Analysis
- max time kernel
145s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
16/10/2024, 02:34
General
- Target a1e1c8b1ab924aeb83526f74499d179cc88eb50283f96bb557f8a56d69c16a61.exe
- Size 1.2MB
- Sample241016-c2jzxasflp
- SHA256 a1e1c8b1ab924aeb83526f74499d179cc88eb50283f96bb557f8a56d69c16a61
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.strakonltd.co.ug
-
Port
587
-
Username
-
Password
Moreblessings@26
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Blocklisted process makes network request 16 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1e1c8b1ab924aeb83526f74499d179cc88eb50283f96bb557f8a56d69c16a61.exe"C:\Users\Admin\AppData\Local\Temp\a1e1c8b1ab924aeb83526f74499d179cc88eb50283f96bb557f8a56d69c16a61.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Gvestes=Get-Content -raw 'C:\Users\Admin\AppData\Local\Temp\carinal\Coracosteon\ludgate.Gdn';$Emanent237=$Gvestes.SubString(28439,3);.$Emanent237($Gvestes)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Gvestes=Get-Content -raw 'C:\Users\Admin\AppData\Local\Temp\carinal\Coracosteon\ludgate.Gdn';$Emanent237=$Gvestes.SubString(28439,3);.$Emanent237($Gvestes)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
05DDC6AA91765AACACDB0A5F96DF8199
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
6DA548C7E5915679F87E910D6581DEF1_831B21EC05D416A4ADB2370CD79ABCDD
C02877841121CC45139CB51404116B25_CFDBFDB29AA6A71EBDC3E04CD6E276F4
05DDC6AA91765AACACDB0A5F96DF8199
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
6DA548C7E5915679F87E910D6581DEF1_831B21EC05D416A4ADB2370CD79ABCDD
C02877841121CC45139CB51404116B25_CFDBFDB29AA6A71EBDC3E04CD6E276F4
__PSScriptPolicyTest_g4ekgjjn.4po.ps1
Antikvitetshandlen.Fis
ludgate.Gdn
memory/1332-125-0x0000000000CB0000-0x0000000000CF8000-memory.dmp
memory/1332-124-0x0000000000CB0000-0x0000000001F04000-memory.dmp
memory/1332-126-0x0000000020790000-0x000000002082C000-memory.dmp
memory/1332-130-0x00000000214C0000-0x0000000021682000-memory.dmp
memory/1332-131-0x0000000020C30000-0x0000000020C80000-memory.dmp
memory/1332-134-0x0000000021390000-0x0000000021422000-memory.dmp
memory/1332-135-0x0000000020D10000-0x0000000020D1A000-memory.dmp
memory/1456-74-0x0000000007830000-0x0000000007854000-memory.dmp
memory/1456-37-0x0000000006170000-0x00000000061BC000-memory.dmp
memory/1456-43-0x0000000008560000-0x0000000008BDA000-memory.dmp
memory/1456-45-0x000000006FA10000-0x000000006FA5C000-memory.dmp
memory/1456-48-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/1456-57-0x00000000074F0000-0x000000000750E000-memory.dmp
memory/1456-58-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/1456-46-0x000000006FE10000-0x0000000070164000-memory.dmp
memory/1456-9-0x0000000005260000-0x0000000005888000-memory.dmp
memory/1456-62-0x0000000007560000-0x0000000007603000-memory.dmp
memory/1456-8-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/1456-10-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/1456-44-0x0000000007510000-0x0000000007542000-memory.dmp
memory/1456-63-0x0000000007680000-0x000000000768A000-memory.dmp
memory/1456-11-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/1456-73-0x0000000007800000-0x000000000782A000-memory.dmp
memory/1456-26-0x0000000005AA0000-0x0000000005DF4000-memory.dmp
memory/1456-76-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/1456-79-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/1456-15-0x0000000005100000-0x0000000005166000-memory.dmp
memory/1456-40-0x00000000070B0000-0x00000000070D2000-memory.dmp
memory/1456-81-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/1456-41-0x0000000007930000-0x0000000007ED4000-memory.dmp
memory/1456-36-0x00000000060E0000-0x00000000060FE000-memory.dmp
memory/1456-39-0x00000000065D0000-0x00000000065EA000-memory.dmp
memory/1456-86-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/1456-87-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/1456-38-0x0000000006620000-0x00000000066B6000-memory.dmp
memory/1456-91-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/2864-75-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/2864-21-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/2864-88-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/2864-84-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/2864-83-0x0000000009090000-0x0000000009B79000-memory.dmp
memory/2864-82-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/2864-78-0x000000007359E000-0x000000007359F000-memory.dmp
memory/2864-14-0x0000000005ED0000-0x0000000005F36000-memory.dmp
memory/2864-89-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/2864-13-0x00000000054F0000-0x0000000005512000-memory.dmp
memory/2864-90-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/2864-12-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/2864-6-0x000000007359E000-0x000000007359F000-memory.dmp
memory/2864-59-0x000000006FA10000-0x000000006FA5C000-memory.dmp
memory/2864-61-0x000000006FE10000-0x0000000070164000-memory.dmp
memory/2864-60-0x0000000073590000-0x0000000073D40000-memory.dmp
memory/2864-7-0x0000000002FD0000-0x0000000003006000-memory.dmp