Analysis

  • max time kernel
    146s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-10-2024 13:29

General

  • Target

    Settlement_Payment_Advise_pdf.exe

  • Size

    815KB

  • MD5

    f301fd124e4a1e98a0940a6897174c9d

  • SHA1

    b7524db5c28cf5174272ed230c620c6b1120b04d

  • SHA256

    d7b641d0151a05ea88a81ce63ba1f8dec700c584203b3978daa4e143af7bfac4

  • SHA512

    8228ed551aa5d9f86c417cdbd19c1a3facb2bd545367c1db5b07b7048acdba6ed8b664ea70f7686e127a457f1c66ff7f188a2f0c1ae45e45e1033d6c9da03566

  • SSDEEP

    24576:PVTcsrgw74/EeWZAULhyeT7W2Gnm3Tw2a:PVcOgDslBVS2Gnm3THa

Malware Config

Extracted

Family

vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Blocklisted process makes network request 8 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Settlement_Payment_Advise_pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Settlement_Payment_Advise_pdf.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Tilluk=Get-Content -Raw 'C:\Users\Admin\AppData\Local\Temp\amtsborgmester\pipette\Bountihead.Amp';$Accustomedness=$Tilluk.SubString(78627,3);.$Accustomedness($Tilluk)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3840
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\syswow64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:3820

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rcq1yv2l.ho1.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\amtsborgmester\pipette\Bountihead.Amp

    Filesize

    76KB

    MD5

    b3e22fcf654587946cbb858f6587c0d4

    SHA1

    6c07411640ad7d6ff1928ff84864b43b84bdcd91

    SHA256

    072cbb8dd2d9776d1f0930cc39d2cca7821c50d9464912a1144e6747d9c20964

    SHA512

    cd5577751bdc4137d9d3bdfbee6dc6590e6f8c7e33a6610889316b57ae8d42ccd6c92d935955e427202dbf58b6f36a40b72d5ca513d317f9c8ef3113b9082021

  • C:\Users\Admin\AppData\Local\Temp\amtsborgmester\pipette\strigsrejsen.Gib

    Filesize

    348KB

    MD5

    fc1b8508adc7dfc8fab6a4ffa3e10764

    SHA1

    030e2952c376452b60eed4ab6bc891677614b5c3

    SHA256

    da015f66da0983444fea0e2079dc9a7cdd31f5f609832051cbc21648df41dbf0

    SHA512

    57a7009c1636549015c1954083b133adfb97fcae78392b915b1587e56b53895028b42cafb56f33956decec466026d7b638adf2d443a1dac84b082775fa67c3d6

