Analysis

  • max time kernel
    86s
  • max time network
    91s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-02-2024 09:49

General

  • Target

    NordVPNSetup.exe

  • Size

    1.7MB

  • MD5

    59cb69a08fdd9cb4b0539e3356df1d4d

  • SHA1

    0c773a0a76f821780c002d527bee387b98904569

  • SHA256

    bea34078c360c71fcadc1a86ebd397d081f0d589913ad43970c1a3983231f522

  • SHA512

    51d4f3d396d183bc5dcaaa0a26cf024fade9b5e5c0e73e1d2ee7663ba26bc55e799beb488d5bab8d8252147b33df6ea1209ebd730124a919940e899758842ec2

  • SSDEEP

    24576:u7FUDowAyrTVE3U5Fg23TD2D+Fz3ifFUwo433RfFcdnOtksSm:uBuZrEUWq0t9D7l

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3596
    • C:\Users\Admin\AppData\Local\Temp\is-PAIHL.tmp\NordVPNSetup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-PAIHL.tmp\NordVPNSetup.tmp" /SL5="$50062,890440,866304,C:\Users\Admin\AppData\Local\Temp\NordVPNSetup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:452
      • C:\Users\Admin\AppData\Local\Temp\is-Q5VJB.tmp\NordVPNSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\is-Q5VJB.tmp\NordVPNSetup.exe" /webinstaller=true /DIR="C:\Program Files\NordVPN" /guid=6a7efad3-0cde-4170-85a3-b3508a006a49
        3⤵
        • Executes dropped EXE
        PID:100
        • C:\Users\Admin\AppData\Local\Temp\is-J1TDF.tmp\NordVPNSetup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-J1TDF.tmp\NordVPNSetup.tmp" /SL5="$600A0,46892173,866304,C:\Users\Admin\AppData\Local\Temp\is-Q5VJB.tmp\NordVPNSetup.exe" /webinstaller=true /DIR="C:\Program Files\NordVPN" /guid=6a7efad3-0cde-4170-85a3-b3508a006a49
          4⤵
            PID:1676

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NordVPNSetup.tmp.log

      Filesize

      932B

      MD5

      87c54d4da204ea1d4fc9489bd45d06e3

      SHA1

      f9ca47f0b16aa375eaf991dc83aec09678e6f749

      SHA256

      c282cbbfd81749788f382185502d567ca75e78030781b498e9ba976fe4d96f63

      SHA512

      172fe3085c22a5b595929e2837174412d1007335b3ef6682ac560b9ec728b2d27664ddb458a79adc59fe1344077a71719660b3b911f926b7080bfb49bff9dc21

    • C:\Users\Admin\AppData\Local\Temp\is-5RCBK.tmp\Nord.Setup.dll

      Filesize

      1KB

      MD5

      669a72cdcb6248aeae1f6712b1477727

      SHA1

      d79c4eac5c8f4cb78db42dfa892bc88dd18daad6

      SHA256

      8a0f7c5f3fa88d23490a5043a115fc9e752d99dfd59604793a50c19d0206ea4c

      SHA512

      ff600b101eafe5ea8ab00897942b264dba6e5e592784a997867a075d741f3861eacef0e95ac1a01f77bd53e3477583db59f3e8fff446bf0c4ec33284df0d774a

    • C:\Users\Admin\AppData\Local\Temp\is-5RCBK.tmp\Nord.Setup.dll

      Filesize

      43KB

      MD5

      b520a418403e5892b7b408057b03691e

      SHA1

      80177b2cc562889f79036adcb9c2382455a66142

      SHA256

      75adb36e6e7299d0cfd72cac0372ae767c7407917e403f9ced4cd544a0b76548

      SHA512

      d7f10f33ff05c9b91441f60e7c276aa6167ca46318c25a592f83f314b1877beb5209e0dac70680a50695ffe783c38f371700583d94bcafa6fd2fce8fdc4551d7

