Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
09-08-2023 19:01
Static task
static1
Behavioral task
behavioral1
Sample
vpn.exe
Resource
win7-20230712-en
3 signatures
150 seconds
General
-
Target
vpn.exe
-
Size
3.0MB
-
MD5
4b32941cd92e048e6a2d16c6069edf62
-
SHA1
5d167b4588575ffbc7a06cd9fa22552dced38951
-
SHA256
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d
-
SHA512
8b5c75642960991648fd18fb2c5421f8d082f0982a4b5950dd091547dc53943fccb287a404593fbb08282188c3c94d75e05c28f1a58f83a5b6559f34a516442e
-
SSDEEP
98304:6fFbrdnYUGkQqOSlBk1G4QBeKW0wnpTX5OIX:6fFbhBMqOxFgW3nRr
Malware Config
Extracted
Family
aurora
C2
94.142.138.215:8081
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
vpn.exepid process 1228 vpn.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
vpn.exetaskmgr.exepid process 1228 vpn.exe 1228 vpn.exe 3240 taskmgr.exe 3240 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 3240 taskmgr.exe Token: SeSystemProfilePrivilege 3240 taskmgr.exe Token: SeCreateGlobalPrivilege 3240 taskmgr.exe -
Suspicious use of FindShellTrayWindow 14 IoCs
Processes:
taskmgr.exepid process 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe -
Suspicious use of SendNotifyMessage 14 IoCs
Processes:
taskmgr.exepid process 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe 3240 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vpn.exe"C:\Users\Admin\AppData\Local\Temp\vpn.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1228-133-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-134-0x00000000772A4000-0x00000000772A6000-memory.dmpFilesize
8KB
-
memory/1228-135-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-136-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-137-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-138-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-139-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-140-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-141-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-142-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-143-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-144-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-145-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-146-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-147-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-149-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-150-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-152-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-154-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-156-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-157-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB
-
memory/1228-159-0x0000000000610000-0x0000000000E32000-memory.dmpFilesize
8.1MB