Analysis

  • max time kernel
    298s
  • max time network
    300s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-09-2024 08:44

General

  • Target

    Swift E-Posta Bildirimi_2024-09-23_T11511900.exe

  • Size

    714KB

  • MD5

    413887cf1ae71796db2ff679fd07793a

  • SHA1

    6bd4ecd40215521c1e6cef50c0de55e74a7c7ebd

  • SHA256

    3da6c537f48990ad2f7bf459249e9ebf35aefd90d32d5b3f41c2528f1d0e4556

  • SHA512

    09d66c79c360b41682ecca209cfa6e278823836d6f3bd415b7e13fc6c18ba7bbd7f0ba955620d1534cb2a402ec843bbdeca8c82adb8e4129acd9e7c53d5493ba

  • SSDEEP

    12288:uN+7mnL4M7jDAmAx54q+aW+DakNVgP+lEJqMQwecBwLutNQVlY/tjIHb877a8bQb:uQKvAmAj4qFRDxLg1nhBwQ6G/CbO7pI

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    quicklyserv.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    omobolajijonze12345

Extracted

Family

vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Swift E-Posta Bildirimi_2024-09-23_T11511900.exe
    "C:\Users\Admin\AppData\Local\Temp\Swift E-Posta Bildirimi_2024-09-23_T11511900.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3944
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Swift E-Posta Bildirimi_2024-09-23_T11511900.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2432
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\lFICHHVpiKsD.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:780
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\lFICHHVpiKsD" /XML "C:\Users\Admin\AppData\Local\Temp\tmpADEE.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2824
    • C:\Users\Admin\AppData\Local\Temp\Swift E-Posta Bildirimi_2024-09-23_T11511900.exe
      "C:\Users\Admin\AppData\Local\Temp\Swift E-Posta Bildirimi_2024-09-23_T11511900.exe"
      2⤵
        PID:1228
      • C:\Users\Admin\AppData\Local\Temp\Swift E-Posta Bildirimi_2024-09-23_T11511900.exe
        "C:\Users\Admin\AppData\Local\Temp\Swift E-Posta Bildirimi_2024-09-23_T11511900.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • outlook_office_path
        • outlook_win_path
        PID:2764
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3924,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
      1⤵
        PID:4332

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Swift E-Posta Bildirimi_2024-09-23_T11511900.exe.log

        Filesize

        1KB

        MD5

        8ec831f3e3a3f77e4a7b9cd32b48384c

        SHA1

        d83f09fd87c5bd86e045873c231c14836e76a05c

        SHA256

        7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

        SHA512

        26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

        Filesize

        2KB

        MD5

        3d086a433708053f9bf9523e1d87a4e8

        SHA1

        b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

        SHA256

        6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

        SHA512

        931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        18KB

        MD5

        5bd58764549044966c90f27e91c0a4a2

        SHA1

        f2eb1e218d004ef04c2dd961e260e3a9bcd6cac4

        SHA256

        27e4870d98205b3117c997c53bd27da60041f25613f4808839add1ab51b7f9fc

        SHA512

        1725a71806f323167e6f9b0e78c46beaa616c35b593afa4bdf5e84338d48a5168548d5c9b5772ca5e7bb60116d5e4f31fb33efe659c1aac4c3dbf5eeddb7cae7

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jp1qjctx.vmt.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\tmpADEE.tmp

        Filesize

        1KB

        MD5

        fbfc0f6ef83ad563042730ffd5c42a88

        SHA1

        4e16ebf253492362f082a93d7fecfdd5d5164160

        SHA256

        ff0796d00c440ecff66ae7431ec488abf3b54ba429963d0bbfb1c2e7a6ac15da

        SHA512

        c86390c6ddc2484bc720c98d3f7c29f83eae1085de1d209131285afc1669ed63935e4cd8592bcd53a08f962e65fcedc47db98cf441a816259d53eb63d1e940df

