vkeylogger | e6ccc7cc7154361faaf1994b3395a27bb0b8a97f002e28bcdba5e9901793bb00

General

Target

b2b_2022-03-20_00-04.exe
Size

298KB
MD5

773c9670c70dd5c465ad8e57a39ae55a
SHA1

dc117d5ecfdea361e0c31568c3a78714461ad02b
SHA256

e6ccc7cc7154361faaf1994b3395a27bb0b8a97f002e28bcdba5e9901793bb00
SHA512

265e1d19da3f1a13a25fc2dd6a12cfff484520e1228517d57dfb9cb4ff171bc4d4f986321eba619dbbb77019c714daf1b6bcd7c9dc921ddcee86ef0b25aa2dac

Score

10^/10

vkeylogger keylogger persistence stealer

Malware Config

Signatures

VKeylogger
A keylogger first seen in Nov 2020.
stealer keylogger vkeylogger

VKeylogger Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1704-56-0x0000000000220000-0x0000000000232000-memory.dmp	family_vkeylogger
behavioral1/memory/1704-57-0x0000000000400000-0x0000000000474000-memory.dmp	family_vkeylogger
behavioral1/memory/1876-61-0x0000000000080000-0x0000000000093000-memory.dmp	family_vkeylogger

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows\CurrentVersion\Run\mfoedmf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b2b_2022-03-20_00-04.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows\CurrentVersion\Run\ghtrh = "C:\\Windows\\system32\\mshta.exe javascript:x=new%20ActiveXObject(\"wscript.shell\");v=x.RegRead(\"HKCU\\\\Software\\\\Microsoft\\\\SMSvcHost\\\\ComponentID\");eval(v);"	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1704 set thread context of 1876	1704	b2b_2022-03-20_00-04.exe	27

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1704	b2b_2022-03-20_00-04.exe
1876	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1876	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1876	explorer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 1876	1704	b2b_2022-03-20_00-04.exe	27
PID 1704 wrote to memory of 1876	1704	b2b_2022-03-20_00-04.exe	27
PID 1704 wrote to memory of 1876	1704	b2b_2022-03-20_00-04.exe	27
PID 1704 wrote to memory of 1876	1704	b2b_2022-03-20_00-04.exe	27

C:\Users\Admin\AppData\Local\Temp\b2b_2022-03-20_00-04.exe
"C:\Users\Admin\AppData\Local\Temp\b2b_2022-03-20_00-04.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-54-0x00000000005FB000-0x000000000060C000-memory.dmp

Filesize
68KB

Download
memory/1704-55-0x00000000005FB000-0x000000000060C000-memory.dmp

Filesize
68KB

Download
memory/1704-56-0x0000000000220000-0x0000000000232000-memory.dmp

Filesize
72KB

Download
memory/1704-57-0x0000000000400000-0x0000000000474000-memory.dmp

Filesize
464KB

Download
memory/1704-58-0x00000000750C1000-0x00000000750C3000-memory.dmp

Filesize
8KB

Download
memory/1876-60-0x00000000746B1000-0x00000000746B3000-memory.dmp

Filesize
8KB

Download
memory/1876-61-0x0000000000080000-0x0000000000093000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing