Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
05-05-2021 10:08
Static task
static1
Behavioral task
behavioral1
Sample
0227cbdb_by_Libranalysis.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
0227cbdb_by_Libranalysis.exe
Resource
win10v20210408
General
-
Target
0227cbdb_by_Libranalysis.exe
-
Size
65KB
-
MD5
0227cbdb229e67a2ef044dc152454f51
-
SHA1
08459d52fb430bc1bb262595edf2c6ca3d54817e
-
SHA256
63d05e539ce789c454fc5765092323fe62fee683e1382d8d4d54d001cfac8457
-
SHA512
0045a6a71cb532345e1e5e94a466b7939ccd8899cf02385d2ccde332c4e11907de2cc6a72016519620fe63566927891c160b0d9e9ec564e000117e89f95e08b2
Malware Config
Signatures
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\vpnTKB.exe aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\vpnTKB.exe aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
vpnTKB.exepid process 4024 vpnTKB.exe -
Drops file in Program Files directory 64 IoCs
Processes:
vpnTKB.exedescription ioc process File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\chrome_pwa_launcher.exe vpnTKB.exe File opened for modification C:\Program Files\Windows Defender\MSASCui.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE vpnTKB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\onenoteshare.exe vpnTKB.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\HxTsr.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe vpnTKB.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE vpnTKB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.exe vpnTKB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\PilotshubApp.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaw.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe vpnTKB.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseSampleUploader.exe vpnTKB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Maps.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\keytool.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE vpnTKB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\3DViewer.ResourceResolver.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE vpnTKB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_1.4.101.0_x64__8wekyb3d8bbwe\Microsoft.StickyNotes.exe vpnTKB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_11.19.19003.0_x64__8wekyb3d8bbwe\XboxIdp.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE vpnTKB.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe vpnTKB.exe File opened for modification C:\Program Files\Windows Defender\NisSrv.exe vpnTKB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeHost.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe vpnTKB.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe vpnTKB.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jconsole.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jarsigner.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe vpnTKB.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe vpnTKB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\XboxApp.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe vpnTKB.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\setup.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\extcheck.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jhat.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javaw.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe vpnTKB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Video.UI.exe vpnTKB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_1.0.16328.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\89.0.4389.114_chrome_installer.exe vpnTKB.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE vpnTKB.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe vpnTKB.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\java-rmi.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\javacpl.exe vpnTKB.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE vpnTKB.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\WindowsCamera.exe vpnTKB.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\ktab.exe vpnTKB.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
0227cbdb_by_Libranalysis.exevpnTKB.exedescription pid process target process PID 800 wrote to memory of 4024 800 0227cbdb_by_Libranalysis.exe vpnTKB.exe PID 800 wrote to memory of 4024 800 0227cbdb_by_Libranalysis.exe vpnTKB.exe PID 800 wrote to memory of 4024 800 0227cbdb_by_Libranalysis.exe vpnTKB.exe PID 4024 wrote to memory of 3144 4024 vpnTKB.exe cmd.exe PID 4024 wrote to memory of 3144 4024 vpnTKB.exe cmd.exe PID 4024 wrote to memory of 3144 4024 vpnTKB.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0227cbdb_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\0227cbdb_by_Libranalysis.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vpnTKB.exeC:\Users\Admin\AppData\Local\Temp\vpnTKB.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\24911852.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\24911852.batMD5
ffaf77fd3204e751a84840f7f1251c0d
SHA17bba8cf93e6250759c15d9dcc34a203bfa26a20c
SHA256386a31c29f64263b6ca29db5a3b2bc738a83a152aa8357f4aea0ab6352ed80ee
SHA5122256d00d46af884bfc7d526de455a41c139514246aae32fe19615a4aa9ea8ab179f1bfd21b7df9f2a71321f63930e12ee151a6c6c5266550c7235613efff9884
-
C:\Users\Admin\AppData\Local\Temp\vpnTKB.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
C:\Users\Admin\AppData\Local\Temp\vpnTKB.exeMD5
56b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e
-
memory/3144-117-0x0000000000000000-mapping.dmp
-
memory/4024-114-0x0000000000000000-mapping.dmp