      • memory/780-79-0x00000000074F0000-0x0000000007501000-memory.dmp

        Filesize

        68KB

      • memory/780-80-0x0000000007520000-0x000000000752E000-memory.dmp

        Filesize

        56KB

      • memory/780-65-0x0000000071210000-0x000000007125C000-memory.dmp

        Filesize

        304KB

      • memory/780-49-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB

      • memory/780-46-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB

      • memory/780-82-0x0000000007630000-0x000000000764A000-memory.dmp

        Filesize

        104KB

      • memory/780-89-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB

      • memory/780-23-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB

      • memory/2432-48-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB

      • memory/2432-81-0x0000000007B90000-0x0000000007BA4000-memory.dmp

        Filesize

        80KB

      • memory/2432-17-0x0000000005730000-0x0000000005D58000-memory.dmp

        Filesize

        6.2MB

      • memory/2432-16-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB

      • memory/2432-90-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB

      • memory/2432-15-0x00000000050C0000-0x00000000050F6000-memory.dmp

        Filesize

        216KB

      • memory/2432-22-0x0000000005FF0000-0x0000000006056000-memory.dmp

        Filesize

        408KB

      • memory/2432-21-0x0000000005ED0000-0x0000000005F36000-memory.dmp

        Filesize

        408KB

      • memory/2432-20-0x0000000005670000-0x0000000005692000-memory.dmp

        Filesize

        136KB

      • memory/2432-83-0x0000000007C70000-0x0000000007C78000-memory.dmp

        Filesize

        32KB

      • memory/2432-18-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB

      • memory/2432-78-0x0000000007BD0000-0x0000000007C66000-memory.dmp

        Filesize

        600KB

      • memory/2432-77-0x00000000079C0000-0x00000000079CA000-memory.dmp

        Filesize

        40KB

      • memory/2432-37-0x0000000006060000-0x00000000063B4000-memory.dmp

        Filesize

        3.3MB

      • memory/2432-76-0x0000000007950000-0x000000000796A000-memory.dmp

        Filesize

        104KB

      • memory/2432-50-0x0000000006620000-0x000000000663E000-memory.dmp

        Filesize

        120KB

      • memory/2432-51-0x00000000066D0000-0x000000000671C000-memory.dmp

        Filesize

        304KB

      • memory/2432-52-0x00000000075C0000-0x00000000075F2000-memory.dmp

        Filesize

        200KB

      • memory/2432-63-0x00000000075A0000-0x00000000075BE000-memory.dmp

        Filesize

        120KB

      • memory/2432-53-0x0000000071210000-0x000000007125C000-memory.dmp

        Filesize

        304KB

      • memory/2432-64-0x0000000007610000-0x00000000076B3000-memory.dmp

        Filesize

        652KB

      • memory/2432-75-0x0000000007F90000-0x000000000860A000-memory.dmp

        Filesize

        6.5MB

      • memory/2764-29-0x0000000000400000-0x000000000044A000-memory.dmp

        Filesize

        296KB

      • memory/2764-93-0x0000000007540000-0x0000000007A6C000-memory.dmp

        Filesize

        5.2MB

      • memory/2764-92-0x0000000006CD0000-0x0000000006D20000-memory.dmp

        Filesize

        320KB

      • memory/2764-91-0x0000000006E40000-0x0000000007002000-memory.dmp

        Filesize

        1.8MB

      • memory/3944-6-0x0000000005300000-0x0000000005312000-memory.dmp

        Filesize

        72KB

      • memory/3944-5-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB

      • memory/3944-9-0x0000000008CE0000-0x0000000008D74000-memory.dmp

        Filesize

        592KB

      • memory/3944-4-0x0000000005020000-0x000000000502A000-memory.dmp

        Filesize

        40KB

      • memory/3944-10-0x000000000B540000-0x000000000B5DC000-memory.dmp

        Filesize

        624KB

      • memory/3944-3-0x0000000005030000-0x00000000050C2000-memory.dmp

        Filesize

        584KB

      • memory/3944-2-0x0000000005700000-0x0000000005CA4000-memory.dmp

        Filesize

        5.6MB

      • memory/3944-1-0x00000000005A0000-0x0000000000658000-memory.dmp

        Filesize

        736KB

      • memory/3944-7-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

        Filesize

        4KB

      • memory/3944-47-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB

      • memory/3944-0-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

        Filesize

        4KB

      • memory/3944-8-0x0000000074B70000-0x0000000075320000-memory.dmp

        Filesize

        7.7MB