Overview
overview
9Static
static
7a/A.class
windows10-1703-x64
3a/B.class
windows10-1703-x64
3a/C.class
windows10-1703-x64
3a/D.class
windows10-1703-x64
3a/E.class
windows10-1703-x64
3a/F.class
windows10-1703-x64
3a/G.class
windows10-1703-x64
3a/H.class
windows10-1703-x64
3a/I.class
windows10-1703-x64
3a/J.class
windows10-1703-x64
3a/K.class
windows10-1703-x64
3a/L.class
windows10-1703-x64
3a/M.class
windows10-1703-x64
3a/N.class
windows10-1703-x64
3a/O.class
windows10-1703-x64
3a/P.class
windows10-1703-x64
3a/Q.class
windows10-1703-x64
3a/R.class
windows10-1703-x64
3a/S.class
windows10-1703-x64
3a/T.class
windows10-1703-x64
3a/U.class
windows10-1703-x64
3a/V.class
windows10-1703-x64
3a/W.class
windows10-1703-x64
3a/X.class
windows10-1703-x64
3a/Y.class
windows10-1703-x64
3vape lite/...er.exe
windows10-1703-x64
1vape lite/...oo.dll
windows10-1703-x64
1vape lite/...te.exe
windows10-1703-x64
9vape lite/...ver.py
windows10-1703-x64
3vape lite/...ll.bat
windows10-1703-x64
1vape lite/...un.bat
windows10-1703-x64
1vape lite/server.py
windows10-1703-x64
3Analysis
-
max time kernel
119s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
31-03-2023 16:07
Behavioral task
behavioral1
Sample
a/A.class
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
a/B.class
Resource
win10-20230220-en
Behavioral task
behavioral3
Sample
a/C.class
Resource
win10-20230220-en
Behavioral task
behavioral4
Sample
a/D.class
Resource
win10-20230220-en
Behavioral task
behavioral5
Sample
a/E.class
Resource
win10-20230220-en
Behavioral task
behavioral6
Sample
a/F.class
Resource
win10-20230220-en
Behavioral task
behavioral7
Sample
a/G.class
Resource
win10-20230220-en
Behavioral task
behavioral8
Sample
a/H.class
Resource
win10-20230220-en
Behavioral task
behavioral9
Sample
a/I.class
Resource
win10-20230220-en
Behavioral task
behavioral10
Sample
a/J.class
Resource
win10-20230220-en
Behavioral task
behavioral11
Sample
a/K.class
Resource
win10-20230220-en
Behavioral task
behavioral12
Sample
a/L.class
Resource
win10-20230220-en
Behavioral task
behavioral13
Sample
a/M.class
Resource
win10-20230220-en
Behavioral task
behavioral14
Sample
a/N.class
Resource
win10-20230220-en
Behavioral task
behavioral15
Sample
a/O.class
Resource
win10-20230220-en
Behavioral task
behavioral16
Sample
a/P.class
Resource
win10-20230220-en
Behavioral task
behavioral17
Sample
a/Q.class
Resource
win10-20230220-en
Behavioral task
behavioral18
Sample
a/R.class
Resource
win10-20230220-en
Behavioral task
behavioral19
Sample
a/S.class
Resource
win10-20230220-en
Behavioral task
behavioral20
Sample
a/T.class
Resource
win10-20230220-en
Behavioral task
behavioral21
Sample
a/U.class
Resource
win10-20230220-en
Behavioral task
behavioral22
Sample
a/V.class
Resource
win10-20230220-en
Behavioral task
behavioral23
Sample
a/W.class
Resource
win10-20230220-en
Behavioral task
behavioral24
Sample
a/X.class
Resource
win10-20230220-en
Behavioral task
behavioral25
Sample
a/Y.class
Resource
win10-20230220-en
Behavioral task
behavioral26
Sample
vape lite/Vape Lite/Kangaroo Patcher.exe
Resource
win10-20230220-en
Behavioral task
behavioral27
Sample
vape lite/Vape Lite/Kangaroo.dll
Resource
win10-20230220-en
Behavioral task
behavioral28
Sample
vape lite/Vape Lite/Vape_Lite.exe
Resource
win10-20230220-en
Behavioral task
behavioral29
Sample
vape lite/dumper/mitm_server.py
Resource
win10-20230220-en
Behavioral task
behavioral30
Sample
vape lite/requirements install.bat
Resource
win10-20230220-en
Behavioral task
behavioral31
Sample
vape lite/server run.bat
Resource
win10-20230220-en
Behavioral task
behavioral32
Sample
vape lite/server.py
Resource
win10-20230220-en
General
-
Target
vape lite/Vape Lite/Vape_Lite.exe
-
Size
6.6MB
-
MD5
3459f3a3d65fa445d1eb52611ac55f6c
-
SHA1
135c835edfeec60e41bc1b24f1a10ad7a86c9a00
-
SHA256
9c85d76526d585038392e1af504886580d096e9646de2907b73feab521920944
-
SHA512
1dbf42476304cefd859754f1d8219c0b37cc5b2885527f874245a37df5e1145dbcc1ff1ce34bdf0fa47df8a503e37244ff07a37bb92e8f2514533d8a89926d8b
-
SSDEEP
98304:MsRRwjPcDZ3IFTbWJ6tWUQSPZyq2XOD6gwosVvC8pQ6TYupGFBUMnEB:MsRKjkNcyDVSROtgwJVvHjTrUIMni
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Vape_Lite.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Vape_Lite.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Vape_Lite.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Vape_Lite.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Vape_Lite.exe -
Processes:
resource yara_rule behavioral28/memory/3840-121-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmp themida behavioral28/memory/3840-122-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmp themida behavioral28/memory/3840-123-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmp themida behavioral28/memory/3840-124-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmp themida behavioral28/memory/3840-125-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmp themida behavioral28/memory/3840-126-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmp themida behavioral28/memory/3840-127-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmp themida behavioral28/memory/3840-128-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmp themida behavioral28/memory/3840-129-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmp themida behavioral28/memory/3840-130-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmp themida behavioral28/memory/3840-131-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmp themida -
Processes:
Vape_Lite.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Vape_Lite.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Vape_Lite.exepid process 3840 Vape_Lite.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 460 3840 WerFault.exe Vape_Lite.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Vape_Lite.exepid process 3840 Vape_Lite.exe 3840 Vape_Lite.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Vape_Lite.exedescription pid process Token: SeDebugPrivilege 3840 Vape_Lite.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vape lite\Vape Lite\Vape_Lite.exe"C:\Users\Admin\AppData\Local\Temp\vape lite\Vape Lite\Vape_Lite.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3840 -s 6922⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3840-121-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmpFilesize
16.5MB
-
memory/3840-122-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmpFilesize
16.5MB
-
memory/3840-123-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmpFilesize
16.5MB
-
memory/3840-124-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmpFilesize
16.5MB
-
memory/3840-125-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmpFilesize
16.5MB
-
memory/3840-126-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmpFilesize
16.5MB
-
memory/3840-127-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmpFilesize
16.5MB
-
memory/3840-128-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmpFilesize
16.5MB
-
memory/3840-129-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmpFilesize
16.5MB
-
memory/3840-130-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmpFilesize
16.5MB
-
memory/3840-131-0x00007FF75ABB0000-0x00007FF75BC26000-memory.dmpFilesize
16.5MB