bea34078c360c71fcadc1a86ebd397d081f0d589913ad43970c1a3983231f522

Analysis

max time kernel
4s
max time network
5s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-02-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NordVPNSetup.exe
Size

1.7MB
MD5

59cb69a08fdd9cb4b0539e3356df1d4d
SHA1

0c773a0a76f821780c002d527bee387b98904569
SHA256

bea34078c360c71fcadc1a86ebd397d081f0d589913ad43970c1a3983231f522
SHA512

51d4f3d396d183bc5dcaaa0a26cf024fade9b5e5c0e73e1d2ee7663ba26bc55e799beb488d5bab8d8252147b33df6ea1209ebd730124a919940e899758842ec2
SSDEEP

24576:u7FUDowAyrTVE3U5Fg23TD2D+Fz3ifFUwo433RfFcdnOtksSm:uBuZrEUWq0t9D7l

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

NordVPNSetup.tmp

pid process

2236 NordVPNSetup.tmp
Loads dropped DLL 4 IoCs

Processes:

NordVPNSetup.exeNordVPNSetup.tmp

pid process

2296 NordVPNSetup.exe
2236 NordVPNSetup.tmp
2236 NordVPNSetup.tmp
2236 NordVPNSetup.tmp

pid	process
2236	NordVPNSetup.tmp

pid	process
2296	NordVPNSetup.exe
2236	NordVPNSetup.tmp
2236	NordVPNSetup.tmp
2236	NordVPNSetup.tmp

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

NordVPNSetup.exe

description	pid	process	target process
PID 2296 wrote to memory of 2236	2296	NordVPNSetup.exe	NordVPNSetup.tmp
PID 2296 wrote to memory of 2236	2296	NordVPNSetup.exe	NordVPNSetup.tmp
PID 2296 wrote to memory of 2236	2296	NordVPNSetup.exe	NordVPNSetup.tmp
PID 2296 wrote to memory of 2236	2296	NordVPNSetup.exe	NordVPNSetup.tmp
PID 2296 wrote to memory of 2236	2296	NordVPNSetup.exe	NordVPNSetup.tmp
PID 2296 wrote to memory of 2236	2296	NordVPNSetup.exe	NordVPNSetup.tmp
PID 2296 wrote to memory of 2236	2296	NordVPNSetup.exe	NordVPNSetup.tmp

C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe
"C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296

C:\Users\Admin\AppData\Local\Temp\is-V5P92.tmp\NordVPNSetup.tmp
"C:\Users\Admin\AppData\Local\Temp\is-V5P92.tmp\NordVPNSetup.tmp" /SL5="$30130,890440,866304,C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabA20.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA23.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-V5P92.tmp\NordVPNSetup.tmp
Filesize
644KB

MD5
59363ee670a0df6e480292696576971a

SHA1
57a07721fd8dc16cd29833099792809961e75534

SHA256
61ce4c729aa8d8c1c91e620b0687f47fff443df25d4ba5cf7ef6bd6f0a6548a5

SHA512
01bb36aa1b3d2225839d54d1d09e07841293719e61767a8f40b00ea882780e90dd9bb3fd050a5c46823373c84275f8bdb7fc2f7e5322c8ef200f9ae3d155eabe

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-V5P92.tmp\NordVPNSetup.tmp
Filesize
591KB

MD5
88bbf39cf6b14a06dea4555258876710

SHA1
ba9c442c2b831e438ac4baabf1659595175fd125

SHA256
26becde982b0e4707a048d8cb0734ac37e7d8e52c42bfe1bb9b4109cc363c47c

SHA512
d6730d77f1aa3a2943102c3592d88aab799429b3e228571ada8ffe5f1385c91080049d767954a840a7e63d03d5737ab022dbb008579651c302bd01be46381743

Download Submit
\Users\Admin\AppData\Local\Temp\is-HG1VT.tmp\Nord.Setup.dll
Filesize
40KB

MD5
fb3b4bb0ea4f23de6109281606a35c8e

SHA1
01fc9184e971407bf2c7bc4b4e5181c96a16e38b

SHA256
5a8c26e985a7346e04d95e57373e7f65646d42f2403ccb24e5092d21d6a2a5b9

SHA512
6481aa9610589fb9609d74c8daa70b527593833972540bbcfeef11bc1ec66544b77ad5517b06b46b3e157969593095045253487c57a6b712efba9f47b75873e6

Download Submit
\Users\Admin\AppData\Local\Temp\is-V5P92.tmp\NordVPNSetup.tmp
Filesize
907KB

MD5
db533b58e0c5769c0260ececd48b111d

SHA1
009c8327ed224c88e3188049910a7ba48189a5f4

SHA256
5adbef9336709e76ac1f14326e398bfef7e9cb44573f776491dbd738a366bbe8

SHA512
ea96784192ba8978713ca8821d30d97b0a11d3798b932f4177877369fc332fe5849fe30361c0330b203c5907b1a2487805716d01d029a47a18415f96037a549f

Download Submit
memory/2236-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2236-18-0x0000000004190000-0x00000000041D0000-memory.dmp

Filesize
256KB

Download
memory/2236-21-0x00000000740A0000-0x000000007464B000-memory.dmp

Filesize
5.7MB

Download
memory/2236-37-0x00000000740A0000-0x000000007464B000-memory.dmp

Filesize
5.7MB

Download
memory/2296-1-0x0000000000400000-0x00000000004E1000-memory.dmp

Filesize
900KB

Download