Analysis
- max time kernel
132s - max time network
120s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
02/10/2024, 11:41
General
- Target 30092463687563.docx
- Size 264KB
- Sample241002-ntwvaayakc
- SHA256 97a4fe736ddd0955e218e7f7fb00d2fddee7896db60aa90e175b4824c9192825
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
hosting2.ro.hostsailor.com
-
Port
587
-
Username
-
Password
7213575aceACE@@
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Blocklisted process makes network request 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Abuses OpenXML format to download file from external location
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Office loads VBA resources, possible macro or embedded object present
- Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\30092463687563.docx"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wealtken20309.exe"C:\Users\Admin\AppData\Roaming\wealtken20309.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wealtken20309.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\wealtken20309.exe"C:\Users\Admin\AppData\Roaming\wealtken20309.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Exploitation for Client Execution
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
FSD-CNRY.FSD
FSD-{96E47E6C-170C-4C3F-98E1-D8B9A741D571}.FSD
wealthzxcv[1].doc
{5A2B2299-D02A-4F34-8FA6-5E382910A6BE}
index.dat
ExcludeDictionaryEN0409.lex
wealtken20309.exe
memory/2004-96-0x0000000000270000-0x000000000028E000-memory.dmp
memory/2004-94-0x00000000010D0000-0x00000000011AC000-memory.dmp
memory/2004-104-0x0000000000440000-0x00000000004CA000-memory.dmp
memory/2252-2-0x0000000070CCD000-0x0000000070CD8000-memory.dmp
memory/2252-0-0x000000002F381000-0x000000002F382000-memory.dmp
memory/2252-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2252-103-0x0000000070CCD000-0x0000000070CD8000-memory.dmp
memory/2568-105-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2568-118-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2568-116-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2568-114-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2568-113-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2568-111-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2568-109-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2568-107-0x0000000000400000-0x0000000000448000-memory.dmp