Resubmissions
26-08-2021 21:14
210826-krx77w8nda 1019-08-2021 18:13
210819-b3j7k4rz6j 1009-07-2021 17:05
210709-w1gprakeqj 10Analysis
-
max time kernel
99s -
max time network
131s -
platform
windows11_x64 -
resource
win11 -
submitted
26-08-2021 21:14
Static task
static1
Behavioral task
behavioral1
Sample
Vape Lite/Vape Lite.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Vape Lite/Vape Lite.exe
Resource
win11
windows11_x64
0 signatures
0 seconds
General
-
Target
Vape Lite/Vape Lite.exe
-
Size
13.7MB
-
MD5
e42b6a2fc7f53e0951f19ba0cd15180c
-
SHA1
f404f1bf35fc152e24bc4f11b49495bbf1a374cf
-
SHA256
aa7021b2e15ae62168b9734f62bd01c59f2e93be1e7937e74a599fb63360915a
-
SHA512
2e10dbd7d19e0be2105eccdeb42b971cf7d6b9cda6cca74c297deaa50f853cdb9eb07894615540bb7cfe9670cbbf748884e741c29c9f427fe18bbd8319f4e605
Malware Config
Signatures
-
Loads dropped DLL 38 IoCs
pid Process 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe 5004 Vape Lite.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org 9 api.ipify.org -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 5004 Vape Lite.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4212 wrote to memory of 5004 4212 Vape Lite.exe 83 PID 4212 wrote to memory of 5004 4212 Vape Lite.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vape Lite\Vape Lite.exe"C:\Users\Admin\AppData\Local\Temp\Vape Lite\Vape Lite.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\Vape Lite\Vape Lite.exe"C:\Users\Admin\AppData\Local\Temp\Vape Lite\Vape Lite.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv juDKImBLWkCHi9D6+osR0w.0.21⤵
- Modifies data under HKEY_USERS
PID:4648
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:1248
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:1468