Analysis

  • max time kernel
    150s
  • max time network
    276s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-09-2024 05:35

General

  • Target

    RFQ-2413AM-KE2800.scr

  • Size

    39KB

  • MD5

    478ace96e7cb7d671bb378dfc1be2899

  • SHA1

    dbd9954889aa460f2f69556d45cb2fbc12f9f6d1

  • SHA256

    c839d8269a32c721dda69fc174596488bf03f9d1416fd83ba822a5672c14d81e

  • SHA512

    3b1a0aad649a69e2a93ac2da557066dd9bb90d2016b2ab5a6ade12824e0c15990df55cc2284f306983926522a008879113d4679d5ca7d6f8b312f1eef66a7079

  • SSDEEP

    768:pPANMaGROq2ZKOVfpikiJUeHN9NY5ILNPshWivefeI:9YM7RSfsJWWNUrmfeI

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7371892501:AAE6c_q-yLsVj82ZZEmMuRlQtTm95MBjCz0/sendMessage?chat_id=6750192797

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3428
      • C:\Users\Admin\AppData\Local\Temp\RFQ-2413AM-KE2800.scr
        "C:\Users\Admin\AppData\Local\Temp\RFQ-2413AM-KE2800.scr" /S
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4952
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1368

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1368-1093-0x0000000075060000-0x0000000075810000-memory.dmp

      Filesize

      7.7MB

    • memory/1368-1094-0x0000000000400000-0x0000000000448000-memory.dmp

      Filesize

      288KB

    • memory/1368-1095-0x0000000005010000-0x00000000050AC000-memory.dmp

      Filesize

      624KB

    • memory/1368-1096-0x0000000075060000-0x0000000075810000-memory.dmp

      Filesize

      7.7MB

    • memory/1368-1097-0x0000000075060000-0x0000000075810000-memory.dmp

      Filesize

      7.7MB

    • memory/1368-1101-0x00000000063B0000-0x00000000063BA000-memory.dmp

      Filesize

      40KB

    • memory/1368-1100-0x00000000065F0000-0x0000000006682000-memory.dmp

      Filesize

      584KB

    • memory/1368-1099-0x00000000062A0000-0x00000000062F0000-memory.dmp

      Filesize

      320KB

    • memory/1368-1098-0x0000000006420000-0x00000000065E2000-memory.dmp

      Filesize

      1.8MB

    • memory/4952-31-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-19-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-41-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-67-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-66-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-63-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-61-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-59-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-57-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-55-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-53-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-51-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-49-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-47-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-45-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-39-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-37-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-35-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-33-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-21-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-29-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-27-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-25-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-23-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-17-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-15-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-13-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-11-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-9-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-7-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-43-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-5-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-4-0x00000000060E0000-0x00000000061C4000-memory.dmp

      Filesize

      912KB

    • memory/4952-1078-0x0000000075060000-0x0000000075810000-memory.dmp

      Filesize

      7.7MB

    • memory/4952-1079-0x00000000062E0000-0x0000000006344000-memory.dmp

      Filesize

      400KB

    • memory/4952-1080-0x00000000061D0000-0x000000000621C000-memory.dmp

      Filesize

      304KB

    • memory/4952-1084-0x0000000075060000-0x0000000075810000-memory.dmp

      Filesize

      7.7MB

    • memory/4952-1085-0x0000000075060000-0x0000000075810000-memory.dmp

      Filesize

      7.7MB

    • memory/4952-1086-0x0000000075060000-0x0000000075810000-memory.dmp

      Filesize

      7.7MB

    • memory/4952-1087-0x000000007506E000-0x000000007506F000-memory.dmp

      Filesize

      4KB

    • memory/4952-3-0x00000000060E0000-0x00000000061CA000-memory.dmp

      Filesize

      936KB

    • memory/4952-2-0x0000000075060000-0x0000000075810000-memory.dmp

      Filesize

      7.7MB

    • memory/4952-1-0x00000000009C0000-0x00000000009D0000-memory.dmp

      Filesize

      64KB

    • memory/4952-0-0x000000007506E000-0x000000007506F000-memory.dmp

      Filesize

      4KB

    • memory/4952-1088-0x0000000075060000-0x0000000075810000-memory.dmp

      Filesize

      7.7MB

    • memory/4952-1089-0x0000000006C40000-0x00000000071E4000-memory.dmp

      Filesize

      5.6MB

    • memory/4952-1090-0x0000000006540000-0x0000000006594000-memory.dmp

      Filesize

      336KB

    • memory/4952-1092-0x0000000075060000-0x0000000075810000-memory.dmp

      Filesize

      7.7MB