Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-10-2024 12:26

General

  • Target

    001_215_EA2047939_202410210815.exe

  • Size

    867KB

  • MD5

    25da279ad7ee7cc3b8d3e5cd5aa4b5b2

  • SHA1

    d1fc6cbe8d8cca235ed29de6b109a0cb951eb5f3

  • SHA256

    963d35a92ffdbbdd35c71fc392a73ce49e242ca1b80f94204ef714cc42bbf8d0

  • SHA512

    db074cfe6c006f194b8b4ca983fb83a88229beb229504c8eba07140fe490974e90dfe75b66b9c4d81bd319fdaaccc822473064771b7ac8d333012859f139498e

  • SSDEEP

    12288:l9Zwb4/I1H06OdtVQuqilUSDFOIBETeVlCE7vkQymGwSW01hXqvjoaCi7lnsZz0W:/dPFtVtOIB+alCJmvulW6Nd0vu

Malware Config

Extracted

Family

vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Blocklisted process makes network request 16 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\001_215_EA2047939_202410210815.exe
    "C:\Users\Admin\AppData\Local\Temp\001_215_EA2047939_202410210815.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Seppo=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Kontokurantens.Unc';$Underviseren=$Seppo.SubString(52189,3);.$Underviseren($Seppo)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4708
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:4384
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Seppo=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Kontokurantens.Unc';$Underviseren=$Seppo.SubString(52189,3);.$Underviseren($Seppo)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:448
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    854B

    MD5

    e935bc5762068caf3e24a2683b1b8a88

    SHA1

    82b70eb774c0756837fe8d7acbfeec05ecbf5463

    SHA256

    a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

    SHA512

    bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    9de7476fdc0bdfcc7b78c40eb0b7ae9c

    SHA1

    e95ecafe1e4f0da7b4cd6d238d75d367f7c9b5cc

    SHA256

    8f4a054cea59ba5bc892962f7ee8c79dafd4ea7e182af0d7fbe3ce89f93750bc

    SHA512

    5bc6682c81b5cdea27a198215d02df7e64a53ca5c92d272d2b1140d32deea3d112b596e8eb35e6f79dc609964a32dab6a4ef83b3845b1057b86bd17537cd2cc2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD

    Filesize

    471B

    MD5

    d27e8f4f186e50ed883dc1676cbb4038

    SHA1

    4dc99e2f5a1b7eafbceb0b837d9030424d67d8a4

    SHA256

    ea5e76383ebf4550a6d4f3e561534cdbda582899df18c32c1ae085e0b1ff9ed8

    SHA512

    3f6c599fdc2eaf4b42b1b594226438cc4d9b3a7846577b16307023c355757b794b1305b260c0d9e0071483e709dc7d5d190ba89ef3808185b4cd2d529c932372

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64

    Filesize

    472B

    MD5

    fff9aba6fe7a03ac24297af4a6ef7600

    SHA1

    7ed4438da3b2bd2080a577c149f0029337d68fe8

    SHA256

    510ed87ce53d8777b77a0de99754d355529f7f2f9e9a05690b927d1ced4dbe92

    SHA512

    86b21267b1379717e414a374f113556c779246026569ab0adbda017d68532a62bd8999e5deb49f059b76c0c10ea15ca40e251f7efc5bdddbac7114ee002342c8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    170B

    MD5

    0c18cf82ddce8803aba4fb55bbeca6ca

    SHA1

    c84097556ddcb20901b8f51912c1f8eec8c3d29c

    SHA256

    ded37b992fc47288dcb37c2f16a9f84b372fa7f4e721e25e9378c098d66d2916

    SHA512

    5fd3942de0dbf9726fc7e72567cc8cf306ca04c02e02ec7d17f3ac5fd6bad07d20682c04add62155d4adbb46372d4c27fb868935d2555987ed563288c0acc43c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    170B

    MD5

    83e612914b62f1baf4cbebe922c0ce9d

    SHA1

    bc34eb2a4cda48897bf001ee4cf77055ae578588

    SHA256

    935baf8e8b135606fbe0220ba683171f5df95ebfa80b8738559417b5d93a18ef

    SHA512

    8b9a4ee1a4dda501a0a2b31f3330f4110a2435df11debf560f0c915fffff421052c2eddce0eeeed83fa8c781202783cbb71dfdf9275aad6ae61010474d8bd1a2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    ac7538943398b0b9248700e0a17715fe