    • C:\Users\Admin\AppData\Local\Temp\is-5RCBK.tmp\VerifyTrust.dll

      Filesize

      85KB

      MD5

      9df5d4f62ade3cc8af0a6e71a0575ac3

      SHA1

      e4459cd0b13b2f4d96e3b56717d4de3a460fe8a3

      SHA256

      af2f4e4676b119843ab71ecaef92562f3f189a99ab765a4d21d30ec8a109bed2

      SHA512

      d67c2385a2c54014266e717dcc18b8c78e22a0518af1397278a0cfecb54b70695047b9fbfdb300b4fd2e012bf3805c0dad400ebff30877dad590666be4b7b872

    • C:\Users\Admin\AppData\Local\Temp\is-5RCBK.tmp\isxdl.dll

      Filesize

      166KB

      MD5

      7192ef335152eead84f33fead7a6d6df

      SHA1

      0da49f29ef0cc9792d529c4b87b1ccc69dc78ef6

      SHA256

      1a50991caa0dce8d832e87d4cba19ad4730b52e504308aa1d43fc4ef5e9ad140

      SHA512

      700ea883bdfcd178d2db0d51276f79e8f15547f8ad920acf6b1083b563bd504fa0d5b3372d00be393d051f97cf855483903416a5dee9846d9585b4b6ad1b1f2b

    • C:\Users\Admin\AppData\Local\Temp\is-J1TDF.tmp\NordVPNSetup.tmp

      Filesize

      546KB

      MD5

      51527bec278b281143875d4cd67a5ba6

      SHA1

      bcb771b1b71a9f154062e52506b57f2bfde42d9d

      SHA256

      944f5231e7c87eeac8bc894568cbb369d55a5fab8e0a44e735293d5a9243d963

      SHA512

      50e2d3f7ce42d46cb935fb839a76662431cc0087e297117c66fa9e6708e8e65cd8077b8e746b425ab87a46792321883ce7de3e2ba2cdad0ca2ba735e871efe1c

    • C:\Users\Admin\AppData\Local\Temp\is-PAIHL.tmp\NordVPNSetup.tmp

      Filesize

      1.8MB

      MD5

      ebacab450c04e1fcf18d0a10414eddcd

      SHA1

      8961c21931247d816aa45ed121b62eed0b14e18b

      SHA256

      84134efd1cb3fc4312c4130dc7da17de267947010d0e4e7e89cf0c2dfa5957f6

      SHA512

      0856be055ad79d438655689b59e4a9a49e13bca7593e1bbd1507f5103d111cb12ec883d03b2a204a6e31dfdd88689f5b0c9cdaff883e8cb14c8dd382f42e8d84

    • C:\Users\Admin\AppData\Local\Temp\is-Q5VJB.tmp\Nord.Setup.dll

      Filesize

      40KB

      MD5

      b18bd486c5718397bc65d77a16ce2593

      SHA1

      58fe73e27c5c04e6915c5358f698f7fe8c2b5af8

      SHA256

      0bbf32b0553ca1292602e8c2c0458e075fdee2c8b6ef8ea81e924a86bc065f3c

      SHA512

      f4ffa1c8983914c41657fecc11c9324caa5899ad875b9687da8ffcf79ab189f19d6f926e16f09f240de9e6b22e26691fae785ed95657af310de5bf6c58ce8e0e

    • C:\Users\Admin\AppData\Local\Temp\is-Q5VJB.tmp\NordVPNSetup.exe

      Filesize

      1.6MB

      MD5

      ccbf0292048774ab1d6cf37e89c73747

      SHA1

      fce770bd8e7407e159b48cebc8c110cfaa17ebd8

      SHA256

      4dc32f6a57d8834b3c3b4cc82323fe0008b5649032a32fa4446eb037ba563c77

      SHA512

      644952aa0355c892bb0ed6a14bfc125cf96a32c839f621fb54705ef6e44401687939bedb4fd2aea0e4f542f478d67a78294f40e92dd3d93cabcffd46b02606eb

