41829e5657955b3e6f1f96d2ae97c15cdefaef0d8fab48e09c9bd4ec961f9bd5

Analysis

max time kernel
140s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

letsvpn-latest.exe
Size

18.2MB
MD5

401a07a0b36cbdea583fbb55c1b934bc
SHA1

36866ac3dc267b9ccd92d9ff53e9574ef13ee041
SHA256

41829e5657955b3e6f1f96d2ae97c15cdefaef0d8fab48e09c9bd4ec961f9bd5
SHA512

695e4afba0e51100b9e23432908128436ce442f9eaeca489317f96020319b937e22e38fec02acadeb0f3802d543fd36a96d7b815dd2854aa043cd15b8a06120d
SSDEEP

393216:GbSXb4YVsff4ePzvH8GVkOu37wT1V46ffPDbN4XsoX3a:GlM5eLf8CM7wX4SfPgi

Score

7^/10

discovery upx vmprotect

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
316	u2.exe

Loads dropped DLL 6 IoCs

pid	Process
1864	letsvpn-latest.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe
396	WerFault.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1864-0-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/1864-18-0x0000000000400000-0x0000000000433000-memory.dmp	upx

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x0015000000018655-6.dat	vmprotect
behavioral1/memory/1864-10-0x0000000002AA0000-0x0000000003455000-memory.dmp	vmprotect
behavioral1/memory/316-11-0x0000000000400000-0x0000000000DB5000-memory.dmp	vmprotect
behavioral1/memory/316-12-0x0000000000400000-0x0000000000DB5000-memory.dmp	vmprotect
behavioral1/memory/316-28-0x0000000000400000-0x0000000000DB5000-memory.dmp	vmprotect

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\letsvpn-latest.exe	letsvpn-latest.exe
File opened for modification	C:\Program Files (x86)\letsvpn-latest.exe	letsvpn-latest.exe
File created	C:\Program Files (x86)\u2.exe	letsvpn-latest.exe
File opened for modification	C:\Program Files (x86)\u2.exe	letsvpn-latest.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
396	316	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	letsvpn-latest.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	u2.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 316	1864	letsvpn-latest.exe	31
PID 1864 wrote to memory of 316	1864	letsvpn-latest.exe	31
PID 1864 wrote to memory of 316	1864	letsvpn-latest.exe	31
PID 1864 wrote to memory of 316	1864	letsvpn-latest.exe	31
PID 316 wrote to memory of 396	316	u2.exe	32
PID 316 wrote to memory of 396	316	u2.exe	32
PID 316 wrote to memory of 396	316	u2.exe	32
PID 316 wrote to memory of 396	316	u2.exe	32

C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe
"C:\Users\Admin\AppData\Local\Temp\letsvpn-latest.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\u2.exe
  "C:\Program Files (x86)\u2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 200
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\u2.exe

Filesize
3.9MB

MD5
e764a104806ac308d01e36ceb93f3460

SHA1
1d4727f2cf99963aaeb0114b8c215adc1c509e2e

SHA256
47ca292b2b8d1dc59b074c935aa768eb1c84f9f0322183594f4408a234342304

SHA512
9ede963ddf2df06d0010da9eb36cc23333b7722037bcfc963d81b34b4e8c90453d67f29d64a2710376c17317bbaed2e7972e0d765ef9c4d450d9b0d4e3fd2352

Download Submit
memory/316-11-0x0000000000400000-0x0000000000DB5000-memory.dmp

Filesize
9.7MB

Download
memory/316-12-0x0000000000400000-0x0000000000DB5000-memory.dmp

Filesize
9.7MB

Download
memory/316-28-0x0000000000400000-0x0000000000DB5000-memory.dmp

Filesize
9.7MB

Download
memory/1864-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1864-10-0x0000000002AA0000-0x0000000003455000-memory.dmp

Filesize
9.7MB

Download
memory/1864-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1864-27-0x0000000002AA0000-0x0000000003455000-memory.dmp

Filesize
9.7MB

Download