Analysis

  • max time kernel
    115s
  • max time network
    117s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-09-2024 06:33

General

  • Target

    P.O COPY USDFOB455EXCEL.exe

  • Size

    1.3MB

  • MD5

    850b1ff6b75f4422ad65d04ce4355ad0

  • SHA1

    5dd4b213e8c9e0bea6459c6955637019a6e1255d

  • SHA256

    12b5956bedc7c8e90f93616e91346b481754f0347bcd2cddd98c770bb143a92b

  • SHA512

    2e64488e2bdc393496e5417d3b5fbd8c7c98d732e7b4c4f5eeff669ec46d463aeb9366e57d4763e92ee85a977b105832c3c15460cff18e0c8fda391699ffcf51

  • SSDEEP

    24576:sRmJkcoQricOIQxiZY1iaQwiRv+PqpjMpIq4YDjX3mZsIHh:5JZoQrbTFZY1iaQ5v+PqKpbfvX3/IB

Malware Config

Extracted

Family

vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 11 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\P.O COPY USDFOB455EXCEL.exe
    "C:\Users\Admin\AppData\Local\Temp\P.O COPY USDFOB455EXCEL.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3292
    • C:\Users\Admin\AppData\Local\directory\name.exe
      "C:\Users\Admin\AppData\Local\Temp\P.O COPY USDFOB455EXCEL.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Users\Admin\AppData\Local\Temp\P.O COPY USDFOB455EXCEL.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nondefinition

    Filesize

    268KB

    MD5

    8ef47999414840e89726b5588637e3a9

    SHA1

    97caf4fc7f8d9e07205004d2a8e116500b7b7a03

    SHA256

    090183bd5491892271fba49bdde1ba4cf10b9ade9bb7ac184d3e584bc5c5b5b6

    SHA512

    774610d1277fb8d75f8e2e27a63d432f3f3abf534f87e2368bed24f616e95ec7eaaa79fdc3df40d824db5f97b1b0abd7a1e4d175c17c0377490b85b8f964186a

  • C:\Users\Admin\AppData\Local\directory\name.exe

    Filesize

    1.3MB

    MD5

    850b1ff6b75f4422ad65d04ce4355ad0

    SHA1

    5dd4b213e8c9e0bea6459c6955637019a6e1255d

    SHA256

    12b5956bedc7c8e90f93616e91346b481754f0347bcd2cddd98c770bb143a92b

    SHA512

    2e64488e2bdc393496e5417d3b5fbd8c7c98d732e7b4c4f5eeff669ec46d463aeb9366e57d4763e92ee85a977b105832c3c15460cff18e0c8fda391699ffcf51

  • memory/1344-17-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

    Filesize

    4KB

  • memory/1344-12-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/1344-13-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

    Filesize

    4KB

  • memory/1344-14-0x0000000005940000-0x0000000005EE4000-memory.dmp

    Filesize

    5.6MB

  • memory/1344-15-0x0000000005290000-0x000000000532C000-memory.dmp

    Filesize

    624KB

  • memory/1344-16-0x0000000074A20000-0x00000000751D0000-memory.dmp

    Filesize

    7.7MB

  • memory/1344-18-0x0000000074A20000-0x00000000751D0000-memory.dmp

    Filesize

    7.7MB

  • memory/1344-19-0x0000000006700000-0x00000000068C2000-memory.dmp

    Filesize

    1.8MB

  • memory/1344-20-0x0000000006580000-0x00000000065D0000-memory.dmp

    Filesize

    320KB

  • memory/1344-21-0x00000000068D0000-0x0000000006962000-memory.dmp

    Filesize

    584KB

  • memory/1344-22-0x00000000069D0000-0x00000000069DA000-memory.dmp

    Filesize

    40KB

  • memory/1820-10-0x0000000003F90000-0x0000000004390000-memory.dmp

    Filesize

    4.0MB

  • memory/3292-2-0x0000000004340000-0x0000000004740000-memory.dmp

    Filesize

    4.0MB