Analysis
-
max time kernel
70s -
max time network
172s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-06-2021 11:46
Static task
static1
Behavioral task
behavioral1
Sample
NordVPNSetup.exe
Resource
win7v20210410
General
-
Target
NordVPNSetup.exe
-
Size
1.1MB
-
MD5
1b01af0b820d4c8d3ebe3723cfefc5f8
-
SHA1
32e5ee49475a930da2ffe199be41e7b639d1ae1b
-
SHA256
eaee3b7f33e680cfebcac7634b0ea0aaefac8564bc50603cb90669a43d89a29e
-
SHA512
f27f2ae8bc047cf392d4823898353901b83733a127c750adad4574c82e8371174666144b21938462f152a7be295143041adc3a43f8b05f4fb46ffbd7394445ae
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org 7 api.ipify.org 10 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NordVPNSetup.exedescription pid process target process PID 1088 set thread context of 820 1088 NordVPNSetup.exe NordVPNSetup.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1356 820 WerFault.exe NordVPNSetup.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
NordVPNSetup.exeNordVPNSetup.exeWerFault.exepid process 1088 NordVPNSetup.exe 1088 NordVPNSetup.exe 820 NordVPNSetup.exe 820 NordVPNSetup.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe 1356 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
NordVPNSetup.exeNordVPNSetup.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1088 NordVPNSetup.exe Token: SeDebugPrivilege 820 NordVPNSetup.exe Token: SeDebugPrivilege 1356 WerFault.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
NordVPNSetup.exeNordVPNSetup.exedescription pid process target process PID 1088 wrote to memory of 820 1088 NordVPNSetup.exe NordVPNSetup.exe PID 1088 wrote to memory of 820 1088 NordVPNSetup.exe NordVPNSetup.exe PID 1088 wrote to memory of 820 1088 NordVPNSetup.exe NordVPNSetup.exe PID 1088 wrote to memory of 820 1088 NordVPNSetup.exe NordVPNSetup.exe PID 1088 wrote to memory of 820 1088 NordVPNSetup.exe NordVPNSetup.exe PID 1088 wrote to memory of 820 1088 NordVPNSetup.exe NordVPNSetup.exe PID 1088 wrote to memory of 820 1088 NordVPNSetup.exe NordVPNSetup.exe PID 1088 wrote to memory of 820 1088 NordVPNSetup.exe NordVPNSetup.exe PID 1088 wrote to memory of 820 1088 NordVPNSetup.exe NordVPNSetup.exe PID 1088 wrote to memory of 820 1088 NordVPNSetup.exe NordVPNSetup.exe PID 1088 wrote to memory of 820 1088 NordVPNSetup.exe NordVPNSetup.exe PID 1088 wrote to memory of 820 1088 NordVPNSetup.exe NordVPNSetup.exe PID 820 wrote to memory of 1356 820 NordVPNSetup.exe WerFault.exe PID 820 wrote to memory of 1356 820 NordVPNSetup.exe WerFault.exe PID 820 wrote to memory of 1356 820 NordVPNSetup.exe WerFault.exe PID 820 wrote to memory of 1356 820 NordVPNSetup.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 820 -s 27563⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/820-67-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/820-72-0x0000000005880000-0x00000000058F0000-memory.dmpFilesize
448KB
-
memory/820-71-0x0000000004890000-0x0000000004891000-memory.dmpFilesize
4KB
-
memory/820-69-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/820-68-0x00000000004934C6-mapping.dmp
-
memory/1088-63-0x0000000004EB0000-0x0000000004F6A000-memory.dmpFilesize
744KB
-
memory/1088-66-0x0000000008110000-0x00000000081A6000-memory.dmpFilesize
600KB
-
memory/1088-65-0x0000000005870000-0x000000000590E000-memory.dmpFilesize
632KB
-
memory/1088-64-0x0000000000440000-0x0000000000444000-memory.dmpFilesize
16KB
-
memory/1088-59-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1088-62-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/1088-61-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/1356-73-0x0000000000000000-mapping.dmp
-
memory/1356-74-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB