Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2024 01:55
Static task
static1
Behavioral task
behavioral1
Sample
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe
Resource
win10v2004-20240802-en
General
-
Target
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe
-
Size
1.2MB
-
MD5
2938cc0b09faea3231faae8793294cda
-
SHA1
ead974fbe630490f260ad5dfd7084d15b6afba71
-
SHA256
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474
-
SHA512
3c7c49ff85c9075287a088df92061e096eb595a01e3019ea19f2ddbc2f19602f24dbfa86b43dddd100327648ca66fdf06b9d7c2858e0fd514dff7021fee5a8b3
-
SSDEEP
24576:pRmJkcoQricOIQxiZY1iaJFsnSe5p42uVti86pa0rL2wREeTrDu:mJZoQrbTFZY1iaJFYYZti8X0/2wREezu
Malware Config
Extracted
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
Password: )NYyffR0
Extracted
vipkeylogger
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
Password: )NYyffR0 - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Drops startup file 1 IoCs
Processes:
name.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe -
Executes dropped EXE 1 IoCs
Processes:
name.exepid Process 4796 name.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 checkip.dyndns.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/files/0x0007000000023436-5.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
name.exedescription pid Process procid_target PID 4796 set thread context of 1100 4796 name.exe 83 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exename.exeRegSvcs.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language name.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid Process 1100 RegSvcs.exe 1100 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
name.exepid Process 4796 name.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid Process Token: SeDebugPrivilege 1100 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exename.exepid Process 4952 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 4952 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 4952 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 4952 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 4952 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 4796 name.exe 4796 name.exe 4796 name.exe 4796 name.exe 4796 name.exe -
Suspicious use of SendNotifyMessage 10 IoCs
Processes:
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exename.exepid Process 4952 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 4952 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 4952 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 4952 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 4952 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 4796 name.exe 4796 name.exe 4796 name.exe 4796 name.exe 4796 name.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exename.exedescription pid Process procid_target PID 4952 wrote to memory of 4796 4952 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 82 PID 4952 wrote to memory of 4796 4952 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 82 PID 4952 wrote to memory of 4796 4952 6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe 82 PID 4796 wrote to memory of 1100 4796 name.exe 83 PID 4796 wrote to memory of 1100 4796 name.exe 83 PID 4796 wrote to memory of 1100 4796 name.exe 83 PID 4796 wrote to memory of 1100 4796 name.exe 83 -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe"C:\Users\Admin\AppData\Local\Temp\6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4952 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\6b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1100
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
268KB
MD50def6a985f5578404d3746ef8b8f71b5
SHA100108c510aba2b818d25edb32e448c99cb76f4f7
SHA256a9ddcd5a482a58d8c4861b243b0d40d4c6c62e6993441cf5b70a99520e690e19
SHA51229cbcaaa6767ea65a04083a76b4b95611ae353e1adc95a73ea9fd40d7dd5d0f16c124e0bd4bb2d70da407dac7484ac738cc908bb47309a64c805643db2f82a56
-
Filesize
1.2MB
MD52938cc0b09faea3231faae8793294cda
SHA1ead974fbe630490f260ad5dfd7084d15b6afba71
SHA2566b936382994c74fa35aadd7655ea89a20f4ca8ddde9c651f4f6287679979f474
SHA5123c7c49ff85c9075287a088df92061e096eb595a01e3019ea19f2ddbc2f19602f24dbfa86b43dddd100327648ca66fdf06b9d7c2858e0fd514dff7021fee5a8b3