Overview

overview

3

Static

static

3

VAMPSET v2...te.zip

windows10-2004-x64

1

VAMPSET v2...xx.lib

windows10-2004-x64

3

VAMPSET v2...d2xx.h

windows10-2004-x64

3

VAMPSET v2...us.cat

windows10-2004-x64

1

VAMPSET v2...us.inf

windows10-2004-x64

1

VAMPSET v2...rt.cat

windows10-2004-x64

1

VAMPSET v2...rt.inf

windows10-2004-x64

1

VAMPSET v2...xx.lib

windows10-2004-x64

3

VAMPSET v2...et.pos

windows10-2004-x64

3

VAMPSET v2...04.vfm

windows10-2004-x64

3

VAMPSET v2...06.vfm

windows10-2004-x64

3

VAMPSET v2...08.vfm

windows10-2004-x64

3

VAMPSET v2...09.vfm

windows10-2004-x64

3

VAMPSET v2...04.vfm

windows10-2004-x64

3

VAMPSET v2...06.vfm

windows10-2004-x64

3

VAMPSET v2...08.vfm

windows10-2004-x64

3

VAMPSET v2...09.vfm

windows10-2004-x64

3

VAMPSET v2...04.vfm

windows10-2004-x64

3

VAMPSET v2...06.vfm

windows10-2004-x64

3

VAMPSET v2...08.vfm

windows10-2004-x64

3

VAMPSET v2...09.vfm

windows10-2004-x64

3

VAMPSET v2...04.vfm

windows10-2004-x64

3

VAMPSET v2...06.vfm

windows10-2004-x64

3

VAMPSET v2...08.vfm

windows10-2004-x64

3

VAMPSET v2...09.vfm

windows10-2004-x64

3

VAMPSET v2...04.vfm

windows10-2004-x64

3

VAMPSET v2...06.vfm

windows10-2004-x64

3

VAMPSET v2...08.vfm

windows10-2004-x64

3

VAMPSET v2...09.vfm

windows10-2004-x64

3

VAMPSET v2...nv.dll

windows10-2004-x64

3

VAMPSET v2...l2.dll

windows10-2004-x64

3

VAMPSET v2...b1.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    433s
  • max time network
    445s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/08/2023, 13:35 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VAMPSET v2.2.206 - Lite/configs/P3G32_30.109.vfm

  • Size

    14.0MB

  • MD5

    7b1429e5b67d4db3f729651d6b565a55

  • SHA1

    7e0f4afe75b471214b5b34a9d460c870ca7be53f

  • SHA256

    da4ea4626dbe67b11f5650b72aab6c32d22ce204dbb6f40bc9b14509d676203d

  • SHA512

    7efd3d6df64ebef5a9dfcb8dcdcd61ca0dd257250e9128c1d07bc0941b952e5633ab84218bebbfb332258f4cbf7f055e75dba7a823b18630014f541b7eceedec

  • SSDEEP

    6144:gr2WpWo2E2WcsutCJ3sTX5PTJeW6uupYcU6IzaHX4Z/FSncyWIdGwti90e7GnUML:xTX5PTJeW6uyoA

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\VAMPSET v2.2.206 - Lite\configs\P3G32_30.109.vfm"
    1⤵
    • Modifies registry class
    PID:4080
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1308

Network

  • flag-us
    DNS
    59.128.231.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    59.128.231.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    113.208.253.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    113.208.253.8.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    71.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.136.104.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.136.104.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    208.194.73.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    208.194.73.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    103.169.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.169.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    126.20.238.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    126.20.238.8.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    63.13.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    63.13.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.173.189.20.in-addr.arpa
    IN PTR
    Response
No results found
  • 8.8.8.8:53
    59.128.231.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    59.128.231.4.in-addr.arpa

  • 8.8.8.8:53
    113.208.253.8.in-addr.arpa
    dns
    72 B
     126 B
     1
    1

    DNS Request

    113.208.253.8.in-addr.arpa

  • 8.8.8.8:53
    71.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    71.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    2.136.104.51.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.136.104.51.in-addr.arpa

  • 8.8.8.8:53
    208.194.73.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    208.194.73.20.in-addr.arpa

  • 8.8.8.8:53
    103.169.127.40.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    103.169.127.40.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    126.20.238.8.in-addr.arpa
    dns
    71 B
     125 B
     1
    1

    DNS Request

    126.20.238.8.in-addr.arpa

  • 8.8.8.8:53
    63.13.109.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    63.13.109.52.in-addr.arpa

  • 8.8.8.8:53
    9.173.189.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    9.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.