General

  • Target

    UrbanVPN2.exe

  • Size

    30.7MB

  • Sample

    221001-khm68afgb2

  • MD5

    7274b344c614f2fe405dbffadccfbab1

  • SHA1

    d2bf8dc3285ce0a5f1a87234e9ac21bee9c72a3c

  • SHA256

    581eba8772a2cf1acabba4094c391034812bb98a5abd91725dfd917c44d8c44c

  • SHA512

    aacf19dfa044a710a774475f61853a408c552a8e5858e349bf3e1dac96bec639c8ca555b027b1dd6515f925959ff7b66e2d0141afbfdfdd3019b71ac93437854

  • SSDEEP

    786432:dtiCbhe50g0+efDnNqc7r1fQFfCxkdc0yQJ:I50kefDnNqirFwCx0pZ

Malware Config

Targets

    • Target

      UrbanVPN2.exe

    • Size

      30.7MB

    • MD5

      7274b344c614f2fe405dbffadccfbab1

    • SHA1

      d2bf8dc3285ce0a5f1a87234e9ac21bee9c72a3c

    • SHA256

      581eba8772a2cf1acabba4094c391034812bb98a5abd91725dfd917c44d8c44c

    • SHA512

      aacf19dfa044a710a774475f61853a408c552a8e5858e349bf3e1dac96bec639c8ca555b027b1dd6515f925959ff7b66e2d0141afbfdfdd3019b71ac93437854

    • SSDEEP

      786432:dtiCbhe50g0+efDnNqc7r1fQFfCxkdc0yQJ:I50kefDnNqirFwCx0pZ

    • Blocklisted process makes network request

    • Drops file in Drivers directory

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks