Overview

overview

3

Static

static

3

VAMPSET v2...te.zip

windows10-2004-x64

1

VAMPSET v2...xx.lib

windows10-2004-x64

3

VAMPSET v2...d2xx.h

windows10-2004-x64

3

VAMPSET v2...us.cat

windows10-2004-x64

1

VAMPSET v2...us.inf

windows10-2004-x64

1

VAMPSET v2...rt.cat

windows10-2004-x64

1

VAMPSET v2...rt.inf

windows10-2004-x64

1

VAMPSET v2...xx.lib

windows10-2004-x64

3

VAMPSET v2...et.pos

windows10-2004-x64

3

VAMPSET v2...04.vfm

windows10-2004-x64

3

VAMPSET v2...06.vfm

windows10-2004-x64

3

VAMPSET v2...08.vfm

windows10-2004-x64

3

VAMPSET v2...09.vfm

windows10-2004-x64

3

VAMPSET v2...04.vfm

windows10-2004-x64

3

VAMPSET v2...06.vfm

windows10-2004-x64

3

VAMPSET v2...08.vfm

windows10-2004-x64

3

VAMPSET v2...09.vfm

windows10-2004-x64

3

VAMPSET v2...04.vfm

windows10-2004-x64

3

VAMPSET v2...06.vfm

windows10-2004-x64

3

VAMPSET v2...08.vfm

windows10-2004-x64

3

VAMPSET v2...09.vfm

windows10-2004-x64

3

VAMPSET v2...04.vfm

windows10-2004-x64

3

VAMPSET v2...06.vfm

windows10-2004-x64

3

VAMPSET v2...08.vfm

windows10-2004-x64

3

VAMPSET v2...09.vfm

windows10-2004-x64

3

VAMPSET v2...04.vfm

windows10-2004-x64

3

VAMPSET v2...06.vfm

windows10-2004-x64

3

VAMPSET v2...08.vfm

windows10-2004-x64

3

VAMPSET v2...09.vfm

windows10-2004-x64

3

VAMPSET v2...nv.dll

windows10-2004-x64

3

VAMPSET v2...l2.dll

windows10-2004-x64

3

VAMPSET v2...b1.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    394s
  • max time network
    418s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/08/2023, 13:35 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VAMPSET v2.2.206 - Lite/configs/P3G30_30.106.vfm

  • Size

    11.7MB

  • MD5

    d6a2b46fc414c734c02363fd80291617

  • SHA1

    3c8aba4e6ab9e5542e8d25e19f663dee4ce185d9

  • SHA256

    8a43cb1fdebba6081369dc27bcc58fb5015a1dbbe2b0e7b4adfc8492154a2300

  • SHA512

    12bdb873fdc970d8f2979219aec722700ab1eea1c70802616f8dcc581dff693290188562022ee78f916a3f14f83f41c82da97c5fbb726144dbab93bfec01ade0

  • SSDEEP

    6144:ir2WPgU3VCJ3sBzGaqB1geKv5ErnEoj40pZx2nVm0SLFEVSo1ZGBtGinYlW2QU/1:+BzGaqB1geKT

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\VAMPSET v2.2.206 - Lite\configs\P3G30_30.106.vfm"
    1⤵
    • Modifies registry class
    PID:3340
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4636

Network

  • flag-us
    DNS
    208.194.73.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    208.194.73.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    120.208.253.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    120.208.253.8.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    108.211.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    108.211.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    71.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    158.240.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    158.240.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    59.128.231.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    59.128.231.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    1.77.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.77.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    10.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.173.189.20.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    208.194.73.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    208.194.73.20.in-addr.arpa

  • 8.8.8.8:53
    120.208.253.8.in-addr.arpa
    dns
    72 B
     126 B
     1
    1

    DNS Request

    120.208.253.8.in-addr.arpa

  • 8.8.8.8:53
    108.211.229.192.in-addr.arpa
    dns
    74 B
     145 B
     1
    1

    DNS Request

    108.211.229.192.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    71.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    71.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    158.240.127.40.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    158.240.127.40.in-addr.arpa

  • 8.8.8.8:53
    59.128.231.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    59.128.231.4.in-addr.arpa

  • 8.8.8.8:53
    1.77.109.52.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    1.77.109.52.in-addr.arpa

  • 8.8.8.8:53
    10.173.189.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    10.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.