Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
01-07-2021 06:58
Static task
static1
Behavioral task
behavioral1
Sample
Nord_VPN.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Nord_VPN.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
Nord_VPN.exe
-
Size
431KB
-
MD5
fbbdc39af1139aebba4da004475e8839
-
SHA1
de5c8d858e6e41da715dca1c019df0bfb92d32c0
-
SHA256
630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
-
SHA512
74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
Score
10/10
Malware Config
Signatures
-
BadRabbit
Ransomware family discovered in late 2017, mainly targeting Russia and Ukraine.
-
Executes dropped EXE 1 IoCs
pid Process 3500 7E9C.tmp -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\infpub.dat Nord_VPN.exe File opened for modification C:\Windows\infpub.dat rundll32.exe File created C:\Windows\cscc.dat rundll32.exe File created C:\Windows\dispci.exe rundll32.exe File opened for modification C:\Windows\7E9C.tmp rundll32.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 648 schtasks.exe 2844 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4004 rundll32.exe 4004 rundll32.exe 4004 rundll32.exe 4004 rundll32.exe 3500 7E9C.tmp 3500 7E9C.tmp 3500 7E9C.tmp 3500 7E9C.tmp 3500 7E9C.tmp 3500 7E9C.tmp -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 4004 rundll32.exe Token: SeDebugPrivilege 4004 rundll32.exe Token: SeTcbPrivilege 4004 rundll32.exe Token: SeDebugPrivilege 3500 7E9C.tmp -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 856 wrote to memory of 4004 856 Nord_VPN.exe 75 PID 856 wrote to memory of 4004 856 Nord_VPN.exe 75 PID 856 wrote to memory of 4004 856 Nord_VPN.exe 75 PID 4004 wrote to memory of 1072 4004 rundll32.exe 77 PID 4004 wrote to memory of 1072 4004 rundll32.exe 77 PID 4004 wrote to memory of 1072 4004 rundll32.exe 77 PID 1072 wrote to memory of 204 1072 cmd.exe 79 PID 1072 wrote to memory of 204 1072 cmd.exe 79 PID 1072 wrote to memory of 204 1072 cmd.exe 79 PID 4004 wrote to memory of 344 4004 rundll32.exe 80 PID 4004 wrote to memory of 344 4004 rundll32.exe 80 PID 4004 wrote to memory of 344 4004 rundll32.exe 80 PID 344 wrote to memory of 2844 344 cmd.exe 82 PID 344 wrote to memory of 2844 344 cmd.exe 82 PID 344 wrote to memory of 2844 344 cmd.exe 82 PID 4004 wrote to memory of 720 4004 rundll32.exe 83 PID 4004 wrote to memory of 720 4004 rundll32.exe 83 PID 4004 wrote to memory of 720 4004 rundll32.exe 83 PID 4004 wrote to memory of 3500 4004 rundll32.exe 84 PID 4004 wrote to memory of 3500 4004 rundll32.exe 84 PID 720 wrote to memory of 648 720 cmd.exe 87 PID 720 wrote to memory of 648 720 cmd.exe 87 PID 720 wrote to memory of 648 720 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nord_VPN.exe"C:\Users\Admin\AppData\Local\Temp\Nord_VPN.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\infpub.dat,#1 152⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Delete /F /TN rhaegal3⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /F /TN rhaegal4⤵PID:204
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4230003035 && exit"3⤵
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /RU SYSTEM /SC ONSTART /TN rhaegal /TR "C:\Windows\system32\cmd.exe /C Start \"\" \"C:\Windows\dispci.exe\" -id 4230003035 && exit"4⤵
- Creates scheduled task(s)
PID:2844
-
-
-
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 09:19:003⤵
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN drogon /RU SYSTEM /TR "C:\Windows\system32\shutdown.exe /r /t 0 /f" /ST 09:19:004⤵
- Creates scheduled task(s)
PID:648
-
-
-
C:\Windows\7E9C.tmp"C:\Windows\7E9C.tmp" \\.\pipe\{1CBB2FB0-349E-4359-9DB7-EE2A12BBD78B}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3500
-
-