Analysis
-
max time kernel
119s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
05-09-2024 12:13
General
-
Target
New Order Inquiry Maiden Med Sept 2024 #287772.exe
-
Size
769KB
-
MD5
c647aab9bb0c4b04a5d15c5d5b4ca4ee
-
SHA1
b94ba0911d7f3addbd1a262de11df13096bb51c4
-
SHA256
eaf84feb50c9fb9957f022597cccf2e343e04fbde288838e64c4fd6513301289
-
SHA512
c0179b98f3b2e40d698a4c408068308c312e026eb5d1f590b0120cb7368761c7a2a2195fb72d252c3d9bc4d41d9ddf9aa717dd3299b191038118a525f102ae1d
-
SSDEEP
12288:unU1UoIG5MPUwBZiAhmug2hF3evSXAF1i1GbnPg82bTGEkJ42qWQ2gi7nWI58wXY:zUobyZdhF3eyAXbUGhkynztlXJbga
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7204444211:AAHhCv47hRiqEWkkF-hzrMRRq69HpYbFD5Y/sendMessage?chat_id=2065242915
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order Inquiry Maiden Med Sept 2024 #287772.exe"C:\Users\Admin\AppData\Local\Temp\New Order Inquiry Maiden Med Sept 2024 #287772.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
792KB
-
Filesize
6.9MB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
560KB
-
Filesize
6.9MB
-
Filesize
296KB
-
Filesize
6.9MB
-
Filesize
296KB
-
Filesize
4KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB