Analysis
-
max time kernel
17s -
max time network
66s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
16-01-2021 19:19
Static task
static1
Behavioral task
behavioral1
Sample
intervpnmix2_1.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
intervpnmix2_1.exe
Resource
win10v20201028
General
-
Target
intervpnmix2_1.exe
-
Size
9.0MB
-
MD5
aa1515279a03f6726d34f9f97ad3ecce
-
SHA1
4a73a63691bbdf15af411ca1bd9c7bfc85110f32
-
SHA256
dc1338766ff9398ff8d68c77e43143a4028ff389ff0231bd941869add11241b0
-
SHA512
157e283e27613601c84692f85125d62c6301db16447eccc72a5118e11913689ab4194d140f0dd99ad0d7776618c8ea301c13e304491ba4277142ebcb36ed8153
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 2 IoCs
Processes:
vruns.exeintervpnmix2.exepid process 3784 vruns.exe 3284 intervpnmix2.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
vruns.exeintervpnmix2.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vruns.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion vruns.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion intervpnmix2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion intervpnmix2.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
vruns.exeintervpnmix2.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Wine vruns.exe Key opened \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Wine intervpnmix2.exe -
Loads dropped DLL 1 IoCs
Processes:
intervpnmix2_1.exepid process 1108 intervpnmix2_1.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
vruns.exeintervpnmix2.exepid process 3784 vruns.exe 3284 intervpnmix2.exe -
Drops file in Program Files directory 44 IoCs
Processes:
intervpnmix2_1.exedescription ioc process File created C:\Program Files (x86)\InterVpn\InterVpn\unins000.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\openvpn.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\OpenVPN64\bin\openvpn-gui.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows64\bin\devcon.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows64\driver\tap0901.sys intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows64\driver\System64Folder\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc\oemwin2k.inf intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\liblzo2-2.dll intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\openssl.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\OpenVPN64\bin\openvpn.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows\bin\addtap.bat intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\vpnpro.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\test.ovpn intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows\driver\tap0901.sys intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows\driver\OemVista.inf intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows64\driver\System64Folder\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc\oemwin2k.PNF intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows64\driver\System64Folder\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc\tap0901.sys intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\unins000.dat intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\openvpnserv.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\OpenVPN64\bin\libeay32.dll intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows\bin\deltapall.bat intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\OpenVPN64\bin\ssleay32.dll intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows\bin\devcon.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows\driver\OemWin2k.inf intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows64\driver\OemWin2k.inf intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\memmgrset.dll intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\openvpn-gui.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\intervpnmix2.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\OpenVPN64\bin\libpkcs11-helper-1.dll intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows64\driver\System64Folder\DriverStore\FileRepository\oemwin2k.inf_amd64_5a1fec2fbbccefcc\tap0901.cat intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows64\driver\tap0901.cat intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\superb.ovpn intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\vpn850936802.ovpn intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\OpenVPN64\bin\openssl.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows\bin\tapinstall.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\OpenVPN64\bin\openvpnserv.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows\driver\tap0901.cat intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows64\bin\addtap.bat intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\TAP-Windows64\bin\deltapall.bat intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\countries.tsv intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\japonia.ovpn intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\libpkcs11-helper-1.dll intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\OpenVPN64\bin\liblzo2-2.dll intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\stop_all.exe intervpnmix2_1.exe File created C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\vruns.exe intervpnmix2_1.exe -
Drops file in Windows directory 1 IoCs
Processes:
intervpnmix2_1.exedescription ioc process File created C:\Windows\INF\oem59.PNF intervpnmix2_1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
vruns.exeintervpnmix2.exepid process 3784 vruns.exe 3784 vruns.exe 3284 intervpnmix2.exe 3284 intervpnmix2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
intervpnmix2_1.exedescription pid process target process PID 1108 wrote to memory of 3784 1108 intervpnmix2_1.exe vruns.exe PID 1108 wrote to memory of 3784 1108 intervpnmix2_1.exe vruns.exe PID 1108 wrote to memory of 3784 1108 intervpnmix2_1.exe vruns.exe PID 1108 wrote to memory of 3284 1108 intervpnmix2_1.exe intervpnmix2.exe PID 1108 wrote to memory of 3284 1108 intervpnmix2_1.exe intervpnmix2.exe PID 1108 wrote to memory of 3284 1108 intervpnmix2_1.exe intervpnmix2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\intervpnmix2_1.exe"C:\Users\Admin\AppData\Local\Temp\intervpnmix2_1.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\vruns.exe"C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\vruns.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\intervpnmix2.exe"C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\intervpnmix2.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\intervpnmix2.exeMD5
f26dc42b3ce20aaaff3bc059ad1ee51d
SHA11bdd627c3804ec84c70c514590da0b1f09513a46
SHA256493c3a5440c0025f8f1154bcc002f109872f2dab955a43169583594dcab485e3
SHA5122e6c7832db631be5717e246f1d5f6677c0344109fa35f7a88f8955f0fa437184fa09961ac94b8e55b45a3b9da30f3aa6251c0be94e6a391d69cb0a5c81ba8601
-
C:\Program Files (x86)\InterVpn\InterVpn\InterVpn\bin\InterVpn\vruns.exeMD5
08b6bafe40b9d0a5a3663567dfaf67fe
SHA1b1496d662a9178fa6cdba42d3639ccb148b3d015
SHA256e310096e361a558c51ff56f42c2639aba9027c02030888604e0f1c51afb06573
SHA51227e38e1ef087bc543c51bf3fad3f4e3ada0297ecedac988d60e677fd813669cc64b1c950e9cbdce4e69a3158554f9e5d63c5e16755c042b7d2fe283bd0f00b59
-
\Users\Admin\AppData\Local\Temp\nsa548F.tmp\UAC.dllMD5
adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
memory/3284-5-0x0000000000000000-mapping.dmp
-
memory/3284-10-0x000000000A0A0000-0x000000000A0A1000-memory.dmpFilesize
4KB
-
memory/3284-9-0x00000000098A0000-0x00000000098A1000-memory.dmpFilesize
4KB
-
memory/3284-11-0x00000000098A0000-0x00000000098A1000-memory.dmpFilesize
4KB
-
memory/3784-3-0x0000000000000000-mapping.dmp
-
memory/3784-7-0x0000000004470000-0x0000000004471000-memory.dmpFilesize
4KB
-
memory/3784-8-0x0000000004C70000-0x0000000004C71000-memory.dmpFilesize
4KB