Analysis

  • max time kernel
    137s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-en
  • submitted
    07-09-2021 06:25

General

  • Target

    NordVPNSetup.exe

  • Size

    1.1MB

  • MD5

    1b01af0b820d4c8d3ebe3723cfefc5f8

  • SHA1

    32e5ee49475a930da2ffe199be41e7b639d1ae1b

  • SHA256

    eaee3b7f33e680cfebcac7634b0ea0aaefac8564bc50603cb90669a43d89a29e

  • SHA512

    f27f2ae8bc047cf392d4823898353901b83733a127c750adad4574c82e8371174666144b21938462f152a7be295143041adc3a43f8b05f4fb46ffbd7394445ae

Malware Config

Signatures

  • Echelon

    Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe
      "{path}"
      2⤵
        PID:320
      • C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe
        "{path}"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:832
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 832 -s 2684
          3⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1324

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/832-62-0x00000000004934C6-mapping.dmp

    • memory/832-67-0x0000000005200000-0x0000000005270000-memory.dmp

      Filesize

      448KB

    • memory/832-66-0x00000000006D0000-0x00000000006D1000-memory.dmp

      Filesize

      4KB

    • memory/832-65-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

      Filesize

      8KB

    • memory/832-63-0x0000000000400000-0x000000000049A000-memory.dmp

      Filesize

      616KB

    • memory/832-61-0x0000000000400000-0x000000000049A000-memory.dmp

      Filesize

      616KB

    • memory/1324-69-0x0000000000250000-0x0000000000251000-memory.dmp

      Filesize

      4KB

    • memory/1324-68-0x0000000000000000-mapping.dmp

    • memory/1664-57-0x0000000004F00000-0x0000000004F01000-memory.dmp

      Filesize

      4KB

    • memory/1664-60-0x0000000005840000-0x00000000058D6000-memory.dmp

      Filesize

      600KB

    • memory/1664-59-0x00000000057A0000-0x000000000583E000-memory.dmp

      Filesize

      632KB

    • memory/1664-58-0x0000000000500000-0x0000000000501000-memory.dmp

      Filesize

      4KB

    • memory/1664-53-0x0000000000900000-0x0000000000901000-memory.dmp

      Filesize

      4KB

    • memory/1664-56-0x0000000000550000-0x0000000000554000-memory.dmp

      Filesize

      16KB

    • memory/1664-55-0x0000000004D30000-0x0000000004DEA000-memory.dmp

      Filesize

      744KB