  • memory/3820-89-0x0000000021AB0000-0x0000000021ABA000-memory.dmp

    Filesize

    40KB

  • memory/3820-88-0x0000000022110000-0x00000000221A2000-memory.dmp

    Filesize

    584KB

  • memory/3820-86-0x00000000219E0000-0x0000000021A30000-memory.dmp

    Filesize

    320KB

  • memory/3820-85-0x0000000022240000-0x0000000022402000-memory.dmp

    Filesize

    1.8MB

  • memory/3820-84-0x0000000002070000-0x00000000035B6000-memory.dmp

    Filesize

    21.3MB

  • memory/3820-82-0x00000000215B0000-0x000000002164C000-memory.dmp

    Filesize

    624KB

  • memory/3820-81-0x0000000000E10000-0x0000000000E5A000-memory.dmp

    Filesize

    296KB

  • memory/3820-80-0x0000000000E10000-0x0000000002064000-memory.dmp

    Filesize

    18.3MB

  • memory/3820-67-0x0000000002070000-0x00000000035B6000-memory.dmp

    Filesize

    21.3MB

  • memory/3840-50-0x0000000007AC0000-0x0000000007B63000-memory.dmp

    Filesize

    652KB

  • memory/3840-59-0x0000000073C50000-0x0000000074400000-memory.dmp

    Filesize

    7.7MB

  • memory/3840-31-0x0000000006B70000-0x0000000006B92000-memory.dmp

    Filesize

    136KB

  • memory/3840-32-0x0000000007E70000-0x0000000008414000-memory.dmp

    Filesize

    5.6MB

  • memory/3840-29-0x00000000075F0000-0x0000000007686000-memory.dmp

    Filesize

    600KB

  • memory/3840-34-0x0000000008AA0000-0x000000000911A000-memory.dmp

    Filesize

    6.5MB

  • memory/3840-37-0x00000000700E0000-0x000000007012C000-memory.dmp

    Filesize

    304KB

  • memory/3840-36-0x0000000073C50000-0x0000000074400000-memory.dmp

    Filesize

    7.7MB

  • memory/3840-35-0x0000000007A50000-0x0000000007A82000-memory.dmp

    Filesize

    200KB

  • memory/3840-38-0x0000000070840000-0x0000000070B94000-memory.dmp

    Filesize

    3.3MB

  • memory/3840-48-0x0000000007A90000-0x0000000007AAE000-memory.dmp

    Filesize

    120KB

  • memory/3840-49-0x0000000073C50000-0x0000000074400000-memory.dmp

    Filesize

    7.7MB

  • memory/3840-9-0x0000000073C5E000-0x0000000073C5F000-memory.dmp

    Filesize

    4KB

  • memory/3840-51-0x0000000007BC0000-0x0000000007BCA000-memory.dmp

    Filesize

    40KB

  • memory/3840-52-0x0000000007D40000-0x0000000007D6A000-memory.dmp

    Filesize

    168KB

  • memory/3840-53-0x0000000007D70000-0x0000000007D94000-memory.dmp

    Filesize

    144KB

  • memory/3840-54-0x0000000073C50000-0x0000000074400000-memory.dmp

    Filesize

    7.7MB

  • memory/3840-56-0x0000000073C50000-0x0000000074400000-memory.dmp

    Filesize

    7.7MB

  • memory/3840-28-0x0000000006650000-0x000000000669C000-memory.dmp

    Filesize

    304KB

  • memory/3840-30-0x0000000006B00000-0x0000000006B1A000-memory.dmp

    Filesize

    104KB

  • memory/3840-58-0x0000000073C5E000-0x0000000073C5F000-memory.dmp

    Filesize

    4KB

  • memory/3840-60-0x0000000073C50000-0x0000000074400000-memory.dmp

    Filesize

    7.7MB

  • memory/3840-62-0x0000000073C50000-0x0000000074400000-memory.dmp

    Filesize

    7.7MB

  • memory/3840-61-0x0000000009120000-0x000000000A666000-memory.dmp

    Filesize

    21.3MB

  • memory/3840-63-0x0000000073C50000-0x0000000074400000-memory.dmp

    Filesize

    7.7MB

  • memory/3840-64-0x0000000073C50000-0x0000000074400000-memory.dmp

    Filesize

    7.7MB

  • memory/3840-65-0x0000000073C50000-0x0000000074400000-memory.dmp

    Filesize

    7.7MB

  • memory/3840-66-0x0000000073C50000-0x0000000074400000-memory.dmp

    Filesize

    7.7MB

  • memory/3840-27-0x0000000006630000-0x000000000664E000-memory.dmp

    Filesize

    120KB

  • memory/3840-26-0x0000000005F80000-0x00000000062D4000-memory.dmp

    Filesize

    3.3MB

  • memory/3840-16-0x0000000005F10000-0x0000000005F76000-memory.dmp

    Filesize

    408KB

  • memory/3840-15-0x0000000005760000-0x00000000057C6000-memory.dmp

    Filesize

    408KB

  • memory/3840-14-0x00000000055C0000-0x00000000055E2000-memory.dmp

    Filesize

    136KB

  • memory/3840-13-0x0000000073C50000-0x0000000074400000-memory.dmp

    Filesize

    7.7MB

  • memory/3840-12-0x0000000073C50000-0x0000000074400000-memory.dmp

    Filesize

    7.7MB

  • memory/3840-11-0x00000000057E0000-0x0000000005E08000-memory.dmp

    Filesize

    6.2MB

  • memory/3840-10-0x0000000002F90000-0x0000000002FC6000-memory.dmp

    Filesize

    216KB