Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29/08/2024, 15:31
Behavioral task
behavioral1
Sample
SALE08765567800T.doc.zip
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
SALE08765567800T.doc.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
SALE08765567800T.scr
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
SALE08765567800T.scr
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
out.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
out.exe
Resource
win10v2004-20240802-en
General
-
Target
SALE08765567800T.scr
-
Size
743KB
-
MD5
e9f5c88ac891da1d0beccbd87d5e019d
-
SHA1
f967099f11090fb9f8aada10189211c98b777a0d
-
SHA256
9c6b53051039e6e3ada670ef5c591e69e3cadae46b3e78510cadb800d2379840
-
SHA512
ebdfe47786bec52aaf399b35a174a05f5840d7897f85de979953b36f1611ebfe47744ab4e74dd77eefbb28525cebd64c8bfe5948ad842460c19907c649dcdb28
-
SSDEEP
12288:COv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPidw/3SKkypQquMKAWy:Cq5TfcdHj4fmb4a3SKaoR
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendMessage?chat_id=6443825857
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hymenophyllaceae.vbs Hymenophyllaceae.exe -
Executes dropped EXE 1 IoCs
pid Process 2648 Hymenophyllaceae.exe -
Loads dropped DLL 1 IoCs
pid Process 1628 SALE08765567800T.scr -
resource yara_rule behavioral3/memory/1628-0-0x0000000000290000-0x0000000000435000-memory.dmp upx behavioral3/files/0x0008000000016d89-14.dat upx behavioral3/memory/2648-21-0x0000000000110000-0x00000000002B5000-memory.dmp upx behavioral3/memory/1628-18-0x0000000000290000-0x0000000000435000-memory.dmp upx behavioral3/memory/2648-36-0x0000000000110000-0x00000000002B5000-memory.dmp upx behavioral3/memory/2648-42-0x0000000000110000-0x00000000002B5000-memory.dmp upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe Key opened \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe Key opened \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral3/memory/1628-18-0x0000000000290000-0x0000000000435000-memory.dmp autoit_exe behavioral3/memory/2648-36-0x0000000000110000-0x00000000002B5000-memory.dmp autoit_exe behavioral3/memory/2648-42-0x0000000000110000-0x00000000002B5000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2648 set thread context of 1800 2648 Hymenophyllaceae.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SALE08765567800T.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hymenophyllaceae.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1800 svchost.exe 1800 svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2648 Hymenophyllaceae.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1800 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1628 SALE08765567800T.scr 1628 SALE08765567800T.scr 2648 Hymenophyllaceae.exe 2648 Hymenophyllaceae.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1628 SALE08765567800T.scr 1628 SALE08765567800T.scr 2648 Hymenophyllaceae.exe 2648 Hymenophyllaceae.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1628 wrote to memory of 2648 1628 SALE08765567800T.scr 30 PID 1628 wrote to memory of 2648 1628 SALE08765567800T.scr 30 PID 1628 wrote to memory of 2648 1628 SALE08765567800T.scr 30 PID 1628 wrote to memory of 2648 1628 SALE08765567800T.scr 30 PID 2648 wrote to memory of 1800 2648 Hymenophyllaceae.exe 31 PID 2648 wrote to memory of 1800 2648 Hymenophyllaceae.exe 31 PID 2648 wrote to memory of 1800 2648 Hymenophyllaceae.exe 31 PID 2648 wrote to memory of 1800 2648 Hymenophyllaceae.exe 31 PID 2648 wrote to memory of 1800 2648 Hymenophyllaceae.exe 31 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SALE08765567800T.scr"C:\Users\Admin\AppData\Local\Temp\SALE08765567800T.scr" /S1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\extrorsal\Hymenophyllaceae.exe"C:\Users\Admin\AppData\Local\Temp\SALE08765567800T.scr" /S2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\SALE08765567800T.scr" /S3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1800
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD544086d7a46f74b283701e6ae5e9baee3
SHA1b0a44d968b0cb91f4f4f2b87369e3f40cbb7e3e0
SHA256f62211bd921aea032d47294694e68376002dacec12b8e6b44ebd3d9350043a15
SHA51257b094bb14ab82b26c347c01cedffcbd7cc768e8ef1ef765767393a83af950f2fc9d14df2ce3934ed6858336d6e0dff8369a5be33714dc2c70ce78fbaa0c0026
-
Filesize
743KB
MD5e9f5c88ac891da1d0beccbd87d5e019d
SHA1f967099f11090fb9f8aada10189211c98b777a0d
SHA2569c6b53051039e6e3ada670ef5c591e69e3cadae46b3e78510cadb800d2379840
SHA512ebdfe47786bec52aaf399b35a174a05f5840d7897f85de979953b36f1611ebfe47744ab4e74dd77eefbb28525cebd64c8bfe5948ad842460c19907c649dcdb28