Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-10-2024 02:23
Static task
static1
Behavioral task
behavioral1
Sample
order details.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
order details.exe
Resource
win10v2004-20240802-en
General
-
Target
order details.exe
-
Size
1023KB
-
MD5
6b752a6938b1e93f23ce8bd928ee84b8
-
SHA1
2984fdfed10fbc93829961376fe877d134142a20
-
SHA256
1ec28e8814497d10ce333d9ecd100ab86ec649e9b612a4349c7f0dbc382fca6f
-
SHA512
29015c682b4d7553a50449a16f09b0e9110a6ad97fcc24a4fc8e6127d5711bc3c9f8375239758c3e99560d25e672c1e836a68010cd860fa2b10fac30b7c7aec7
-
SSDEEP
12288:ssf/Q9N4Bw3XIlga8LunuX15h7cP1z4iE0EdCtqfGplddJDf+5IEO55zR+nyYr6:slalQLuuXk4iEiqfGVdJDf+UzNo
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7682425803:AAHHoZD1_lffPXz0N6EaljeP4aAXgk0EI3k/sendMessage?chat_id=2135869667
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
order details.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order details.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order details.exe Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order details.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
order details.exedescription pid process target process PID 2084 set thread context of 2324 2084 order details.exe order details.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
order details.exeorder details.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language order details.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language order details.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
order details.exepid process 2324 order details.exe 2324 order details.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
order details.exedescription pid process Token: SeDebugPrivilege 2324 order details.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
order details.exedescription pid process target process PID 2084 wrote to memory of 2324 2084 order details.exe order details.exe PID 2084 wrote to memory of 2324 2084 order details.exe order details.exe PID 2084 wrote to memory of 2324 2084 order details.exe order details.exe PID 2084 wrote to memory of 2324 2084 order details.exe order details.exe PID 2084 wrote to memory of 2324 2084 order details.exe order details.exe PID 2084 wrote to memory of 2324 2084 order details.exe order details.exe PID 2084 wrote to memory of 2324 2084 order details.exe order details.exe PID 2084 wrote to memory of 2324 2084 order details.exe order details.exe PID 2084 wrote to memory of 2324 2084 order details.exe order details.exe -
outlook_office_path 1 IoCs
Processes:
order details.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order details.exe -
outlook_win_path 1 IoCs
Processes:
order details.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 order details.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\order details.exe"C:\Users\Admin\AppData\Local\Temp\order details.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\order details.exe"C:\Users\Admin\AppData\Local\Temp\order details.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2324