Overview

overview

9

Static

static

7

a/A.class

windows10-1703-x64

3

a/B.class

windows10-1703-x64

3

a/C.class

windows10-1703-x64

3

a/D.class

windows10-1703-x64

3

a/E.class

windows10-1703-x64

3

a/F.class

windows10-1703-x64

3

a/G.class

windows10-1703-x64

3

a/H.class

windows10-1703-x64

3

a/I.class

windows10-1703-x64

3

a/J.class

windows10-1703-x64

3

a/K.class

windows10-1703-x64

3

a/L.class

windows10-1703-x64

3

a/M.class

windows10-1703-x64

3

a/N.class

windows10-1703-x64

3

a/O.class

windows10-1703-x64

3

a/P.class

windows10-1703-x64

3

a/Q.class

windows10-1703-x64

3

a/R.class

windows10-1703-x64

3

a/S.class

windows10-1703-x64

3

a/T.class

windows10-1703-x64

3

a/U.class

windows10-1703-x64

3

a/V.class

windows10-1703-x64

3

a/W.class

windows10-1703-x64

3

a/X.class

windows10-1703-x64

3

a/Y.class

windows10-1703-x64

3

vape lite/...er.exe

windows10-1703-x64

1

vape lite/...oo.dll

windows10-1703-x64

1

vape lite/...te.exe

windows10-1703-x64

9

vape lite/...ver.py

windows10-1703-x64

3

vape lite/...ll.bat

windows10-1703-x64

1

vape lite/...un.bat

windows10-1703-x64

1

vape lite/server.py

windows10-1703-x64

3

Analysis

  • max time kernel
    140s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31-03-2023 16:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    vape lite/Vape Lite/Kangaroo.dll

  • Size

    37KB

  • MD5

    0202563145fb353f35c915cdbe5474f8

  • SHA1

    01b1ea50745a3824e68330b0339a44e27c9068e9

  • SHA256

    5223fc529531a32c6111ef6e93e33d134961490831b6711db1ed87b3f93574bd

  • SHA512

    8d972347f6e87fb0639033e22df9687a30363423a650cc872d6746582eb03274c673727c2287d9ba12df0cd68e4deecfcbb3d11c130e122022b57c6088c6309d

  • SSDEEP

    768:yPGh18G4BxUz6jPypNKLf7wtGHBpc/HO27:S+1YUWrypNKPbBp8u27

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\vape lite\Vape Lite\Kangaroo.dll",#1
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:2908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads