Analysis
- max time kernel
143s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
22/08/2024, 01:35
General
- Target 62e3674255ab055706f5ecca32d8c4bc0f4cd660efd42487d15da35a5db5fbb6.exe
- Size 1.3MB
- Sample240822-bz4e4avhpk
- SHA256 62e3674255ab055706f5ecca32d8c4bc0f4cd660efd42487d15da35a5db5fbb6
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
gator3220.hostgator.com
-
Port
587
-
Username
-
Password
RaF5@@ts7^d?AE_grv4fhZ!!
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62e3674255ab055706f5ecca32d8c4bc0f4cd660efd42487d15da35a5db5fbb6.exe"C:\Users\Admin\AppData\Local\Temp\62e3674255ab055706f5ecca32d8c4bc0f4cd660efd42487d15da35a5db5fbb6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2356-0-0x00007FFE6E443000-0x00007FFE6E445000-memory.dmp
memory/2356-1-0x000002213F5F0000-0x000002213F748000-memory.dmp
memory/2356-3-0x0000022159B60000-0x0000022159C48000-memory.dmp
memory/2356-2-0x00007FFE6E440000-0x00007FFE6EF01000-memory.dmp
memory/2356-4-0x0000022159D60000-0x0000022159E48000-memory.dmp
memory/2356-26-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-54-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-56-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-68-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-66-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-64-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-62-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-60-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-58-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-52-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-50-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-48-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-46-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-44-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-42-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-39-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-36-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-32-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-30-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-28-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-41-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-34-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-22-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-14-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-8-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-24-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-20-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-18-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-16-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-12-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-10-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-6-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-5-0x0000022159D60000-0x0000022159E43000-memory.dmp
memory/2356-1077-0x00007FFE6E440000-0x00007FFE6EF01000-memory.dmp
memory/2356-1078-0x0000022159E50000-0x0000022159EB4000-memory.dmp
memory/2356-1079-0x0000022159EB0000-0x0000022159EFC000-memory.dmp
memory/2356-1083-0x00007FFE6E440000-0x00007FFE6EF01000-memory.dmp
memory/2356-1084-0x00007FFE6E440000-0x00007FFE6EF01000-memory.dmp
memory/2356-1085-0x00007FFE6E440000-0x00007FFE6EF01000-memory.dmp
memory/2356-1086-0x00007FFE6E443000-0x00007FFE6E445000-memory.dmp
memory/2356-1087-0x00007FFE6E440000-0x00007FFE6EF01000-memory.dmp
memory/2356-1089-0x000002215B1E0000-0x000002215B234000-memory.dmp
memory/2356-1091-0x00007FFE6E440000-0x00007FFE6EF01000-memory.dmp
memory/4516-1092-0x00007FFE6E440000-0x00007FFE6EF01000-memory.dmp
memory/4516-1093-0x0000000140000000-0x0000000140046000-memory.dmp
memory/4516-1094-0x00007FFE6E440000-0x00007FFE6EF01000-memory.dmp
memory/4516-1095-0x00007FFE6E440000-0x00007FFE6EF01000-memory.dmp
memory/4516-1096-0x00000217EEDA0000-0x00000217EEF62000-memory.dmp
memory/4516-1097-0x00000217D6020000-0x00000217D6070000-memory.dmp