Analysis

  • max time kernel
    142s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-10-2024 14:03

General

  • Target

    Sprawl.exe

  • Size

    859KB

  • MD5

    47fd98348b7d314e4e9dae46e5f1e1a1

  • SHA1

    cafe48404707e61235bfbe6646d8072af4298e21

  • SHA256

    125b4582b7dd2221044fb257f580da57e4dc61b03a6c35e208fed973f71c28a1

  • SHA512

    8a1deda7d7e8e80d8b2e62ad0d9d4400b1d865ea322955e577fc439a8a0f1d6d3cb912397ecb6458941fd7fd566c1fdbdf4c4ed02c72234fa543bfcb45db845a

  • SSDEEP

    12288:l9/IyjazmRR+BZhOLlpJjdCPwwdw6ETeVlCE7vkQymGwSW01hXqvjoaCi7lnsZzz:/A/KqZhOnJdyzp+alCJmvulW6Nd0vo

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.ionos.es
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    pW@4G()=#2

Extracted

Family

vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Blocklisted process makes network request 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Sprawl.exe
    "C:\Users\Admin\AppData\Local\Temp\Sprawl.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Sensitometer42=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej';$Loveliest=$Sensitometer42.SubString(55162,3);.$Loveliest($Sensitometer42)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4404
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:3228

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iqum3pyh.fdn.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Overtrdelser.Dok

    Filesize

    319KB

    MD5

    0333fb2b0e19a85944c9ea2538f15529

    SHA1

    cb7cf6aef6b3409205b0efa337eb5fc4f84fa237

    SHA256

    3529ab40264cb6806cb5ed7e64d98d29b94362987720cd633e4785f41e0163e2

    SHA512

    5fa5102e95fb393e47fea92d7cee9b0f66bfaa94ec0cace06a83bd18413eb9d7968e6973a8843aeb7f9b877418a11e3686f61d326569392ae3e6cb65cc51ea5e

  • C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Paraffinerer.Dej

    Filesize

    53KB

    MD5

    6f2c225ff02a35f64c6157286f9e90b1

    SHA1

    fdfb286088fd3cb3c3fa39f39e2e7ba48b3c6624

    SHA256

    0f4caa809a6b9ad70a305958af34e60b82f3080bbb7067f316ca85702ffba443

    SHA512

    c5fb4eafb4c29b774648bcec26736ad0808815d10618c95b723de9296240e6f9cbc35e90cc4439266f013810f16dde0f44a840fa928d8be2a8562cc5ac8d2eb5

  • memory/3228-80-0x0000000000D70000-0x0000000001FC4000-memory.dmp

    Filesize

    18.3MB

  • memory/3228-82-0x0000000000D70000-0x0000000000DBA000-memory.dmp

    Filesize

    296KB

  • memory/3228-90-0x0000000022AD0000-0x0000000022ADA000-memory.dmp

    Filesize

    40KB

  • memory/3228-89-0x0000000022B10000-0x0000000022BA2000-memory.dmp

    Filesize

    584KB

  • memory/3228-87-0x0000000023320000-0x000000002384C000-memory.dmp

    Filesize

    5.2MB

  • memory/3228-86-0x00000000223E0000-0x0000000022430000-memory.dmp

    Filesize

    320KB

  • memory/3228-84-0x0000000022C20000-0x0000000022DE2000-memory.dmp

    Filesize

    1.8MB

  • memory/3228-83-0x0000000021F90000-0x000000002202C000-memory.dmp

    Filesize

    624KB

  • memory/3228-81-0x0000000000D70000-0x0000000001FC4000-memory.dmp

    Filesize

    18.3MB

  • memory/4404-38-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-52-0x0000000007D10000-0x0000000007DB3000-memory.dmp

    Filesize

    652KB

  • memory/4404-25-0x00000000067C0000-0x00000000067DE000-memory.dmp

    Filesize

    120KB

  • memory/4404-26-0x00000000068B0000-0x00000000068FC000-memory.dmp

    Filesize

    304KB

  • memory/4404-27-0x0000000073F0E000-0x0000000073F0F000-memory.dmp

    Filesize

    4KB

  • memory/4404-28-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-29-0x0000000007870000-0x0000000007906000-memory.dmp

    Filesize

    600KB

  • memory/4404-30-0x0000000006C90000-0x0000000006CAA000-memory.dmp

    Filesize

    104KB

  • memory/4404-31-0x0000000006D20000-0x0000000006D42000-memory.dmp

    Filesize

    136KB

  • memory/4404-32-0x0000000007EC0000-0x0000000008464000-memory.dmp

    Filesize

    5.6MB

  • memory/4404-34-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-35-0x0000000008AF0000-0x000000000916A000-memory.dmp

    Filesize

    6.5MB

  • memory/4404-37-0x0000000075740000-0x000000007578C000-memory.dmp

    Filesize

    304KB

  • memory/4404-36-0x0000000007CB0000-0x0000000007CE2000-memory.dmp

    Filesize

    200KB

  • memory/4404-14-0x0000000006270000-0x00000000062D6000-memory.dmp

    Filesize

    408KB

  • memory/4404-39-0x0000000074D00000-0x0000000075054000-memory.dmp

    Filesize

    3.3MB

  • memory/4404-49-0x0000000007CF0000-0x0000000007D0E000-memory.dmp

    Filesize

    120KB

  • memory/4404-50-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-51-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-24-0x00000000062E0000-0x0000000006634000-memory.dmp

    Filesize

    3.3MB

  • memory/4404-53-0x0000000007C90000-0x0000000007C9A000-memory.dmp

    Filesize

    40KB

  • memory/4404-54-0x0000000007E70000-0x0000000007E9A000-memory.dmp

    Filesize

    168KB

  • memory/4404-55-0x00000000085B0000-0x00000000085D4000-memory.dmp

    Filesize

    144KB

  • memory/4404-56-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-58-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-59-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-60-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-61-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-63-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-64-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-66-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-13-0x0000000006190000-0x00000000061F6000-memory.dmp

    Filesize

    408KB

  • memory/4404-12-0x0000000005890000-0x00000000058B2000-memory.dmp

    Filesize

    136KB

  • memory/4404-11-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-10-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB

  • memory/4404-9-0x0000000005970000-0x0000000005F98000-memory.dmp

    Filesize

    6.2MB

  • memory/4404-8-0x00000000031F0000-0x0000000003226000-memory.dmp

    Filesize

    216KB

  • memory/4404-7-0x0000000073F0E000-0x0000000073F0F000-memory.dmp

    Filesize

    4KB

  • memory/4404-65-0x0000000009170000-0x000000000B8F5000-memory.dmp

    Filesize

    39.5MB

  • memory/4404-67-0x0000000073F00000-0x00000000746B0000-memory.dmp

    Filesize

    7.7MB