Analysis
-
max time kernel
66s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-06-2021 11:46
Static task
static1
Behavioral task
behavioral1
Sample
NordVPNSetup.exe
Resource
win7v20210410
General
-
Target
NordVPNSetup.exe
-
Size
1.1MB
-
MD5
1b01af0b820d4c8d3ebe3723cfefc5f8
-
SHA1
32e5ee49475a930da2ffe199be41e7b639d1ae1b
-
SHA256
eaee3b7f33e680cfebcac7634b0ea0aaefac8564bc50603cb90669a43d89a29e
-
SHA512
f27f2ae8bc047cf392d4823898353901b83733a127c750adad4574c82e8371174666144b21938462f152a7be295143041adc3a43f8b05f4fb46ffbd7394445ae
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 15 api.ipify.org 16 api.ipify.org 17 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NordVPNSetup.exedescription pid process target process PID 4092 set thread context of 372 4092 NordVPNSetup.exe NordVPNSetup.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2736 372 WerFault.exe NordVPNSetup.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
NordVPNSetup.exeNordVPNSetup.exeWerFault.exepid process 4092 NordVPNSetup.exe 4092 NordVPNSetup.exe 4092 NordVPNSetup.exe 4092 NordVPNSetup.exe 4092 NordVPNSetup.exe 372 NordVPNSetup.exe 372 NordVPNSetup.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe 2736 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
NordVPNSetup.exeNordVPNSetup.exeWerFault.exedescription pid process Token: SeDebugPrivilege 4092 NordVPNSetup.exe Token: SeDebugPrivilege 372 NordVPNSetup.exe Token: SeRestorePrivilege 2736 WerFault.exe Token: SeBackupPrivilege 2736 WerFault.exe Token: SeDebugPrivilege 2736 WerFault.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
NordVPNSetup.exedescription pid process target process PID 4092 wrote to memory of 3880 4092 NordVPNSetup.exe NordVPNSetup.exe PID 4092 wrote to memory of 3880 4092 NordVPNSetup.exe NordVPNSetup.exe PID 4092 wrote to memory of 3880 4092 NordVPNSetup.exe NordVPNSetup.exe PID 4092 wrote to memory of 372 4092 NordVPNSetup.exe NordVPNSetup.exe PID 4092 wrote to memory of 372 4092 NordVPNSetup.exe NordVPNSetup.exe PID 4092 wrote to memory of 372 4092 NordVPNSetup.exe NordVPNSetup.exe PID 4092 wrote to memory of 372 4092 NordVPNSetup.exe NordVPNSetup.exe PID 4092 wrote to memory of 372 4092 NordVPNSetup.exe NordVPNSetup.exe PID 4092 wrote to memory of 372 4092 NordVPNSetup.exe NordVPNSetup.exe PID 4092 wrote to memory of 372 4092 NordVPNSetup.exe NordVPNSetup.exe PID 4092 wrote to memory of 372 4092 NordVPNSetup.exe NordVPNSetup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 29483⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NordVPNSetup.exe.logMD5
b4f7a6a57cb46d94b72410eb6a6d45a9
SHA169f3596ffa027202d391444b769ceea0ae14c5f7
SHA25623994ebe221a48ea16ebad51ae0d4b47ccd415ae10581f9405e588d4f6c2523b
SHA512be6da516e54c3a5b33ac2603137a2f8cf8445ff5961dd266faedf3627bae8979953d7ef305538df0151c609917a5b99bf5d023bdd32de50fd5c723950f90db5c
-
memory/372-127-0x00000000004934C6-mapping.dmp
-
memory/372-133-0x0000000006490000-0x0000000006500000-memory.dmpFilesize
448KB
-
memory/372-132-0x0000000002F50000-0x0000000002F51000-memory.dmpFilesize
4KB
-
memory/372-131-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/372-126-0x0000000000400000-0x000000000049A000-memory.dmpFilesize
616KB
-
memory/4092-119-0x00000000052D0000-0x000000000538A000-memory.dmpFilesize
744KB
-
memory/4092-122-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/4092-123-0x00000000029C0000-0x00000000029C1000-memory.dmpFilesize
4KB
-
memory/4092-124-0x0000000006070000-0x000000000610E000-memory.dmpFilesize
632KB
-
memory/4092-125-0x00000000087F0000-0x0000000008886000-memory.dmpFilesize
600KB
-
memory/4092-121-0x0000000005240000-0x0000000005244000-memory.dmpFilesize
16KB
-
memory/4092-120-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/4092-114-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/4092-118-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/4092-117-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/4092-116-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB