Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 02:33
Behavioral task
behavioral1
Sample
VantaPaid.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
VantaPaid.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
VantaPaid.exe
-
Size
165KB
-
MD5
dee04dfb6b2dd1b73a5c6b83911c4bed
-
SHA1
a80516d112d08fc820ddaaf6e6e972c088a2dfe2
-
SHA256
09bfb2b9045773f123de5aad102a6cc08bbad620b7cd35fa926b624ef1e7ee30
-
SHA512
209734045eb5efb01a0527db8bd74ebc027f3922b1c0c2caaa9eaa1e0043b22aa5c5845629d97aff698eb13ead2b111ff9a7d05df37ddd5e4e014f2426733c23
-
SSDEEP
3072:Fw19/9Arq7DWCKoXiO4VIaGEcPkGmK9LxBbqp2h2q:FwEwyxvcMGmCBbIq
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation VantaPaid.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupHelper.exe StartupHelper.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupHelper.exe StartupHelper.exe -
Executes dropped EXE 3 IoCs
pid Process 1984 StartupHelper.exe 112 StartupHelper.exe 4752 StartupHelper.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\StartupHelper.exe = "\"C:\\Windows\\StartupHelper.exe\" .." StartupHelper.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartupHelper.exe = "\"C:\\Windows\\StartupHelper.exe\" .." StartupHelper.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\StartupHelper.exe VantaPaid.exe File opened for modification C:\Windows\StartupHelper.exe StartupHelper.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VantaPaid.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2136 schtasks.exe 4380 schtasks.exe 1508 schtasks.exe 3104 schtasks.exe 840 schtasks.exe 1136 schtasks.exe 3260 schtasks.exe 4448 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe 4684 VantaPaid.exe -
Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeDebugPrivilege 4684 VantaPaid.exe Token: SeDebugPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: SeDebugPrivilege 112 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: SeDebugPrivilege 4752 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe Token: 33 1984 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1984 StartupHelper.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 4684 wrote to memory of 2180 4684 VantaPaid.exe 83 PID 4684 wrote to memory of 2180 4684 VantaPaid.exe 83 PID 4684 wrote to memory of 2180 4684 VantaPaid.exe 83 PID 4684 wrote to memory of 3260 4684 VantaPaid.exe 85 PID 4684 wrote to memory of 3260 4684 VantaPaid.exe 85 PID 4684 wrote to memory of 3260 4684 VantaPaid.exe 85 PID 4684 wrote to memory of 528 4684 VantaPaid.exe 87 PID 4684 wrote to memory of 528 4684 VantaPaid.exe 87 PID 4684 wrote to memory of 528 4684 VantaPaid.exe 87 PID 4684 wrote to memory of 4448 4684 VantaPaid.exe 89 PID 4684 wrote to memory of 4448 4684 VantaPaid.exe 89 PID 4684 wrote to memory of 4448 4684 VantaPaid.exe 89 PID 4684 wrote to memory of 1984 4684 VantaPaid.exe 91 PID 4684 wrote to memory of 1984 4684 VantaPaid.exe 91 PID 4684 wrote to memory of 1984 4684 VantaPaid.exe 91 PID 1984 wrote to memory of 3428 1984 StartupHelper.exe 92 PID 1984 wrote to memory of 3428 1984 StartupHelper.exe 92 PID 1984 wrote to memory of 3428 1984 StartupHelper.exe 92 PID 1984 wrote to memory of 2136 1984 StartupHelper.exe 94 PID 1984 wrote to memory of 2136 1984 StartupHelper.exe 94 PID 1984 wrote to memory of 2136 1984 StartupHelper.exe 94 PID 1984 wrote to memory of 1768 1984 StartupHelper.exe 95 PID 1984 wrote to memory of 1768 1984 StartupHelper.exe 95 PID 1984 wrote to memory of 1768 1984 StartupHelper.exe 95 PID 1984 wrote to memory of 4380 1984 StartupHelper.exe 98 PID 1984 wrote to memory of 4380 1984 StartupHelper.exe 98 PID 1984 wrote to memory of 4380 1984 StartupHelper.exe 98 PID 112 wrote to memory of 2192 112 StartupHelper.exe 117 PID 112 wrote to memory of 2192 112 StartupHelper.exe 117 PID 112 wrote to memory of 2192 112 StartupHelper.exe 117 PID 112 wrote to memory of 1508 112 StartupHelper.exe 119 PID 112 wrote to memory of 1508 112 StartupHelper.exe 119 PID 112 wrote to memory of 1508 112 StartupHelper.exe 119 PID 112 wrote to memory of 1284 112 StartupHelper.exe 120 PID 112 wrote to memory of 1284 112 StartupHelper.exe 120 PID 112 wrote to memory of 1284 112 StartupHelper.exe 120 PID 112 wrote to memory of 3104 112 StartupHelper.exe 123 PID 112 wrote to memory of 3104 112 StartupHelper.exe 123 PID 112 wrote to memory of 3104 112 StartupHelper.exe 123 PID 4752 wrote to memory of 4708 4752 StartupHelper.exe 127 PID 4752 wrote to memory of 4708 4752 StartupHelper.exe 127 PID 4752 wrote to memory of 4708 4752 StartupHelper.exe 127 PID 4752 wrote to memory of 840 4752 StartupHelper.exe 129 PID 4752 wrote to memory of 840 4752 StartupHelper.exe 129 PID 4752 wrote to memory of 840 4752 StartupHelper.exe 129 PID 4752 wrote to memory of 656 4752 StartupHelper.exe 130 PID 4752 wrote to memory of 656 4752 StartupHelper.exe 130 PID 4752 wrote to memory of 656 4752 StartupHelper.exe 130 PID 4752 wrote to memory of 1136 4752 StartupHelper.exe 133 PID 4752 wrote to memory of 1136 4752 StartupHelper.exe 133 PID 4752 wrote to memory of 1136 4752 StartupHelper.exe 133
Processes
-
C:\Users\Admin\AppData\Local\Temp\VantaPaid.exe"C:\Users\Admin\AppData\Local\Temp\VantaPaid.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:2180
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\VantaPaid.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3260
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:528
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\VantaPaid.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4448
-
-
C:\Windows\StartupHelper.exe"C:\Windows\StartupHelper.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:3428
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2136
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:1768
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4380
-
-
-
C:\Windows\StartupHelper.exeC:\Windows\StartupHelper.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:2192
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1508
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:1284
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3104
-
-
C:\Windows\StartupHelper.exeC:\Windows\StartupHelper.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:4708
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:840
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:656
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1136
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD540b0c3caa1b14a4c83e8475c46bf2016
SHA1af9575cda4d842f028d18b17063796a894ecd9d0
SHA25670e88a428d92b6ab5905dac9f324824c4c6f120bc3f385c82b2d12f707a4a867
SHA512916437df737de4b6063b7116b4d148229d4a975eb4046122d47434b81fba06e88e09e5f273ec496c81ef3feecb843ccad20a7a04074224416c1fa9951acbdac7
-
Filesize
165KB
MD5dee04dfb6b2dd1b73a5c6b83911c4bed
SHA1a80516d112d08fc820ddaaf6e6e972c088a2dfe2
SHA25609bfb2b9045773f123de5aad102a6cc08bbad620b7cd35fa926b624ef1e7ee30
SHA512209734045eb5efb01a0527db8bd74ebc027f3922b1c0c2caaa9eaa1e0043b22aa5c5845629d97aff698eb13ead2b111ff9a7d05df37ddd5e4e014f2426733c23