    SHA1

    cc13645350f899a0d48fa907fb065bd54bc17fc0

    SHA256

    aee438396676775daa479bbc6beada288cb8bcc995892efbf2b91c6c1d82a317

    SHA512

    38923daf7b579f47b9e7ae1e777d3d4eb4db05ec4661160be68357e03087b7da809dc077349bb534a22b844a6a9f8871f847c9642c321b4941d0d479020186f2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD

    Filesize

    406B

    MD5

    6ec35013b14af827e2615d2cacb611e4

    SHA1

    5e14cdfba35c1fadc76095588316a9b0b6b2de16

    SHA256

    8955b6902b4770e158d43b90705d7104c141f1df374b8e2504423fc890cff1a2

    SHA512

    f5c69f08ee4864c43287c33669ccacd72d34edcd8e81224c46f840076c9511ee8e69f7a8b2e7b7a32909cbe55210ee29591066840aac4e5ff4e4474ace0fe6b4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64

    Filesize

    402B

    MD5

    d1a2d84782553db950546ff01c3f3503

    SHA1

    10950f92a1487b7fccc72790c6d9af9af14e387d

    SHA256

    6c3077458a25dc6bb9fe55567522d5a3417b3b2719ae6dfb2fa3591ca01bf28a

    SHA512

    9a50d7a7496784d124cafec82b662fa6399ae9e621386a57dd8040139fcc3fea758debf2e34a5b5a77f6c4f660209f118662264fc0ea143e03194efce1be7e4e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    Filesize

    53KB

    MD5

    01404e51f6442f60e478c306b1e6e52e

    SHA1

    37f234ccf5611b8309023410ceb9e76ad81f5678

    SHA256

    d4356dd23aa2e811712132f9718786331661a1bd0d062c49cb76807b9563928b

    SHA512

    94a9d843ae4055e2a9b412f03cba85e2d7b804ec3106f059d14ca50b15ae4acc6cd452f9461c2e21d1632d06848c969732c539aea17869b8b3a2f5ab93b891d7

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s33mpkwn.dp3.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\001_215_EA2047939_202410210815.exe

    Filesize

    867KB

    MD5

    25da279ad7ee7cc3b8d3e5cd5aa4b5b2

    SHA1

    d1fc6cbe8d8cca235ed29de6b109a0cb951eb5f3

    SHA256

    963d35a92ffdbbdd35c71fc392a73ce49e242ca1b80f94204ef714cc42bbf8d0

    SHA512

    db074cfe6c006f194b8b4ca983fb83a88229beb229504c8eba07140fe490974e90dfe75b66b9c4d81bd319fdaaccc822473064771b7ac8d333012859f139498e

  • C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Associerendes.Lov

    Filesize

    334KB

    MD5

    8dc34d1e450d9695f44738379365b189

    SHA1

    9e77d26860ba038a647b6670fd0ddd2c961d0666

    SHA256

    fb8575b17a714bab821f43e25454975876348a6ccf9fb580f25351311d09690b

    SHA512

    f842056d5dcd6f43c88ff6ba91eb6207d3fa48b4e38f050a756fbe3d281cf8483def8a4221f63407953d589be05a7505c31fc6df12a0ed77dd64581e27722f08

  • C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Kontokurantens.Unc

    Filesize

    50KB

    MD5

    8a4da8bab6993bc24f8ba89b1a5035ba

    SHA1

    0266616ebaff76b9027bdf4a52742bbb6d7dbf90

    SHA256

    d19add8d848501931650d9c2f77d4519b15ffe2399a161dac88ea99c07f1b62d

    SHA512

    1f604a65b0fb4543feab6eb9584aab3c47c5ebcabf251492c7be827e3c5d547f310ff05354bf30837fe8192be427c1855ec22783a0be14db15b40b1f05a13c50

  • memory/448-41-0x0000000007840000-0x0000000007DE4000-memory.dmp

    Filesize

    5.6MB

  • memory/448-73-0x00000000077E0000-0x000000000780A000-memory.dmp

    Filesize

    168KB

  • memory/448-84-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/448-83-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/448-90-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/448-43-0x0000000008470000-0x0000000008AEA000-memory.dmp

