x00007FF9A811C000-memory.dmp
                • memory/492-22-0x0000000000000000-mapping.dmp
                • memory/1896-34-0x0000000000000000-mapping.dmp
                • memory/1920-21-0x0000000000000000-mapping.dmp
                • memory/2024-38-0x00007FF9A77D0000-0x00007FF9A81BC000-memory.dmp
                • memory/2816-14-0x00007FF9A7730000-0x00007FF9A811C000-memory.dmp
                • memory/2816-19-0x0000000000420000-0x0000000000421000-memory.dmp
                • memory/2816-11-0x0000000000000000-mapping.dmp
                • memory/3120-18-0x00000000731F0000-0x00000000738DE000-memory.dmp
                • memory/3120-35-0x0000000005540000-0x0000000005541000-memory.dmp
                • memory/3120-4-0x0000000000000000-mapping.dmp
                • memory/3120-36-0x0000000005840000-0x0000000005841000-memory.dmp
                • memory/3120-28-0x0000000000A10000-0x0000000000A11000-memory.dmp
                • memory/3120-30-0x00000000055A0000-0x00000000055A1000-memory.dmp
                • memory/3120-31-0x0000000005B40000-0x0000000005B41000-memory.dmp
                • memory/3120-32-0x00000000056E0000-0x00000000056E1000-memory.dmp
                • memory/3304-8-0x0000000000000000-mapping.dmp
                • memory/3304-16-0x00000000038E0000-0x00000000038E1000-memory.dmp
                • memory/3304-17-0x0000000003AE0000-0x0000000003AE1000-memory.dmp
                • memory/3304-15-0x00000000038E0000-0x00000000038E1000-memory.dmp
                • memory/3628-33-0x0000000000000000-mapping.dmp
                • memory/3772-1-0x0000000000000000-mapping.dmp