Analysis
-
max time kernel
137s -
max time network
146s -
platform
windows7_x64 -
resource
win7-en -
submitted
07-09-2021 06:25
Static task
static1
Behavioral task
behavioral1
Sample
NordVPNSetup.exe
Resource
win7-en
0 signatures
0 seconds
General
-
Target
NordVPNSetup.exe
-
Size
1.1MB
-
MD5
1b01af0b820d4c8d3ebe3723cfefc5f8
-
SHA1
32e5ee49475a930da2ffe199be41e7b639d1ae1b
-
SHA256
eaee3b7f33e680cfebcac7634b0ea0aaefac8564bc50603cb90669a43d89a29e
-
SHA512
f27f2ae8bc047cf392d4823898353901b83733a127c750adad4574c82e8371174666144b21938462f152a7be295143041adc3a43f8b05f4fb46ffbd7394445ae
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 api.ipify.org 8 api.ipify.org 11 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NordVPNSetup.exedescription pid process target process PID 1664 set thread context of 832 1664 NordVPNSetup.exe NordVPNSetup.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1324 832 WerFault.exe NordVPNSetup.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
NordVPNSetup.exeNordVPNSetup.exeWerFault.exepid process 1664 NordVPNSetup.exe 1664 NordVPNSetup.exe 1664 NordVPNSetup.exe 1664 NordVPNSetup.exe 1664 NordVPNSetup.exe 832 NordVPNSetup.exe 832 NordVPNSetup.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe 1324 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
NordVPNSetup.exeNordVPNSetup.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1664 NordVPNSetup.exe Token: SeDebugPrivilege 832 NordVPNSetup.exe Token: SeDebugPrivilege 1324 WerFault.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
NordVPNSetup.exeNordVPNSetup.exedescription pid process target process PID 1664 wrote to memory of 320 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 320 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 320 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 320 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 320 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 320 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 320 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 832 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 832 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 832 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 832 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 832 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 832 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 832 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 832 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 832 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 832 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 832 1664 NordVPNSetup.exe NordVPNSetup.exe PID 1664 wrote to memory of 832 1664 NordVPNSetup.exe NordVPNSetup.exe PID 832 wrote to memory of 1324 832 NordVPNSetup.exe WerFault.exe PID 832 wrote to memory of 1324 832 NordVPNSetup.exe WerFault.exe PID 832 wrote to memory of 1324 832 NordVPNSetup.exe WerFault.exe PID 832 wrote to memory of 1324 832 NordVPNSetup.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"{path}"2⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 26843⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324