    • C:\Users\Admin\AppData\Local\Temp\is-Q5VJB.tmp\NordVPNSetup.exe

      Filesize

      580KB

      MD5

      8f72a4b50bb7e1ad942ee5ecf2274b43

      SHA1

      d5cc75b7045d667be938e275ed24a30a45be0085

      SHA256

      fca1e3ec2da97a4b197f7e9a8e0583c9945eb2cf6aaa42beda356b9b83385375

      SHA512

      3219ab52a07e0d0d870e5eda87bbc3f4277a871accb6fa6a5cee8bdbd40f4a11dc1c5eaaad113f3aa6b6d1108479a41da5c8337c0c0c306e186310dc000cc39b

    • C:\Users\Admin\AppData\Local\Temp\is-Q5VJB.tmp\NordVPNSetup.exe

      Filesize

      715KB

      MD5

      0379a8776f69bbaa2022178ab750e74e

      SHA1

      c29a3e5db051dee8b82d26ca2cbc288526e85e7f

      SHA256

      a62adde090bb8fd2d3d2ed5ddff24f25db7e19bc0a2f3c4f9489acd954a8ccb0

      SHA512

      3eb2d19a812df473432688c2838b0d0c74f64c0f2a61b275962060c93220ef882cb48815bcebdeaffa6afcd7aa6e72f85817bc91929db4e17c5f393fa58d2470

    • memory/100-70-0x0000000000400000-0x00000000004E1000-memory.dmp

      Filesize

      900KB

    • memory/452-26-0x0000000006650000-0x0000000006B7C000-memory.dmp

      Filesize

      5.2MB

    • memory/452-24-0x00000000745C0000-0x00000000745D0000-memory.dmp

      Filesize

      64KB

    • memory/452-45-0x0000000000400000-0x000000000071B000-memory.dmp

      Filesize

      3.1MB

    • memory/452-32-0x0000000004340000-0x0000000004350000-memory.dmp

      Filesize

      64KB

    • memory/452-29-0x0000000000A30000-0x0000000000A31000-memory.dmp

      Filesize

      4KB

    • memory/452-28-0x0000000000400000-0x000000000071B000-memory.dmp

      Filesize

      3.1MB

    • memory/452-6-0x0000000000A30000-0x0000000000A31000-memory.dmp

      Filesize

      4KB

    • memory/452-19-0x0000000004340000-0x0000000004350000-memory.dmp

      Filesize

      64KB

    • memory/452-33-0x0000000073D20000-0x00000000744D0000-memory.dmp

      Filesize

      7.7MB

    • memory/452-25-0x0000000073D20000-0x00000000744D0000-memory.dmp

      Filesize

      7.7MB

    • memory/452-120-0x0000000000400000-0x000000000071B000-memory.dmp

      Filesize

      3.1MB

    • memory/452-121-0x0000000073D20000-0x00000000744D0000-memory.dmp

      Filesize

      7.7MB

    • memory/452-23-0x00000000042F0000-0x0000000004300000-memory.dmp

      Filesize

      64KB

    • memory/1676-145-0x0000000074140000-0x0000000074150000-memory.dmp

      Filesize

      64KB

    • memory/1676-143-0x0000000003650000-0x0000000003660000-memory.dmp

      Filesize

      64KB

    • memory/1676-76-0x0000000000D10000-0x0000000000D11000-memory.dmp

      Filesize

      4KB

    • memory/1676-146-0x00000000738A0000-0x0000000074050000-memory.dmp

      Filesize

      7.7MB

    • memory/1676-144-0x0000000003680000-0x0000000003690000-memory.dmp

      Filesize

      64KB

    • memory/3596-123-0x0000000000400000-0x00000000004E1000-memory.dmp

      Filesize

      900KB

    • memory/3596-1-0x0000000000400000-0x00000000004E1000-memory.dmp

      Filesize

      900KB

    • memory/3596-27-0x0000000000400000-0x00000000004E1000-memory.dmp

      Filesize

      900KB