Overview

overview

8

Static

static

1

softether-...el.exe

windows10-2004-x64

8

softether-...el.exe

windows11-ltsc_2024-x64

5

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 23:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    softether-vpnclient-v4.44-9807-rtm-2025.04.16-windows-x86_x64-intel.exe
  • Size 53.6MB
  • Sample260809-3cbkcaxcph
  • SHA256 ab006331f1f646bc319585088239d55bc54ecde5c269009268e9598307da7a44
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 17 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 6 IoCs
    execution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 35 IoCs
  • Drops file in Windows directory 6 IoCs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\softether-vpnclient-v4.44-9807-rtm-2025.04.16-windows-x86_x64-intel.exe
    "C:\Users\Admin\AppData\Local\Temp\softether-vpnclient-v4.44-9807-rtm-2025.04.16-windows-x86_x64-intel.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Users\Admin\AppData\Local\Temp\VPN_A150\vpnsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\VPN_A150\vpnsetup.exe" /CALLERSFXPATH:"C:\Users\Admin\AppData\Local\Temp\VPN_A150\installer.cache" /ISEASYINSTALLER:0
      2⤵
      • Adds Run key to start application
      • Checks computer location settings
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4924
      • C:\Windows\SysWOW64\cscript.exe
        C:\Windows\system32\cscript.exe "C:\Users\Admin\AppData\Local\Temp\VPN_114F\winfire_1EA65D4DF09B.vbs"
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        PID:4332
      • C:\Windows\SysWOW64\cscript.exe
        C:\Windows\system32\cscript.exe "C:\Users\Admin\AppData\Local\Temp\VPN_114F\winfire_7FE6B811D65B.vbs"
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        PID:4196
      • C:\Windows\SysWOW64\cscript.exe
        C:\Windows\system32\cscript.exe "C:\Users\Admin\AppData\Local\Temp\VPN_114F\winfire_8662E404CDBE.vbs"
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        PID:3144
      • C:\Windows\SysWOW64\cscript.exe
        C:\Windows\system32\cscript.exe "C:\Users\Admin\AppData\Local\Temp\VPN_114F\winfire_4C1212C9EEDD.vbs"
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        PID:4008
      • C:\Windows\SysWOW64\cscript.exe
        C:\Windows\system32\cscript.exe "C:\Users\Admin\AppData\Local\Temp\VPN_114F\winfire_8B772B9AE845.vbs"
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        PID:4744
      • C:\Windows\SysWOW64\cscript.exe
        C:\Windows\system32\cscript.exe "C:\Users\Admin\AppData\Local\Temp\VPN_114F\winfire_60354AA7A593.vbs"
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        PID:980
      • C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe
        "C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe" /uihelp
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:700
        • C:\Users\Admin\AppData\Local\Temp\VPN_C775\driver_installer.exe
          "C:\Users\Admin\AppData\Local\Temp\VPN_C775\driver_installer.exe" instvlan VPN
          4⤵
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1408
          • C:\Windows\system32\netsh.exe
            C:\Windows\system32\netsh.exe interface set interface name="Local Area Connection" newname="VPN - VPN Client"
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:3220
          • C:\Windows\system32\netsh.exe
            C:\Windows\system32\netsh.exe netsh interface ipv4 set interface interface="VPN - VPN Client" metric=1
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:5036
          • C:\Windows\system32\netsh.exe
            C:\Windows\system32\netsh.exe netsh interface ipv4 set interface interface="VPN - VPN Client" metric=1
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:1292
          • C:\Windows\system32\netsh.exe
            C:\Windows\system32\netsh.exe netsh interface ipv4 set interface interface="VPN - VPN Client" metric=1
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:4876
          • C:\Windows\system32\netsh.exe
            C:\Windows\system32\netsh.exe netsh interface ipv4 set interface interface="VPN - VPN Client" metric=1
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:2032
          • C:\Windows\system32\netsh.exe
            C:\Windows\system32\netsh.exe netsh interface ipv4 set interface interface="VPN - VPN Client" metric=1
            5⤵
            • Event Triggered Execution: Netsh Helper DLL
            PID:2616
      • C:\Program Files\SoftEther VPN Client\vpncmd_x64.exe
        "C:\Program Files\SoftEther VPN Client\vpncmd_x64.exe" /?
        3⤵
        • Drops file in System32 directory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4212
      • C:\Program Files\SoftEther VPN Client\vpncmgr_x64.exe
        "C:\Program Files\SoftEther VPN Client\vpncmgr_x64.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2416
  • C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe
    "C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe" /service
    1⤵
    • Executes dropped EXE
    PID:4828
  • C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe
    "C:\Program Files\SoftEther VPN Client\vpnclient_x64.exe" /service
    1⤵
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:720
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{12784f1a-8bb7-0344-bbbd-ed4a451b8ece}\neo6_x64_vpn.inf" "9" "45695478f" "0000000000000160" "WinSta0\Default" "0000000000000174" "208" "c:\users\admin\appdata\local\temp\vpn_9afe"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:1948
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:fc9f1aa2bdee116c:NeoAdapter.Install:4.25.0.9658:neoadapter_vpn," "45695478f" "0000000000000160"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:3056
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
    1⤵
    • Modifies data under HKEY_USERS
    PID:4836

