Analysis
-
max time kernel
122s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 07:43
Static task
static1
Behavioral task
behavioral1
Sample
27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe
Resource
win10v2004-20240802-en
General
-
Target
27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe
-
Size
703KB
-
MD5
d48a40e1ebe635d7368017c6fe020f09
-
SHA1
3c66aa4de1f6d27f5ac9c01eae8f92bda4ba2417
-
SHA256
27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea
-
SHA512
d0c8e024c3ed345b2a1dead2d524c93b04da95ea41dbbd7c2f7e1114def9440f9308918366e0febec22b385aece156dc1853b7f71fbe7cb82cbfa9e89ada3a56
-
SSDEEP
12288:9dOsd0DUdUAum4zaLLp/Jy+ft1be4qcWsAXxcnrC/bZQMglIMw5:Csd0IdT4GLFxy+lIpD6uNoIt
Malware Config
Extracted
Protocol: smtp- Host:
smtp.ionos.fr - Port:
587 - Username:
[email protected] - Password:
Rajahsouthfruits5
Extracted
vipkeylogger
Protocol: smtp- Host:
smtp.ionos.fr - Port:
587 - Username:
[email protected] - Password:
Rajahsouthfruits5 - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid Process 1624 powershell.exe 852 powershell.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exedescription pid Process procid_target PID 2868 set thread context of 3036 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exepowershell.exepowershell.exeschtasks.exe27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exepowershell.exepowershell.exepid Process 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 3036 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 1624 powershell.exe 852 powershell.exe 3036 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exepowershell.exepowershell.exedescription pid Process Token: SeDebugPrivilege 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe Token: SeDebugPrivilege 3036 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe Token: SeDebugPrivilege 852 powershell.exe Token: SeDebugPrivilege 1624 powershell.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exedescription pid Process procid_target PID 2868 wrote to memory of 1624 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 28 PID 2868 wrote to memory of 1624 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 28 PID 2868 wrote to memory of 1624 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 28 PID 2868 wrote to memory of 1624 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 28 PID 2868 wrote to memory of 852 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 30 PID 2868 wrote to memory of 852 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 30 PID 2868 wrote to memory of 852 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 30 PID 2868 wrote to memory of 852 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 30 PID 2868 wrote to memory of 2268 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 32 PID 2868 wrote to memory of 2268 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 32 PID 2868 wrote to memory of 2268 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 32 PID 2868 wrote to memory of 2268 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 32 PID 2868 wrote to memory of 3036 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 34 PID 2868 wrote to memory of 3036 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 34 PID 2868 wrote to memory of 3036 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 34 PID 2868 wrote to memory of 3036 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 34 PID 2868 wrote to memory of 3036 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 34 PID 2868 wrote to memory of 3036 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 34 PID 2868 wrote to memory of 3036 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 34 PID 2868 wrote to memory of 3036 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 34 PID 2868 wrote to memory of 3036 2868 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe 34 -
outlook_office_path 1 IoCs
Processes:
27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe -
outlook_win_path 1 IoCs
Processes:
27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe"C:\Users\Admin\AppData\Local\Temp\27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fqroOm.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fqroOm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBAC7.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2268
-
-
C:\Users\Admin\AppData\Local\Temp\27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe"C:\Users\Admin\AppData\Local\Temp\27336a02b8be0e210cae46d680509f78bff16d64f653925b55a11cc837341eea.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3036
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD5e36ae30401ff61859e0d15183806727d
SHA1c1bb1e2916913d067a1d3eb99ecf80710decf05f
SHA25641a6fcbfc7e038e5141dff0be12a54a63b3326b4494f7f67dc2552477073824e
SHA512f36ed6a65b392e96ec10bf792a30d5b2f35441f3b5b25fc108124aa2d78a1236c7ca150bd9fef868ed635e87b81479a49df40c546d8716002f3cb7df6a31cc5a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD56a61048e9f1eaa746a70ffee4e24640e
SHA18821a290ea1917e6b3bd9a2856560e6372df3aff
SHA256cbe05f075a6242eb5a3807825e47dcec89d67102386b922439bf418d77b01c1e
SHA512f94fc80d958d88905022cb8f8c03eaefc06e6b46fa3ce1e5ac4ae66f61a0316594bd3ff8ecb792d032e72cfe05a03a610b6b72e756b5b1fb8d801b2012daf94b