Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 02:07
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION_AUGQTRA071244PDF.scr
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
QUOTATION_AUGQTRA071244PDF.scr
Resource
win10v2004-20240802-en
General
-
Target
QUOTATION_AUGQTRA071244PDF.scr
-
Size
368KB
-
MD5
4254466206b939b825d0957307eb877d
-
SHA1
329c84f27a03b13f06acc770dea9da958e0a4bd6
-
SHA256
5817c5243b268da19c1772864360db3d72eaf7f5d0d870d1e0de973f159ca7b5
-
SHA512
f57f9f9e89526cbe9bac7550b46158c857d18314d13e397d64b4a4702e45fc43f4226efef0818f4878aeb6fe66776091341d637c5c90e713706e5c3ca219e126
-
SSDEEP
384:DSuXuZfTHd3nyEVPTHWKtL2H0VuM35zlQEew+yTzSf4JM54iICSCr4H444uiiiLP:5eNTHBnyAWkaHRQMwdz+4H4447iiL1w
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
investms.vadavo.cloud - Port:
587 - Username:
[email protected] - Password:
OBri#75@ts*!3i_$y7pteB^ob - Email To:
[email protected]
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4244 created 3444 4244 QUOTATION_AUGQTRA071244PDF.scr 56 -
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 47 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4244 set thread context of 2632 4244 QUOTATION_AUGQTRA071244PDF.scr 97 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4244 QUOTATION_AUGQTRA071244PDF.scr 4244 QUOTATION_AUGQTRA071244PDF.scr 4244 QUOTATION_AUGQTRA071244PDF.scr 4244 QUOTATION_AUGQTRA071244PDF.scr 2632 aspnet_compiler.exe 2632 aspnet_compiler.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4244 QUOTATION_AUGQTRA071244PDF.scr Token: SeDebugPrivilege 4244 QUOTATION_AUGQTRA071244PDF.scr Token: SeDebugPrivilege 2632 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4244 wrote to memory of 2632 4244 QUOTATION_AUGQTRA071244PDF.scr 97 PID 4244 wrote to memory of 2632 4244 QUOTATION_AUGQTRA071244PDF.scr 97 PID 4244 wrote to memory of 2632 4244 QUOTATION_AUGQTRA071244PDF.scr 97 PID 4244 wrote to memory of 2632 4244 QUOTATION_AUGQTRA071244PDF.scr 97 PID 4244 wrote to memory of 2632 4244 QUOTATION_AUGQTRA071244PDF.scr 97 PID 4244 wrote to memory of 2632 4244 QUOTATION_AUGQTRA071244PDF.scr 97 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION_AUGQTRA071244PDF.scr"C:\Users\Admin\AppData\Local\Temp\QUOTATION_AUGQTRA071244PDF.scr" /S2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2632
-