    Filesize

    6.5MB

  • memory/448-35-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/448-94-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/448-25-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/448-24-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/448-88-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/448-57-0x000000006FE00000-0x000000006FE4C000-memory.dmp

    Filesize

    304KB

  • memory/448-70-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/448-60-0x0000000070560000-0x00000000708B4000-memory.dmp

    Filesize

    3.3MB

  • memory/448-74-0x0000000007810000-0x0000000007834000-memory.dmp

    Filesize

    144KB

  • memory/448-72-0x00000000077A0000-0x00000000077AA000-memory.dmp

    Filesize

    40KB

  • memory/448-75-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/1520-131-0x0000000000E00000-0x0000000002054000-memory.dmp

    Filesize

    18.3MB

  • memory/1520-132-0x0000000000E00000-0x0000000000E48000-memory.dmp

    Filesize

    288KB

  • memory/1520-133-0x00000000251A0000-0x000000002523C000-memory.dmp

    Filesize

    624KB

  • memory/1520-138-0x0000000025E30000-0x0000000025FF2000-memory.dmp

    Filesize

    1.8MB

  • memory/1520-139-0x0000000025610000-0x0000000025660000-memory.dmp

    Filesize

    320KB

  • memory/1520-140-0x0000000025D00000-0x0000000025D92000-memory.dmp

    Filesize

    584KB

  • memory/1520-141-0x0000000025C90000-0x0000000025C9A000-memory.dmp

    Filesize

    40KB

  • memory/4384-130-0x00000000008F0000-0x0000000001B44000-memory.dmp

    Filesize

    18.3MB

  • memory/4384-135-0x00000000008F0000-0x0000000000938000-memory.dmp

    Filesize

    288KB

  • memory/4384-134-0x00000000008F0000-0x0000000001B44000-memory.dmp

    Filesize

    18.3MB

  • memory/4708-85-0x0000000008B20000-0x000000000DC87000-memory.dmp

    Filesize

    81.4MB

  • memory/4708-11-0x0000000005190000-0x00000000051B2000-memory.dmp

    Filesize

    136KB

  • memory/4708-39-0x0000000006680000-0x000000000669A000-memory.dmp

    Filesize

    104KB

  • memory/4708-82-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/4708-89-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/4708-36-0x0000000006170000-0x000000000618E000-memory.dmp

    Filesize

    120KB

  • memory/4708-80-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/4708-95-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/4708-79-0x000000007397E000-0x000000007397F000-memory.dmp

    Filesize

    4KB

  • memory/4708-37-0x0000000006190000-0x00000000061DC000-memory.dmp

    Filesize

    304KB

  • memory/4708-19-0x0000000005B90000-0x0000000005EE4000-memory.dmp

    Filesize

    3.3MB

  • memory/4708-13-0x0000000005B20000-0x0000000005B86000-memory.dmp

    Filesize

    408KB

  • memory/4708-12-0x0000000005AB0000-0x0000000005B16000-memory.dmp

    Filesize

    408KB

  • memory/4708-87-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/4708-9-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/4708-10-0x0000000005290000-0x00000000058B8000-memory.dmp

    Filesize

    6.2MB

  • memory/4708-8-0x0000000004BC0000-0x0000000004BF6000-memory.dmp

    Filesize

    216KB

  • memory/4708-71-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/4708-59-0x0000000007600000-0x00000000076A3000-memory.dmp

    Filesize

    652KB

  • memory/4708-58-0x0000000007390000-0x00000000073AE000-memory.dmp

    Filesize

    120KB

  • memory/4708-45-0x000000006FE00000-0x000000006FE4C000-memory.dmp

    Filesize

    304KB

  • memory/4708-47-0x0000000070560000-0x00000000708B4000-memory.dmp

    Filesize

    3.3MB

  • memory/4708-46-0x0000000073970000-0x0000000074120000-memory.dmp

    Filesize

    7.7MB

  • memory/4708-44-0x00000000073B0000-0x00000000073E2000-memory.dmp

    Filesize

    200KB

  • memory/4708-38-0x0000000007220000-0x00000000072B6000-memory.dmp

    Filesize

    600KB

  • memory/4708-7-0x000000007397E000-0x000000007397F000-memory.dmp

    Filesize

    4KB

  • memory/4708-40-0x00000000066E0000-0x0000000006702000-memory.dmp

    Filesize

    136KB