vipkeylogger | eaf84feb50c9fb9957f022597cccf2e343e04fbde288838e64c4fd6513301289

General

Target

New Order Inquiry Maiden Med Sept 2024 #287772.exe
Size

769KB
MD5

c647aab9bb0c4b04a5d15c5d5b4ca4ee
SHA1

b94ba0911d7f3addbd1a262de11df13096bb51c4
SHA256

eaf84feb50c9fb9957f022597cccf2e343e04fbde288838e64c4fd6513301289
SHA512

c0179b98f3b2e40d698a4c408068308c312e026eb5d1f590b0120cb7368761c7a2a2195fb72d252c3d9bc4d41d9ddf9aa717dd3299b191038118a525f102ae1d
SSDEEP

12288:unU1UoIG5MPUwBZiAhmug2hF3evSXAF1i1GbnPg82bTGEkJ42qWQ2gi7nWI58wXY:zUobyZdhF3eyAXbUGhkynztlXJbga

Score

10^/10

vipkeylogger collection credential_access discovery keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7204444211:AAHhCv47hRiqEWkkF-hzrMRRq69HpYbFD5Y/sendMessage?chat_id=2065242915

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2600 set thread context of 2544	2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe	94

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Order Inquiry Maiden Med Sept 2024 #287772.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe
2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe
2544	MSBuild.exe
2544	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe
Token: SeDebugPrivilege	2544	MSBuild.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3272	2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe	93
PID 2600 wrote to memory of 3272	2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe	93
PID 2600 wrote to memory of 3272	2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe	93
PID 2600 wrote to memory of 2544	2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe	94
PID 2600 wrote to memory of 2544	2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe	94
PID 2600 wrote to memory of 2544	2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe	94
PID 2600 wrote to memory of 2544	2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe	94
PID 2600 wrote to memory of 2544	2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe	94
PID 2600 wrote to memory of 2544	2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe	94
PID 2600 wrote to memory of 2544	2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe	94
PID 2600 wrote to memory of 2544	2600	New Order Inquiry Maiden Med Sept 2024 #287772.exe	94

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\New Order Inquiry Maiden Med Sept 2024 #287772.exe
"C:\Users\Admin\AppData\Local\Temp\New Order Inquiry Maiden Med Sept 2024 #287772.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:3272
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2544-11-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2544-20-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/2544-19-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/2544-18-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/2544-17-0x0000000006A70000-0x0000000006AC0000-memory.dmp

Filesize
320KB

Download
memory/2544-16-0x0000000006BD0000-0x0000000006D92000-memory.dmp

Filesize
1.8MB

Download
memory/2544-15-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/2544-13-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/2600-5-0x0000000005BD0000-0x0000000005BDA000-memory.dmp

Filesize
40KB

Download
memory/2600-9-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/2600-10-0x0000000007170000-0x00000000071FC000-memory.dmp

Filesize
560KB

Download
memory/2600-8-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

Filesize
4KB

Download
memory/2600-7-0x0000000005E70000-0x0000000005E88000-memory.dmp

Filesize
96KB

Download
memory/2600-14-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/2600-6-0x0000000005CB0000-0x0000000005D4C000-memory.dmp

Filesize
624KB

Download
memory/2600-0-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

Filesize
4KB

Download
memory/2600-4-0x0000000074B70000-0x0000000075320000-memory.dmp

Filesize
7.7MB

Download
memory/2600-3-0x0000000005A40000-0x0000000005AD2000-memory.dmp

Filesize
584KB

Download
memory/2600-2-0x0000000005F50000-0x00000000064F4000-memory.dmp

Filesize
5.6MB

Download
memory/2600-1-0x0000000000FA0000-0x0000000001066000-memory.dmp

Filesize
792KB

Download

Analysis

Sharing