Analysis
-
max time kernel
97s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2024 05:13
Static task
static1
Behavioral task
behavioral1
Sample
FACTURA.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
FACTURA.exe
Resource
win10v2004-20240802-en
General
-
Target
FACTURA.exe
-
Size
865KB
-
MD5
158d8d8e57ad1e305fce17d3e277cc6f
-
SHA1
0ee2ca41f4b1898838fbd3c5c44baf124c21f4fb
-
SHA256
51466536fb4a4b2f46c0344206795c49ca7a95ab1179c3c7c269a80623589477
-
SHA512
4532aae393c59d63def7feb58bafa3530a7c77def52aa44892e76b72353f1fcd416ac388e8445be7041a370a72e4df692abbab899ff0a3afd9a87be4588d608b
-
SSDEEP
12288:tTv21WRE10veA7aUJc+QS+shiCp++qsqwFnyZ7l:Fv2Q71W/OhPZryZ
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
smtp.ionos.es - Port:
587 - Username:
[email protected] - Password:
102#Nova#Resid2 - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 4852 powershell.exe 2028 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
FACTURA.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation FACTURA.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 24 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FACTURA.exedescription pid process target process PID 2852 set thread context of 4900 2852 FACTURA.exe FACTURA.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4448 4900 WerFault.exe FACTURA.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
FACTURA.exepowershell.exepowershell.exeschtasks.exeFACTURA.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FACTURA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FACTURA.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
FACTURA.exepowershell.exepowershell.exeFACTURA.exepid process 2852 FACTURA.exe 4852 powershell.exe 2028 powershell.exe 2852 FACTURA.exe 4852 powershell.exe 2028 powershell.exe 4900 FACTURA.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
FACTURA.exepowershell.exepowershell.exeFACTURA.exedescription pid process Token: SeDebugPrivilege 2852 FACTURA.exe Token: SeDebugPrivilege 2028 powershell.exe Token: SeDebugPrivilege 4852 powershell.exe Token: SeDebugPrivilege 4900 FACTURA.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
FACTURA.exedescription pid process target process PID 2852 wrote to memory of 4852 2852 FACTURA.exe powershell.exe PID 2852 wrote to memory of 4852 2852 FACTURA.exe powershell.exe PID 2852 wrote to memory of 4852 2852 FACTURA.exe powershell.exe PID 2852 wrote to memory of 2028 2852 FACTURA.exe powershell.exe PID 2852 wrote to memory of 2028 2852 FACTURA.exe powershell.exe PID 2852 wrote to memory of 2028 2852 FACTURA.exe powershell.exe PID 2852 wrote to memory of 3948 2852 FACTURA.exe schtasks.exe PID 2852 wrote to memory of 3948 2852 FACTURA.exe schtasks.exe PID 2852 wrote to memory of 3948 2852 FACTURA.exe schtasks.exe PID 2852 wrote to memory of 4900 2852 FACTURA.exe FACTURA.exe PID 2852 wrote to memory of 4900 2852 FACTURA.exe FACTURA.exe PID 2852 wrote to memory of 4900 2852 FACTURA.exe FACTURA.exe PID 2852 wrote to memory of 4900 2852 FACTURA.exe FACTURA.exe PID 2852 wrote to memory of 4900 2852 FACTURA.exe FACTURA.exe PID 2852 wrote to memory of 4900 2852 FACTURA.exe FACTURA.exe PID 2852 wrote to memory of 4900 2852 FACTURA.exe FACTURA.exe PID 2852 wrote to memory of 4900 2852 FACTURA.exe FACTURA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FACTURA.exe"C:\Users\Admin\AppData\Local\Temp\FACTURA.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FACTURA.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jGcAjS.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jGcAjS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCDFE.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\FACTURA.exe"C:\Users\Admin\AppData\Local\Temp\FACTURA.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 14843⤵
- Program crash
PID:4448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4900 -ip 49001⤵PID:2332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD53a31ce9081b4ec55b8564502df3b379f
SHA1569f9f220899b3895b3e1a89af361cb360d34abe
SHA25609ef856a75f684134c3ae9530105288dc146032e608f3598654128a0adaeab4a
SHA512f62a16edd8b16400ee41c1b0a8856ec829f875c143bfdbbc48cf10eb3a615499c25d3eae457615cf4e2e738b9584ce375cb2a970ad31727f74eb1d1b39363994
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD51d919e89b2357f665dc2d883f8d22eb5
SHA1e6c38cf63be43709f957c8c56fd919a1cd8a4a37
SHA25697821f0335ba177e6a6e1ffa80e3015bc0b93be45215f85de7b4d123b0abc410
SHA51220ab12231ea4e2218216536cb249754f694f27580dc73f904550c883fcdaa6895dc21d7d1df382b283ecdcf36e1cffbb0cbc683536fcb48c9b9181321e1e1a34