Resubmissions

12-11-2021 18:04

211112-wnzb8aahhm 10

19-11-2020 10:08

201119-rhwlt38jrx 10

18-11-2020 17:26

201118-htd4fq29va 10

Analysis

  • max time kernel
    119s
  • max time network
    300s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    12-11-2021 18:04

General

  • Target

    VyprVPN.exe

  • Size

    1.6MB

  • MD5

    f1d5f022e71b8bc9e3241fbb72e87be2

  • SHA1

    1b8abac6f9ffc3571b14c68ae1bc5e7568b4106c

  • SHA256

    08fb58bfaee81d99cbb71bf71ba8f2ab4f107563c5b0c3f20484d096b337e50d

  • SHA512

    f16130958a3ff33b21623881cbdeec018dd031b4aeb01bbb676c4bdeb1ec1d4f7d312efab48b4125eaaf6ea1c8b0aa4e037b1959af1f10c2a55fbc2da9f3924f

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 4 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\VyprVPN.exe
    "C:\Users\Admin\AppData\Local\Temp\VyprVPN.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Users\Admin\AppData\Roaming\1337\joinResult.exe
      "C:\Users\Admin\AppData\Roaming\1337\joinResult.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2936
      • C:\Users\Admin\AppData\Roaming\1337\1111.exe
        "C:\Users\Admin\AppData\Roaming\1337\1111.exe"
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:804
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C ping 1.1.1.1 -n 3 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\1337\1111.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2268
          • C:\Windows\SysWOW64\PING.EXE
            ping 1.1.1.1 -n 3 -w 3000
            5⤵
            • Runs ping.exe
            PID:1988
      • C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
        "C:\Users\Admin\AppData\Roaming\1337\Clipper.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1632
        • C:\Windows\System32\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "Windows Service" /tr "C:\Users\Admin\WinService.exe" /f
          4⤵
          • Creates scheduled task(s)
          PID:1692
        • C:\Users\Admin\WinService.exe
          "C:\Users\Admin\WinService.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:604
    • C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
      "C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe"
      2⤵
      • Executes dropped EXE
      PID:864
  • C:\Users\Admin\WinService.exe
    C:\Users\Admin\WinService.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Winlogon Helper DLL

1
T1004

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\1337\1111.exe
    MD5

    32373185ece79936dfd0fd41d2848a2e

    SHA1

    591f92bcaeeea85e8bba6988ef0d1afcea35fbbd

    SHA256

    5390fc20629a4a350dc8f0482472f9962f50364b7818b2d510beb4e520581ad4

    SHA512

    443b8df46dd6009285500148d2c4e0654e20e24b897fb29a9eded1cb21da6c495feaa1df81043ed4818f6ea511813c926e9f645b3ec4c8ab5c2c79f0fb5859dc

  • C:\Users\Admin\AppData\Roaming\1337\1111.exe
    MD5

    32373185ece79936dfd0fd41d2848a2e

    SHA1

    591f92bcaeeea85e8bba6988ef0d1afcea35fbbd

    SHA256

    5390fc20629a4a350dc8f0482472f9962f50364b7818b2d510beb4e520581ad4

    SHA512

    443b8df46dd6009285500148d2c4e0654e20e24b897fb29a9eded1cb21da6c495feaa1df81043ed4818f6ea511813c926e9f645b3ec4c8ab5c2c79f0fb5859dc

  • C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
    MD5

    c7e43ab36c3da3371fc915de9dc5106f

    SHA1

    f1bb12ae485853c1a28a8306604ef3eb3939068d

    SHA256

    4ff04b9be72efe982594832d51681c08334f4d8512c3560c646c21f88fd5e532

    SHA512

    383a02a7a338ca66077f5d577ae7f63f95cf1b711f1338e9dd11867a62d6dc298e0fd01878adc273669f5f1e8cffb0aa4ea3efa75ffb870616a0d3fef3cb454e

  • C:\Users\Admin\AppData\Roaming\1337\Clipper.exe
    MD5

    c7e43ab36c3da3371fc915de9dc5106f

    SHA1

    f1bb12ae485853c1a28a8306604ef3eb3939068d

    SHA256

    4ff04b9be72efe982594832d51681c08334f4d8512c3560c646c21f88fd5e532

    SHA512

    383a02a7a338ca66077f5d577ae7f63f95cf1b711f1338e9dd11867a62d6dc298e0fd01878adc273669f5f1e8cffb0aa4ea3efa75ffb870616a0d3fef3cb454e

  • C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
    MD5

    25e9776bb3965060ac5d9234fd25a11d

    SHA1

    5df6e261a930c0068c94542ef5180722a513e4fb

    SHA256

    8321b2785893442efeedddc40f0979563e8e2fc1a51cc3e4ee93d6f36d4e154d

    SHA512

    8735acb4bad98ad06b9cee96cda9a3c5026e5f584bd4efb782cf9a8a6f3ea9e39f7d280497dabbb5f6662a6a63bb9a6674c4c020bc73669517b05d0e708d0d7c

  • C:\Users\Admin\AppData\Roaming\1337\VyprVPN.exe
    MD5

    25e9776bb3965060ac5d9234fd25a11d

    SHA1

    5df6e261a930c0068c94542ef5180722a513e4fb

    SHA256

    8321b2785893442efeedddc40f0979563e8e2fc1a51cc3e4ee93d6f36d4e154d

    SHA512

    8735acb4bad98ad06b9cee96cda9a3c5026e5f584bd4efb782cf9a8a6f3ea9e39f7d280497dabbb5f6662a6a63bb9a6674c4c020bc73669517b05d0e708d0d7c

