Analysis
- max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
22/10/2024, 12:20
General
- Target 001_215_EA2047939_202410210815.exe
- Size 867KB
- Sample241022-phq1bswgrp
- SHA256 963d35a92ffdbbdd35c71fc392a73ce49e242ca1b80f94204ef714cc42bbf8d0
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
smtp.ionos.fr
-
Port
587
-
Username
-
Password
Jc.2o3o@
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Blocklisted process makes network request 13 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\001_215_EA2047939_202410210815.exe"C:\Users\Admin\AppData\Local\Temp\001_215_EA2047939_202410210815.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Seppo=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Kontokurantens.Unc';$Underviseren=$Seppo.SubString(52189,3);.$Underviseren($Seppo)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Seppo=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Kontokurantens.Unc';$Underviseren=$Seppo.SubString(52189,3);.$Underviseren($Seppo)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4372 -s 20244⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4372 -ip 43721⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
05DDC6AA91765AACACDB0A5F96DF8199
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD
DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64
05DDC6AA91765AACACDB0A5F96DF8199
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD
DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64
ModuleAnalysisCache
__PSScriptPolicyTest_kjalbq2s.wpb.ps1
Associerendes.Lov
Kontokurantens.Unc
memory/1436-73-0x0000000008260000-0x0000000008284000-memory.dmp
memory/1436-12-0x0000000005580000-0x00000000055A2000-memory.dmp
memory/1436-38-0x0000000007520000-0x00000000075B6000-memory.dmp
memory/1436-39-0x0000000006A40000-0x0000000006A5A000-memory.dmp
memory/1436-40-0x0000000006A90000-0x0000000006AB2000-memory.dmp
memory/1436-41-0x0000000007CB0000-0x0000000008254000-memory.dmp
memory/1436-36-0x0000000006550000-0x000000000656E000-memory.dmp
memory/1436-43-0x00000000088E0000-0x0000000008F5A000-memory.dmp
memory/1436-44-0x0000000007980000-0x00000000079B2000-memory.dmp
memory/1436-47-0x0000000070790000-0x0000000070AE4000-memory.dmp
memory/1436-46-0x00000000701E0000-0x000000007022C000-memory.dmp
memory/1436-45-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/1436-58-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/1436-57-0x0000000007960000-0x000000000797E000-memory.dmp
memory/1436-60-0x00000000079D0000-0x0000000007A73000-memory.dmp
memory/1436-8-0x0000000002C10000-0x0000000002C46000-memory.dmp
memory/1436-9-0x0000000005760000-0x0000000005D88000-memory.dmp
memory/1436-10-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/1436-72-0x0000000007C70000-0x0000000007C9A000-memory.dmp
memory/1436-7-0x0000000073D5E000-0x0000000073D5F000-memory.dmp
memory/1436-11-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/1436-76-0x0000000073D5E000-0x0000000073D5F000-memory.dmp
memory/1436-37-0x0000000006570000-0x00000000065BC000-memory.dmp
memory/1436-78-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/1436-13-0x0000000005620000-0x0000000005686000-memory.dmp
memory/1436-14-0x0000000005690000-0x00000000056F6000-memory.dmp
memory/1436-20-0x0000000005F10000-0x0000000006264000-memory.dmp
memory/1436-91-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/1436-84-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/1436-85-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/2660-59-0x00000000701E0000-0x000000007022C000-memory.dmp
memory/2660-61-0x0000000070790000-0x0000000070AE4000-memory.dmp
memory/2660-90-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/2660-82-0x0000000008E30000-0x000000000DF97000-memory.dmp
memory/2660-81-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/2660-80-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/2660-79-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/2660-26-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/2660-74-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/2660-71-0x0000000007AE0000-0x0000000007AEA000-memory.dmp
memory/2660-25-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/2660-86-0x0000000073D50000-0x0000000074500000-memory.dmp
memory/4360-125-0x0000000000D90000-0x0000000001FE4000-memory.dmp
memory/4360-128-0x0000000000D90000-0x0000000000DD8000-memory.dmp
memory/4360-129-0x00000000249E0000-0x0000000024A7C000-memory.dmp
memory/4360-127-0x0000000000D90000-0x0000000001FE4000-memory.dmp
memory/4360-133-0x0000000025610000-0x00000000257D2000-memory.dmp
memory/4360-134-0x0000000024EC0000-0x0000000024F10000-memory.dmp
memory/4360-136-0x00000000257E0000-0x0000000025872000-memory.dmp
memory/4360-137-0x0000000024F80000-0x0000000024F8A000-memory.dmp
memory/4372-130-0x0000000001000000-0x0000000002254000-memory.dmp