Analysis

  • max time kernel
    104s
  • max time network
    106s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2024 19:07

General

  • Target

    Urgent inquiry for quotation.exe

  • Size

    1.2MB

  • MD5

    99f8afeaf690544887a8bfc9243f3c7f

  • SHA1

    49ac8b9909d9c429530860e851a81f1262a5ce14

  • SHA256

    cc4e80189451b050cc7bc90aa3fa787a4e3a50a0cc6f845fa68bdc849b1f5d14

  • SHA512

    02b7f53d0430b172599f5449b78b83fe722fa5443e02e9b6b116a964d1cb008c5c0dd5d0909930f66c37bef6214bbb5d1c3f440ccb6e930f68462ba677d87e0a

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLpJtGoBCZNyozGcuYViYxy7Y5b:f3v+7/5QLpJaZNKcoYxPB

Malware Config

Extracted

Family

vipkeylogger

Credentials
C2

https://api.telegram.org/bot7323823089:AAFBRsTW94zIpSoDS8yfGsotlQLqF2I6TU0/sendMessage?chat_id=5013849544

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Urgent inquiry for quotation.exe
    "C:\Users\Admin\AppData\Local\Temp\Urgent inquiry for quotation.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1456
    • C:\Users\Admin\AppData\Local\directory\name.exe
      "C:\Users\Admin\AppData\Local\Temp\Urgent inquiry for quotation.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2964
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Users\Admin\AppData\Local\Temp\Urgent inquiry for quotation.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:3156

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\scroll

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Local\directory\name.exe

    Filesize

    1.2MB

    MD5

    99f8afeaf690544887a8bfc9243f3c7f

    SHA1

    49ac8b9909d9c429530860e851a81f1262a5ce14

    SHA256

    cc4e80189451b050cc7bc90aa3fa787a4e3a50a0cc6f845fa68bdc849b1f5d14

    SHA512

    02b7f53d0430b172599f5449b78b83fe722fa5443e02e9b6b116a964d1cb008c5c0dd5d0909930f66c37bef6214bbb5d1c3f440ccb6e930f68462ba677d87e0a

  • memory/1456-2-0x00000000042B0000-0x00000000046B0000-memory.dmp

    Filesize

    4.0MB

  • memory/2964-10-0x0000000003ED0000-0x00000000042D0000-memory.dmp

    Filesize

    4.0MB

  • memory/3156-14-0x0000000005480000-0x0000000005A24000-memory.dmp

    Filesize

    5.6MB

  • memory/3156-13-0x000000007414E000-0x000000007414F000-memory.dmp

    Filesize

    4KB

  • memory/3156-12-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/3156-15-0x0000000004ED0000-0x0000000004F6C000-memory.dmp

    Filesize

    624KB

  • memory/3156-16-0x0000000074140000-0x00000000748F0000-memory.dmp

    Filesize

    7.7MB

  • memory/3156-17-0x0000000006300000-0x00000000064C2000-memory.dmp

    Filesize

    1.8MB

  • memory/3156-18-0x00000000061A0000-0x00000000061F0000-memory.dmp

    Filesize

    320KB

  • memory/3156-19-0x000000007414E000-0x000000007414F000-memory.dmp

    Filesize

    4KB

  • memory/3156-20-0x0000000074140000-0x00000000748F0000-memory.dmp

    Filesize

    7.7MB

  • memory/3156-21-0x00000000064D0000-0x0000000006562000-memory.dmp

    Filesize

    584KB

  • memory/3156-22-0x00000000062B0000-0x00000000062BA000-memory.dmp

    Filesize

    40KB