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        lang.config
        • Path C:\Program Files\SoftEther VPN Client\lang.config
        • Size 867B
        • SHA256 198a807286efe5d84bcccd01ca6d2e4b71dd0b4024919406395483117b745b81
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        .unicode_cache_3d911b06.dat
        • Path C:\Users\Admin\AppData\Local\Temp\.unicode_cache_3d911b06.dat
        • Size 1.6MB
        • SHA256 cd53c19662acbab238f08ed50dbb5ad4b12bfeb6e72954510da644d5fe740833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        9218E5A4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_114F\9218E5A4.dll
        • Size 5.3MB
        • SHA256 af17ddfcf02a27bc542501be3a2801d0c891a6e39452b9c5b7ac4bf2447536eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        winfire_1EA65D4DF09B.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_114F\winfire_1EA65D4DF09B.vbs
        • Size 590B
        • SHA256 90cfdf8285248ae40d4ce6fb752847ea9c34607f084f4b7c0dd7d086eb4af9a6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        winfire_4C1212C9EEDD.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_114F\winfire_4C1212C9EEDD.vbs
        • Size 630B
        • SHA256 dfb40a11e1f641e43cd612045d387c8e087bf06f550777ab48da116e0d1d508a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        winfire_60354AA7A593.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_114F\winfire_60354AA7A593.vbs
        • Size 625B
        • SHA256 c62e7594633ab12ef0a5c9868b4cf7895bf2fa027fae391a996df778a39f2086
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        winfire_7FE6B811D65B.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_114F\winfire_7FE6B811D65B.vbs
        • Size 594B
        • SHA256 3f6fe40ea9ffaf170e69ba328e8249d7ab28dbd5e7a4846a867122c25a84f8a6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        winfire_8662E404CDBE.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_114F\winfire_8662E404CDBE.vbs
        • Size 626B
        • SHA256 f20470c5ce0c6329be48937c3154b54ccbacbec201f187b39ebb895148bdb011
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        winfire_8B772B9AE845.vbs
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_114F\winfire_8B772B9AE845.vbs
        • Size 621B
        • SHA256 a0bd44c26b145fbd50cfbf994daa98065204208ba4c0d8c8dd0544b3d572f862
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Neo6_x64_VPN.cat
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_9AFE\Neo6_x64_VPN.cat
        • Size 19KB
        • SHA256 162c56608532ef7c699520194fd2231550bab6d0a32c1bbb6866f22da8c45aed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Neo6_x64_VPN.inf
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_9AFE\Neo6_x64_VPN.inf
        • Size 3KB
        • SHA256 8f049a53bab3f1a16f118c91c15569cceef4b2955905c8f7c70f7952f9c175b8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Neo6_x64_VPN.sys
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_9AFE\Neo6_x64_VPN.sys
        • Size 36KB
        • SHA256 54e74a7906af47c2b07f0ea171973d6abb123549a1c66cf0cc6f24ec5e55a237
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        hamcore.se2
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_A150\hamcore.se2
        • Size 22.1MB
        • SHA256 ef14f333cce4ed853ccde0075142851e9258040a4e794b13113f8f192556ad16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        install_src.dat
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_A150\install_src.dat
        • Size 13B
        • SHA256 a14e2262c62cbab88292046dc872d920792e29f35abd1daf536e31be52c8e1a7
        • MD5 SHA1 SHA512
        Submit Download

        vpnclient.exe
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_A150\vpnclient.exe
        • Size 5.3MB
        • SHA256 6b1360724373bd1666a31f72dfe9c466931acee37dbec36a4e0608396dfed095
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vpnclient_x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_A150\vpnclient_x64.exe
        • Size 6.7MB
        • SHA256 58e64e25ba2e9d155ca6950de03b2c4b2c2a88e2f742cd53ddb96e9abda2fbb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vpncmd.exe
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_A150\vpncmd.exe
        • Size 5.3MB
        • SHA256 d09745d77b02b077384af4f56a1d6a03b7ed9dd8cbe2fe26cd07d822cfe3cab0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vpncmd_x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_A150\vpncmd_x64.exe
        • Size 6.7MB
        • SHA256 6b006be36e081d42f3ecccfb237e06505542aaad807cc7520aaeaf3e7125e022
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vpncmgr.exe
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_A150\vpncmgr.exe
        • Size 5.4MB
        • SHA256 5f43266fe190791fdd2226a243a28d6adb65ecf0172daf552c8d529f6b052ee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vpncmgr_x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_A150\vpncmgr_x64.exe
        • Size 6.9MB
        • SHA256 a6bd522824ec719f9a4f4922b20a4634549d9feb8fdf50417d060e3ce59a0a84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vpninstall.exe
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_A150\vpninstall.exe
        • Size 5.4MB
        • SHA256 941a715136fad9d4c6cde1f8dafb288872f6eba64d34c7799c05339762e1a8c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vpnsetup.exe
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_A150\vpnsetup.exe
        • Size 6.2MB
        • SHA256 7b39e1981e5e7b1386d56631a5f952b599bd1756e6d711b0f4305cd0f152a369
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vpnsetup_x64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_A150\vpnsetup_x64.exe
        • Size 7.6MB
        • SHA256 46ede0a42ca7408ef997e47dedfe66a825be2b10b0b5fbeb9b87e5a8525a7668
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vpnweb.cab
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_A150\vpnweb.cab
        • Size 213KB
        • SHA256 c3398437369d621d2cf46664b0416b1eb2f4e395bef244d04b10364b24a3a302
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        driver_installer.exe
        • Path C:\Users\Admin\AppData\Local\Temp\VPN_C775\driver_installer.exe
        • Size 6.8MB
        • SHA256 20ad5507a0545930f844832ad9ac4f7c62164884c3d5c396429d4819f5ce0090
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        0FC343C0.dll
        • Path C:\Windows\Temp\VPN_504E\0FC343C0.dll
        • Size 181KB
        • SHA256 00053aa7be3825828ad7c8c1c9f9ad29df07f5538107479886d8427df86bb4f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download