2c17a26b5fe33122e3ced51fd836599068998940407c1e2f1a44f4ec6e5fb4e1

General

Target
AviraPhantomVPNPro/Avira Phantom VPN Pro/Avira Phantom VPN Pro 2.44.1.19908.exe
Size 5.2MB
Sample240614-agbrpaxarc
SHA256 940ec4012984218f6e314d793c995b3cb3c3366aabba0308fece77fe2ed7abb7
MD5 0fe5732c15e8150c8f107a0e73db4e45
SHA1 a3b4e14d09b82d365dbf52480854e399b2672f34
SHA512 2cedc194be8ec37a7d035bcf4af42ea74a6a51fa220ea2d9edc406ae5a7b4dea022f1287c09a22f59a552e23a20730821184434cee2879371db0a78897d0e292
SSDEEP 98304:w0FHAF/aUuvI2peNyoiOC+uWiOqXL6cY9J54jqrZwY8v:xFHAFdCpwy+PeOZ9J5v2YQ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation	Avira Phantom VPN Pro 2.44.1.19908.tmp

Executes dropped EXE 1 IoCs

pid	Process
1188	Avira Phantom VPN Pro 2.44.1.19908.tmp

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2692	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 3 IoCs

evasion

pid	Process
5036	taskkill.exe
744	taskkill.exe
1520	taskkill.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	744	taskkill.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 1188	856	Avira Phantom VPN Pro 2.44.1.19908.exe	89
PID 856 wrote to memory of 1188	856	Avira Phantom VPN Pro 2.44.1.19908.exe	89
PID 856 wrote to memory of 1188	856	Avira Phantom VPN Pro 2.44.1.19908.exe	89
PID 1188 wrote to memory of 1520	1188	Avira Phantom VPN Pro 2.44.1.19908.tmp	91
PID 1188 wrote to memory of 1520	1188	Avira Phantom VPN Pro 2.44.1.19908.tmp	91
PID 1188 wrote to memory of 1520	1188	Avira Phantom VPN Pro 2.44.1.19908.tmp	91
PID 1188 wrote to memory of 5036	1188	Avira Phantom VPN Pro 2.44.1.19908.tmp	93
PID 1188 wrote to memory of 5036	1188	Avira Phantom VPN Pro 2.44.1.19908.tmp	93
PID 1188 wrote to memory of 5036	1188	Avira Phantom VPN Pro 2.44.1.19908.tmp	93
PID 1188 wrote to memory of 744	1188	Avira Phantom VPN Pro 2.44.1.19908.tmp	95
PID 1188 wrote to memory of 744	1188	Avira Phantom VPN Pro 2.44.1.19908.tmp	95
PID 1188 wrote to memory of 744	1188	Avira Phantom VPN Pro 2.44.1.19908.tmp	95
PID 1188 wrote to memory of 2692	1188	Avira Phantom VPN Pro 2.44.1.19908.tmp	97
PID 1188 wrote to memory of 2692	1188	Avira Phantom VPN Pro 2.44.1.19908.tmp	97
PID 1188 wrote to memory of 2692	1188	Avira Phantom VPN Pro 2.44.1.19908.tmp	97

C:\Users\Admin\AppData\Local\Temp\AviraPhantomVPNPro\Avira Phantom VPN Pro\Avira Phantom VPN Pro 2.44.1.19908.exe
"C:\Users\Admin\AppData\Local\Temp\AviraPhantomVPNPro\Avira Phantom VPN Pro\Avira Phantom VPN Pro 2.44.1.19908.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\is-4QJRK.tmp\Avira Phantom VPN Pro 2.44.1.19908.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4QJRK.tmp\Avira Phantom VPN Pro 2.44.1.19908.tmp" /SL5="$E0120,4884611,248832,C:\Users\Admin\AppData\Local\Temp\AviraPhantomVPNPro\Avira Phantom VPN Pro\Avira Phantom VPN Pro 2.44.1.19908.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im Avira.WebAppHost.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im Avira.VPN.Notifier.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /f /im Avira.NetworkBlocker.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:744
- - C:\Windows\SysWOW64\sc.exe
    "C:\Windows\System32\sc.exe" stop AviraPhantomVPN
    3⤵
    - Launches sc.exe
    PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3924,i,10925946972013221578,8820669985803190952,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
1⤵
PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Avira Phantom VPN Pro 2.44.1.19908.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-4QJRK.tmp\Avira Phantom VPN Pro 2.44.1.19908.tmp
Size 1.5MB
SHA256 02febfffcac96296e9cbad84cccf0153a11c051e0f2421e86360eccfc21f7f4d
MD5 0c1c8eb89026af3bc48b56d10759c400
SHA1 46052ea988389f440ebbf5ff2fe3cc4570f2131c
SHA512 5c85df79f85c31557cb9d5d5974314fddd71ddaf66427c5d673b5db887b752a31e2dd510b2ab0bc5953751037c97e436c6bfa149a22ae7a8031a24e92c319d20
SSDEEP 24576:5H9/gqpQYze0XKvc4BYCsCS3D4kjiIUjyeyXEDq8UbVlc3GYgl4KvjKTexLNB:fIEJxCWluyZ8UbMkr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/856-0-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/856-2-0x0000000000401000-0x0000000000417000-memory.dmp

Download

memory/856-13-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/1188-6-0x0000000000400000-0x0000000000593000-memory.dmp

Download

memory/1188-14-0x0000000000400000-0x0000000000593000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads