Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 01:55
Static task
static1
Behavioral task
behavioral1
Sample
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe
Resource
win10v2004-20240802-en
General
-
Target
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe
-
Size
1.2MB
-
MD5
2938cc0b09faea3231faae8793294cda
-
SHA1
ead974fbe630490f260ad5dfd7084d15b6afba71
-
SHA256
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474
-
SHA512
3c7c49ff85c9075287a088df92061e096eb595a01e3019ea19f2ddbc2f19602f24dbfa86b43dddd100327648ca66fdf06b9d7c2858e0fd514dff7021fee5a8b3
-
SSDEEP
24576:pRmJkcoQricOIQxiZY1iaJFsnSe5p42uVti86pa0rL2wREeTrDu:mJZoQrbTFZY1iaJFYYZti8X0/2wREezu
Malware Config
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
Password: )NYyffR0
Extracted
vipkeylogger
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
Password: )NYyffR0 - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Drops startup file 1 IoCs
Processes:
name.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe -
Executes dropped EXE 1 IoCs
Processes:
name.exepid Process 2800 name.exe -
Loads dropped DLL 1 IoCs
Processes:
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exepid Process 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 checkip.dyndns.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/files/0x00070000000193c4-4.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
name.exedescription pid Process procid_target PID 2800 set thread context of 2568 2800 name.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exename.exeRegSvcs.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language name.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid Process 2568 RegSvcs.exe 2568 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
name.exepid Process 2800 name.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid Process Token: SeDebugPrivilege 2568 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exename.exepid Process 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 2800 name.exe 2800 name.exe 2800 name.exe 2800 name.exe 2800 name.exe -
Suspicious use of SendNotifyMessage 10 IoCs
Processes:
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exename.exepid Process 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 2800 name.exe 2800 name.exe 2800 name.exe 2800 name.exe 2800 name.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exename.exedescription pid Process procid_target PID 2132 wrote to memory of 2800 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 30 PID 2132 wrote to memory of 2800 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 30 PID 2132 wrote to memory of 2800 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 30 PID 2132 wrote to memory of 2800 2132 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 30 PID 2800 wrote to memory of 2568 2800 name.exe 31 PID 2800 wrote to memory of 2568 2800 name.exe 31 PID 2800 wrote to memory of 2568 2800 name.exe 31 PID 2800 wrote to memory of 2568 2800 name.exe 31 PID 2800 wrote to memory of 2568 2800 name.exe 31 PID 2800 wrote to memory of 2568 2800 name.exe 31 PID 2800 wrote to memory of 2568 2800 name.exe 31 PID 2800 wrote to memory of 2568 2800 name.exe 31 -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe"C:\Users\Admin\AppData\Local\Temp\6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2568
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
268KB
MD50def6a985f5578404d3746ef8b8f71b5
SHA100108c510aba2b818d25edb32e448c99cb76f4f7
SHA256a9ddcd5a482a58d8c4861b243b0d40d4c6c62e6993441cf5b70a99520e690e19
SHA51229cbcaaa6767ea65a04083a76b4b95611ae353e1adc95a73ea9fd40d7dd5d0f16c124e0bd4bb2d70da407dac7484ac738cc908bb47309a64c805643db2f82a56
-
Filesize
1.2MB
MD52938cc0b09faea3231faae8793294cda
SHA1ead974fbe630490f260ad5dfd7084d15b6afba71
SHA2566b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474
SHA5123c7c49ff85c9075287a088df92061e096eb595a01e3019ea19f2ddbc2f19602f24dbfa86b43dddd100327648ca66fdf06b9d7c2858e0fd514dff7021fee5a8b3