Analysis
-
max time kernel
239s -
max time network
240s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-10-2024 16:12
Static task
static1
Behavioral task
behavioral1
Sample
Zahlung,jpg.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Zahlung,jpg.exe
Resource
win10v2004-20241007-en
General
-
Target
Zahlung,jpg.exe
-
Size
1.1MB
-
MD5
3416c390fb272a17a1c1a796411c5afe
-
SHA1
a9b9134c22add2a45732e8886f439b2d7ef28942
-
SHA256
f3024f40a06568ae85fb111a6f93923437951b6720f84f8a06c1ce9d21af5c83
-
SHA512
f0d364223f65788b2584fd2dc83c0e04d16f9d60b3d911853914a46401ad6621952568d2d97075f4989a2524f9b1d71ac37cb7b897b32a671ac233f4a66e4214
-
SSDEEP
12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QLNy7DEv/EE8l5HhqvtY9rzS+6iGNevT:ffmMv6Ckr7Mny5QL93Mdqv4re+6ut
Malware Config
Extracted
vipkeylogger
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Zahlung,jpg.exedescription pid process target process PID 2296 set thread context of 1760 2296 Zahlung,jpg.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Zahlung,jpg.exesvchost.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zahlung,jpg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
svchost.exepid process 1760 svchost.exe 1760 svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Zahlung,jpg.exepid process 2296 Zahlung,jpg.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchost.exedescription pid process Token: SeDebugPrivilege 1760 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Zahlung,jpg.exepid process 2296 Zahlung,jpg.exe 2296 Zahlung,jpg.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Zahlung,jpg.exepid process 2296 Zahlung,jpg.exe 2296 Zahlung,jpg.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Zahlung,jpg.exedescription pid process target process PID 2296 wrote to memory of 1760 2296 Zahlung,jpg.exe svchost.exe PID 2296 wrote to memory of 1760 2296 Zahlung,jpg.exe svchost.exe PID 2296 wrote to memory of 1760 2296 Zahlung,jpg.exe svchost.exe PID 2296 wrote to memory of 1760 2296 Zahlung,jpg.exe svchost.exe PID 2296 wrote to memory of 1760 2296 Zahlung,jpg.exe svchost.exe -
outlook_office_path 1 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe -
outlook_win_path 1 IoCs
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zahlung,jpg.exe"C:\Users\Admin\AppData\Local\Temp\Zahlung,jpg.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\Zahlung,jpg.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1760