  • C:\Users\Admin\AppData\Roaming\1337\joinResult.exe
    MD5

    79022fbafee9fe740a5230f87bd33171

    SHA1

    42bf0f7bf41009fd0009535a8b1162cbe60dce6f

    SHA256

    640c30cfa519be11c02c4e51bf18979a93266887cc9ef19076b3d0f1f20528b6

    SHA512

    48e0d4a18d99dce4398de73895a157e13293115b52ee5158f9ea6fc73c4d5f4133e1cebba14ff5482b8c4f7dfeebfe3b003df1caf351314f1cc16944818df4b3

  • C:\Users\Admin\AppData\Roaming\1337\joinResult.exe
    MD5

    79022fbafee9fe740a5230f87bd33171

    SHA1

    42bf0f7bf41009fd0009535a8b1162cbe60dce6f

    SHA256

    640c30cfa519be11c02c4e51bf18979a93266887cc9ef19076b3d0f1f20528b6

    SHA512

    48e0d4a18d99dce4398de73895a157e13293115b52ee5158f9ea6fc73c4d5f4133e1cebba14ff5482b8c4f7dfeebfe3b003df1caf351314f1cc16944818df4b3

  • C:\Users\Admin\WinService.exe
    MD5

    c7e43ab36c3da3371fc915de9dc5106f

    SHA1

    f1bb12ae485853c1a28a8306604ef3eb3939068d

    SHA256

    4ff04b9be72efe982594832d51681c08334f4d8512c3560c646c21f88fd5e532

    SHA512

    383a02a7a338ca66077f5d577ae7f63f95cf1b711f1338e9dd11867a62d6dc298e0fd01878adc273669f5f1e8cffb0aa4ea3efa75ffb870616a0d3fef3cb454e

  • C:\Users\Admin\WinService.exe
    MD5

    c7e43ab36c3da3371fc915de9dc5106f

    SHA1

    f1bb12ae485853c1a28a8306604ef3eb3939068d

    SHA256

    4ff04b9be72efe982594832d51681c08334f4d8512c3560c646c21f88fd5e532

    SHA512

    383a02a7a338ca66077f5d577ae7f63f95cf1b711f1338e9dd11867a62d6dc298e0fd01878adc273669f5f1e8cffb0aa4ea3efa75ffb870616a0d3fef3cb454e

  • C:\Users\Admin\WinService.exe
    MD5

    c7e43ab36c3da3371fc915de9dc5106f

    SHA1

    f1bb12ae485853c1a28a8306604ef3eb3939068d

    SHA256

    4ff04b9be72efe982594832d51681c08334f4d8512c3560c646c21f88fd5e532

    SHA512

    383a02a7a338ca66077f5d577ae7f63f95cf1b711f1338e9dd11867a62d6dc298e0fd01878adc273669f5f1e8cffb0aa4ea3efa75ffb870616a0d3fef3cb454e

  • \Users\Admin\AppData\Local\Temp\nsiBD62.tmp\System.dll
    MD5

    2ae993a2ffec0c137eb51c8832691bcb

    SHA1

    98e0b37b7c14890f8a599f35678af5e9435906e1

    SHA256

    681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

    SHA512

    2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

  • \Users\Admin\AppData\Local\Temp\nsrACA9.tmp\System.dll
    MD5

    2ae993a2ffec0c137eb51c8832691bcb

    SHA1

    98e0b37b7c14890f8a599f35678af5e9435906e1

    SHA256

    681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

    SHA512

    2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

  • memory/604-143-0x0000000000000000-mapping.dmp
  • memory/804-126-0x0000000000000000-mapping.dmp
  • memory/864-132-0x0000000000E40000-0x0000000000E41000-memory.dmp
    Filesize

    4KB

  • memory/864-123-0x0000000000000000-mapping.dmp
  • memory/864-148-0x0000000005AB0000-0x0000000005FAE000-memory.dmp
    Filesize

    5.0MB

  • memory/864-138-0x0000000005AB0000-0x0000000005AB1000-memory.dmp
    Filesize

    4KB

  • memory/864-139-0x0000000005A10000-0x0000000005A11000-memory.dmp
    Filesize

    4KB

  • memory/864-140-0x0000000005CA0000-0x0000000005CA1000-memory.dmp
    Filesize

    4KB

  • memory/864-141-0x0000000005AB0000-0x0000000005FAE000-memory.dmp
    Filesize

    5.0MB

  • memory/864-135-0x0000000005FB0000-0x0000000005FB1000-memory.dmp
    Filesize

    4KB

  • memory/864-134-0x0000000005960000-0x0000000005961000-memory.dmp
    Filesize

    4KB

  • memory/1632-127-0x0000000000000000-mapping.dmp
  • memory/1632-136-0x0000000000EA0000-0x0000000000EA1000-memory.dmp
    Filesize

    4KB

  • memory/1692-142-0x0000000000000000-mapping.dmp
  • memory/1988-150-0x0000000000000000-mapping.dmp
  • memory/2028-154-0x000000001B270000-0x000000001B272000-memory.dmp
    Filesize

    8KB

  • memory/2268-149-0x0000000000000000-mapping.dmp
  • memory/2936-119-0x0000000000000000-mapping.dmp