Analysis
-
max time kernel
7s -
max time network
10s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 10:08
Static task
static1
Behavioral task
behavioral1
Sample
0227cbdb_by_Libranalysis.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
0227cbdb_by_Libranalysis.exe
Resource
win10v20210408
General
-
Target
0227cbdb_by_Libranalysis.exe
-
Size
65KB
-
MD5
0227cbdb229e67a2ef044dc152454f51
-
SHA1
08459d52fb430bc1bb262595edf2c6ca3d54817e
-
SHA256
63d05e539ce789c454fc5765092323fe62fee683e1382d8d4d54d001cfac8457
-
SHA512
0045a6a71cb532345e1e5e94a466b7939ccd8899cf02385d2ccde332c4e11907de2cc6a72016519620fe63566927891c160b0d9e9ec564e000117e89f95e08b2
Malware Config
Signatures
-
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\vpnTKB.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\vpnTKB.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\vpnTKB.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\vpnTKB.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
vpnTKB.exepid process 1336 vpnTKB.exe -
Loads dropped DLL 2 IoCs
Processes:
0227cbdb_by_Libranalysis.exepid process 1084 0227cbdb_by_Libranalysis.exe 1084 0227cbdb_by_Libranalysis.exe -
Drops file in Program Files directory 64 IoCs
Processes:
vpnTKB.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE vpnTKB.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe vpnTKB.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jre7\bin\klist.exe vpnTKB.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe vpnTKB.exe File opened for modification C:\Program Files\Windows Journal\Journal.exe vpnTKB.exe File opened for modification C:\Program Files\Windows Journal\PDIALOG.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUME011.tmp\GoogleUpdateSetup.exe vpnTKB.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe vpnTKB.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\89.0.4389.114_chrome_installer.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{406E5475-62F1-42AB-B6F4-D17073AF9034}\89.0.4389.114_chrome_installer.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE vpnTKB.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe vpnTKB.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE vpnTKB.exe File opened for modification C:\Program Files\7-Zip\7z.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE vpnTKB.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe vpnTKB.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE vpnTKB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE vpnTKB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE vpnTKB.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe vpnTKB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
0227cbdb_by_Libranalysis.exevpnTKB.exedescription pid process target process PID 1084 wrote to memory of 1336 1084 0227cbdb_by_Libranalysis.exe vpnTKB.exe PID 1084 wrote to memory of 1336 1084 0227cbdb_by_Libranalysis.exe vpnTKB.exe PID 1084 wrote to memory of 1336 1084 0227cbdb_by_Libranalysis.exe vpnTKB.exe PID 1084 wrote to memory of 1336 1084 0227cbdb_by_Libranalysis.exe vpnTKB.exe PID 1336 wrote to memory of 1172 1336 vpnTKB.exe cmd.exe PID 1336 wrote to memory of 1172 1336 vpnTKB.exe cmd.exe PID 1336 wrote to memory of 1172 1336 vpnTKB.exe cmd.exe PID 1336 wrote to memory of 1172 1336 vpnTKB.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0227cbdb_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\0227cbdb_by_Libranalysis.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vpnTKB.exeC:\Users\Admin\AppData\Local\Temp\vpnTKB.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\46011051.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\46011051.batMD5
2fe01c312134eb84c1a3b1d5c6e2e2d4
SHA1fa679a6b9204febb92dd63a09daa1da819bba1f8
SHA256c1569cc9fb8dd14c9d74b5f5cb938868c886045d4eb05732f3454d07e0101400
SHA512a714d114489223ea178c3815be2bbcd5f0b6b10cb9c9a41bce6cc59405ddcbf76e70cc97df637ef83882bf96b78af9663762f616fd00726e450d10a700ad099f
-
C:\Users\Admin\AppData\Local\Temp\vpnTKB.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
C:\Users\Admin\AppData\Local\Temp\vpnTKB.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
\Users\Admin\AppData\Local\Temp\vpnTKB.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
\Users\Admin\AppData\Local\Temp\vpnTKB.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
memory/1172-66-0x0000000000000000-mapping.dmp
-
memory/1336-62-0x0000000000000000-mapping.dmp
-
memory/1336-64-0x00000000752F1000-0x00000000752F3000-memory.dmpFilesize
8KB