Analysis
- max time kernel
145s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
09/10/2024, 01:14
General
- Target 1eb9e4d9431c70bfd18beb58430bc81724eaff21837dd1faf012c83921a6418b.exe
- Size 655KB
- Sample241009-blympa1gpb
- SHA256 1eb9e4d9431c70bfd18beb58430bc81724eaff21837dd1faf012c83921a6418b
Malware Config
Extracted
-
Protocol
smtp
-
Host
smtp.ionos.es
-
Port
587
-
Username
-
Password
@Briaii133
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
smtp.ionos.es
-
Port
587
-
Username
-
Password
@Briaii133
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Blocklisted process makes network request 9 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1eb9e4d9431c70bfd18beb58430bc81724eaff21837dd1faf012c83921a6418b.exe"C:\Users\Admin\AppData\Local\Temp\1eb9e4d9431c70bfd18beb58430bc81724eaff21837dd1faf012c83921a6418b.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Efterforskernes=Get-Content -raw 'C:\Users\Admin\AppData\Local\downrange\Stutteriers\samfrdselen\Bronchial.Rev';$regives=$Efterforskernes.SubString(53737,3);.$regives($Efterforskernes)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\syswow64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_bmbnhhfn.nra.ps1
Bronchial.Rev
dropforger.Tac
memory/3904-34-0x0000000070780000-0x0000000070AD4000-memory.dmp
memory/3904-47-0x0000000007B10000-0x0000000007B1A000-memory.dmp
memory/3904-10-0x00000000054B0000-0x00000000054D2000-memory.dmp
memory/3904-11-0x0000000005550000-0x00000000055B6000-memory.dmp
memory/3904-12-0x00000000055C0000-0x0000000005626000-memory.dmp
memory/3904-7-0x0000000005690000-0x0000000005CB8000-memory.dmp
memory/3904-22-0x0000000005F20000-0x0000000006274000-memory.dmp
memory/3904-23-0x0000000006560000-0x000000000657E000-memory.dmp
memory/3904-24-0x00000000065A0000-0x00000000065EC000-memory.dmp
memory/3904-27-0x0000000006AA0000-0x0000000006AC2000-memory.dmp
memory/3904-26-0x0000000006A50000-0x0000000006A6A000-memory.dmp
memory/3904-25-0x0000000007520000-0x00000000075B6000-memory.dmp
memory/3904-28-0x0000000007BC0000-0x0000000008164000-memory.dmp
memory/3904-8-0x0000000073B50000-0x0000000074300000-memory.dmp
memory/3904-30-0x00000000087F0000-0x0000000008E6A000-memory.dmp
memory/3904-32-0x000000006FFE0000-0x000000007002C000-memory.dmp
memory/3904-33-0x0000000073B50000-0x0000000074300000-memory.dmp
memory/3904-46-0x00000000079F0000-0x0000000007A93000-memory.dmp
memory/3904-44-0x0000000007980000-0x000000000799E000-memory.dmp
memory/3904-5-0x0000000073B5E000-0x0000000073B5F000-memory.dmp
memory/3904-9-0x0000000073B50000-0x0000000074300000-memory.dmp
memory/3904-45-0x0000000073B50000-0x0000000074300000-memory.dmp
memory/3904-31-0x00000000079A0000-0x00000000079D2000-memory.dmp
memory/3904-48-0x0000000007B50000-0x0000000007B7A000-memory.dmp
memory/3904-49-0x0000000007B80000-0x0000000007BA4000-memory.dmp
memory/3904-50-0x0000000073B50000-0x0000000074300000-memory.dmp
memory/3904-52-0x0000000073B50000-0x0000000074300000-memory.dmp
memory/3904-6-0x0000000004FC0000-0x0000000004FF6000-memory.dmp
memory/3904-54-0x0000000073B50000-0x0000000074300000-memory.dmp
memory/3904-55-0x0000000073B5E000-0x0000000073B5F000-memory.dmp
memory/3904-57-0x0000000073B50000-0x0000000074300000-memory.dmp
memory/3904-56-0x0000000008E70000-0x000000000B21E000-memory.dmp
memory/3904-58-0x0000000073B50000-0x0000000074300000-memory.dmp
memory/3904-59-0x0000000073B50000-0x0000000074300000-memory.dmp
memory/3904-60-0x0000000073B50000-0x0000000074300000-memory.dmp
memory/4704-73-0x00000000008D0000-0x0000000001B24000-memory.dmp
memory/4704-74-0x00000000008D0000-0x000000000091A000-memory.dmp
memory/4704-75-0x0000000021F20000-0x0000000021FBC000-memory.dmp
memory/4704-77-0x0000000022B70000-0x0000000022D32000-memory.dmp
memory/4704-78-0x0000000022390000-0x00000000223E0000-memory.dmp
memory/4704-79-0x0000000023270000-0x000000002379C000-memory.dmp
memory/4704-81-0x0000000022AA0000-0x0000000022B32000-memory.dmp
memory/4704-82-0x0000000022A60000-0x0000000022A6A000-memory.dmp