vkeylogger | 57df82d0e4547407bdca25692313c2a95b07438991c4cfd44a85d85e5976a965

Analysis

max time kernel
142s
max time network
145s
platform
windows10_x64
resource
win10-20220223-en
submitted
09-03-2022 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57df82d0e4547407bdca25692313c2a95b07438991c4cfd44a85d85e5976a965.exe
Size

74KB
MD5

ba4380237e7a0f220deaaada1fddff73
SHA1

394b852855574cffa26a66bec083792a21f87f79
SHA256

57df82d0e4547407bdca25692313c2a95b07438991c4cfd44a85d85e5976a965
SHA512

5e70426b3547020f93c62764f418ff7d475f4bf772130b056f33884e7b155b9675a4af292b356bd9897c5e6c665488989d7400dfb452d8544d1252b3e3798142

Score

10^/10

vkeylogger keylogger persistence stealer

Malware Config

Signatures

VKeylogger
A keylogger first seen in Nov 2020.
stealer keylogger vkeylogger

VKeylogger Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2540-114-0x0000000000990000-0x00000000009A2000-memory.dmp	family_vkeylogger

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Windows\CurrentVersion\Run\grerg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\57df82d0e4547407bdca25692313c2a95b07438991c4cfd44a85d85e5976a965.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Windows\CurrentVersion\Run\yrty = "C:\\Windows\\system32\\mshta.exe javascript:x=new%20ActiveXObject(\"wscript.shell\");v=x.RegRead(\"HKCU\\\\Software\\\\Microsoft\\\\SMSvcHost\\\\ComponentID\");eval(v);"	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3544 set thread context of 2540	3544	57df82d0e4547407bdca25692313c2a95b07438991c4cfd44a85d85e5976a965.exe	42

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3544	57df82d0e4547407bdca25692313c2a95b07438991c4cfd44a85d85e5976a965.exe
2540	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2540	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 2540	3544	57df82d0e4547407bdca25692313c2a95b07438991c4cfd44a85d85e5976a965.exe	42
PID 3544 wrote to memory of 2540	3544	57df82d0e4547407bdca25692313c2a95b07438991c4cfd44a85d85e5976a965.exe	42
PID 3544 wrote to memory of 2540	3544	57df82d0e4547407bdca25692313c2a95b07438991c4cfd44a85d85e5976a965.exe	42

C:\Users\Admin\AppData\Local\Temp\57df82d0e4547407bdca25692313c2a95b07438991c4cfd44a85d85e5976a965.exe
"C:\Users\Admin\AppData\Local\Temp\57df82d0e4547407bdca25692313c2a95b07438991c4cfd44a85d85e5976a965.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2540-114-0x0000000000990000-0x00000000009A2000-memory.dmp

Filesize
72KB

Download