Analysis
- max time kernel
144s - max time network
125s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
22/10/2024, 06:44
General
- Target MT103-539 PAYMENT (1).docx
- Size 319KB
- Sample241022-hhg9vsvbql
- SHA256 30e0259012e5808f7a34b0a9c7fba9194ae40bfa6fcba4a6f28787623a5f8cb1
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.tonicables.top
-
Port
587
-
Username
-
Password
7213575aceACE@@
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Blocklisted process makes network request 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Abuses OpenXML format to download file from external location
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Office loads VBA resources, possible macro or embedded object present
- Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\MT103-539 PAYMENT (1).docx"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\rekigobi34567.exe"C:\Users\Admin\AppData\Roaming\rekigobi34567.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rekigobi34567.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\rekigobi34567.exe"C:\Users\Admin\AppData\Roaming\rekigobi34567.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Exploitation for Client Execution
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
FSD-{1B742350-D41E-4592-9E8C-D286A5E02F0D}.FSD
FSD-CNRY.FSD
FSD-{E40E3027-6993-44FB-9222-B5DDD71A220E}.FSD
7vbu8ZW8lFI8mn5[1].doc
{0E53ED7D-F25D-4A0D-953D-96A590BBB931}
ExcludeDictionaryEN0409.lex
rekigobi34567.exe
memory/1668-110-0x0000000000340000-0x000000000035C000-memory.dmp
memory/1668-111-0x0000000004980000-0x0000000004A0A000-memory.dmp
memory/1668-94-0x0000000001090000-0x000000000114C000-memory.dmp
memory/1764-120-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1764-116-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1764-124-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1764-123-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1764-121-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1764-118-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1764-114-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1764-112-0x0000000000400000-0x0000000000448000-memory.dmp
memory/3000-109-0x00000000712FD000-0x0000000071308000-memory.dmp
memory/3000-0-0x000000002F331000-0x000000002F332000-memory.dmp
memory/3000-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/3000-2-0x00000000712FD000-0x0000000071308000-memory.dmp