Analysis
-
max time kernel
84s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 03:51
Static task
static1
Behavioral task
behavioral1
Sample
fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe
Resource
win10v2004-20240802-en
General
-
Target
fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe
-
Size
1.2MB
-
MD5
788799e671e3a59bc0776d760511992a
-
SHA1
612ae251d122782aeb8f47479a650e8881cc6bc8
-
SHA256
fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551
-
SHA512
55732156573ddf95344702fdf519a45a04f9b8160d377491035a91eec45df46ae37f33784560cb8fb4768898e3b36a9171926b912457d81746d0776396799a79
-
SSDEEP
24576:pRmJkcoQricOIQxiZY1iaVzKSfvLt8vhBT+MEFn7acEP0bMCe:mJZoQrbTFZY1iaV2mj8xw7YBCe
Malware Config
Extracted
vipkeylogger
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exedescription pid Process procid_target PID 2116 set thread context of 3032 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 2852 3032 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exeRegSvcs.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegSvcs.exepid Process 3032 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exepid Process 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid Process Token: SeDebugPrivilege 3032 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exepid Process 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exepid Process 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exeRegSvcs.exedescription pid Process procid_target PID 2116 wrote to memory of 3032 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 29 PID 2116 wrote to memory of 3032 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 29 PID 2116 wrote to memory of 3032 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 29 PID 2116 wrote to memory of 3032 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 29 PID 2116 wrote to memory of 3032 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 29 PID 2116 wrote to memory of 3032 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 29 PID 2116 wrote to memory of 3032 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 29 PID 2116 wrote to memory of 3032 2116 fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe 29 PID 3032 wrote to memory of 2852 3032 RegSvcs.exe 30 PID 3032 wrote to memory of 2852 3032 RegSvcs.exe 30 PID 3032 wrote to memory of 2852 3032 RegSvcs.exe 30 PID 3032 wrote to memory of 2852 3032 RegSvcs.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe"C:\Users\Admin\AppData\Local\Temp\fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\fb8591420d16f45c6d4a6b2e5908aedb1836bb8437718a228926d80f3ed24551.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 10723⤵
- Program crash
PID:2852
-
-