Analysis
- max time kernel
119s - max time network
122s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
- submitted
15/10/2024, 18:19
General
- Target na.rtf
- Size 1.1MB
- Sample241015-wx6gwstdpn
- SHA256 fe93d23dcde3d5a6cfff8ed7b9e77e418a477ce2fcff41edf3ba0d786aed5551
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
cp1.virtualine.org
-
Port
587
-
Username
-
Password
7213575aceACE@@
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Blocklisted process makes network request 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Office loads VBA resources, possible macro or embedded object present
- Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\na.rtf"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\jcndokagod38511.exe"C:\Users\Admin\AppData\Roaming\jcndokagod38511.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jcndokagod38511.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\jcndokagod38511.exe"C:\Users\Admin\AppData\Roaming\jcndokagod38511.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\jcndokagod38511.exe"C:\Users\Admin\AppData\Roaming\jcndokagod38511.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Exploitation for Client Execution
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
jcndokagod38511.exe
memory/1248-24-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1248-31-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1248-18-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1248-20-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1248-22-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1248-29-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1248-27-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1248-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2516-2-0x00000000717CD000-0x00000000717D8000-memory.dmp
memory/2516-16-0x00000000717CD000-0x00000000717D8000-memory.dmp
memory/2516-0-0x000000002F451000-0x000000002F452000-memory.dmp
memory/2516-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2808-17-0x00000000052B0000-0x000000000533C000-memory.dmp
memory/2808-15-0x0000000000370000-0x0000000000382000-memory.dmp
memory/2808-14-0x0000000000AD0000-0x0000000000B78000-memory.dmp