Overview
overview
7Static
static
7RedVIP5Rel...88.exe
windows7-x64
7RedVIP5Rel...88.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3DLLCLT.dll
windows7-x64
3DLLCLT.dll
windows10-2004-x64
3DownLoad/attrib.exe
windows7-x64
3DownLoad/attrib.exe
windows10-2004-x64
3DownLoad/rar.exe
windows7-x64
3DownLoad/rar.exe
windows10-2004-x64
3McuFlash/Download.exe
windows7-x64
3McuFlash/Download.exe
windows10-2004-x64
3RedVIPControls.dll
windows7-x64
3RedVIPControls.dll
windows10-2004-x64
3VIP.exe
windows7-x64
4VIP.exe
windows10-2004-x64
4VIPExec.exe
windows7-x64
3VIPExec.exe
windows10-2004-x64
3VIPUpdate.exe
windows7-x64
3VIPUpdate.exe
windows10-2004-x64
3VPADLL.dll
windows7-x64
3VPADLL.dll
windows10-2004-x64
3VPVDLL.dll
windows7-x64
3VPVDLL.dll
windows10-2004-x64
3advert/ad_mcu.html
windows7-x64
3advert/ad_mcu.html
windows10-2004-x64
3divx.dll
windows7-x64
3divx.dll
windows10-2004-x64
3Analysis
-
max time kernel
94s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2024 01:03
Behavioral task
behavioral1
Sample
RedVIP5Release_91502088.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
RedVIP5Release_91502088.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
DLLCLT.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
DLLCLT.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
DownLoad/attrib.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
DownLoad/attrib.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
DownLoad/rar.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
DownLoad/rar.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
McuFlash/Download.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
McuFlash/Download.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
RedVIPControls.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
RedVIPControls.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
VIP.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
VIP.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
VIPExec.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
VIPExec.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
VIPUpdate.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
VIPUpdate.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
VPADLL.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
VPADLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
VPVDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
VPVDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
advert/ad_mcu.html
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
advert/ad_mcu.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
divx.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
divx.dll
Resource
win10v2004-20240802-en
General
-
Target
VIP.exe
-
Size
814KB
-
MD5
e23aac527fcc2f5856c7435aacbf1cad
-
SHA1
867498c41f6b43aabf70eb612ce4d0b4aaa75739
-
SHA256
e5afc3b73e6262349dcdd8060810da309324b0ccbdaadefba0cd4847dc7e0d19
-
SHA512
bf86e9fa8beb1d4a01d6c9ab799a151571950d89fa3c53570240c6d904515063b687e141037b50da550bf62287c886465f653432689eaa0676262f3f100ae54c
-
SSDEEP
12288:ihHsnpEQyLL2Y1sbXbd1g3PnvTcjTknYjladX9rGYSAucdkZR777:iJsnLyebYvvTcvYKYD
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\VIP.INI VIP.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VIP.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3928 VIP.exe 3928 VIP.exe 3928 VIP.exe 3928 VIP.exe 3928 VIP.exe