Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-10-2024 01:36

General

  • Target

    9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe

  • Size

    868KB

  • MD5

    c676d09741d75516a52593da851f8e81

  • SHA1

    d240a1271f4a3a0380a550d7c34bbfc5e2f3212b

  • SHA256

    9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc

  • SHA512

    1f032edb87bf2f7333e74e2ff997c07731974163d6e961261aee24b5e1ee6b00e3fe451c77e2983b509959d8ca86979b29796de133b1832c463894f46bae5b80

  • SSDEEP

    12288:l9Aw7LtaVYyyQiZ5Q20zMETeVlCE7vkQymGwSW01hXqvjoaCi7lnsZz0ma2:/AmtaVYyyQijQ9g+alCJmvulW6Nd0v2

Malware Config

Extracted

Family

vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Blocklisted process makes network request 16 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe
    "C:\Users\Admin\AppData\Local\Temp\9b1f6b694a8757b419c04ccd6ade02b58db56952b45d3a70c02dfb9682ec9fdc.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4560
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Bittermandler=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Melibiose.Spa';$Datarepraesentation=$Bittermandler.SubString(54249,3);.$Datarepraesentation($Bittermandler)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:808
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Bittermandler=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Melibiose.Spa';$Datarepraesentation=$Bittermandler.SubString(54249,3);.$Datarepraesentation($Bittermandler)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:648

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    854B

    MD5

    e935bc5762068caf3e24a2683b1b8a88

    SHA1

    82b70eb774c0756837fe8d7acbfeec05ecbf5463

    SHA256

    a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

    SHA512

    bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    76b2de4276a82861ed2fc9622aca4532

    SHA1

    121d53d4ccd29ff917c424c703a718f4ce811172

    SHA256

    a5d281814ab7745a410c2de4e66244f253662f3c78fdc0d2a280632afab807e4

    SHA512

    de2758ac45fd6d48008c9ad0f58e71d064e6284f8665cd09794f9d1a6d6c2747ed7c9be6f6a784c530b72290c0de015849e9a650e2ddd7172dda1dba79562605

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD

    Filesize

    471B

    MD5

    ed2bc277627fe9729bb6e14fc0ca8651

    SHA1

    45904821d33b90391b60e1c78283343b40167f79

    SHA256

    7d3aa148aa339df14b24d65c7ec460b0bec9067dee838ef9a48a1028e393a99b

    SHA512

    e02dd1357820ef6824580e5d9277ffcaa8540f936ae076de3dca4a61c2ab4ad0b4d1b024a171473bbd65bd8a9cf27f46167f3f38be04d56280b7348abe23440a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64

    Filesize

    472B

    MD5

    452e11716ea4843afe2f66561e31bed5

    SHA1

    36e2c61b5ead22352683945567e75f3bfbfc6b3c

    SHA256

    9daa8523616103e9dd1f7ba52b95b16fcf1b6935d43488db6abf5467dceab917

    SHA512

    b9089c671248e5a4b47742756da9837ae49da54a9cd3072624266adaaf69bcc32dabde6fcd1b7529ec6fefa3b127ec745ce425f3de22bc3cff1b922be8075d89

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    170B

    MD5

    c1e3d1e6bf1268828b50bbe9fef28e40

    SHA1

    8499aac8e1863b89548d64e2b52afec3c59863f8

    SHA256

    2eafb4445917a6c3e4f0dda54480d0a7930920ed2da3f1009bac688eadff034d

    SHA512

    0b1cb3484df05e905a3c41b9cb5d0cf9634738fbde30bcd7fb75e67c52ca6f05d8932e8a88daad6daf36d665202613c087127850f3de8ac8d35dff031c43efdd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    14d35798f0d6367079bb70e42cea7da4

    SHA1

    cab3992e5d376f353cca68ff1565b2322b592a40

    SHA256

    8df5069df50f04cbecacc7e9c1f40e40af12d767c428521f45ad6ce89a07062d

    SHA512

    f7cd1e5f77162d26359b20361c3a2d6e0be1d8876910077aceac5559644cc4b912be8540afa47d031fea87617c5305881cc6fb235bb61b52f8bd34660cbc1dbb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD

    Filesize

    406B

    MD5

    740ad5a3443b1ce34ca4927788d72703

    SHA1

    2bdf9fba52c02efeaeaab7ae9767a8499d71c09f

    SHA256

    33ea7a3854f76ff3e8eebeb4a5af6ea2753b4743b4c8892c0af2444bc10d19af

    SHA512

    86ec8f387e5a4e5a52024b100d5bdb1df82702c834943031f0bf6c68f506c7d01b3f5fecfc9aefd5b6af0ed281a7fc57c5865cd002bee6419295643b26316b14

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64

    Filesize

    402B

    MD5

    26c82aee502b3a7984d8f6d3d3b992e7

    SHA1

    031c2817004be0111797f49ad71aefdca66c3e43

    SHA256

    76ccd8933a01e69ac7a70120161a638392c8ce6ffa8fd0cfa90e67dfd89d3829

    SHA512

    db4b68d450641386888a7c278ac25029b14a25c142b8c137736a85cb90fc245688e68ad1299c7a6226e551d91eacf2284b4b2e11dbd03e026d44275b410e3204

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4cct4q5m.hkd.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Melibiose.Spa

    Filesize

    53KB

    MD5

    1f737850c90e5d135b2a519df3ce86a4

    SHA1

    3d539ea4291810b1191eb671d8369b0cfa6d6f1d

    SHA256

    dbc22a96f5153282b6037375b64d01887dbf9b978dd5eada76eaba847d8e7a3f

    SHA512

    677a27533f8505de074c2237fba524f250c6db2c5a02b9b89341a49cd49ea6ccca1126d5964de025414fcf2fac58aee798f2c5c1536ab80a8ada088f1fd85996

  • C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Thetombs20.Rel

    Filesize

    333KB

    MD5

    6c43ff6c8e656140c1dca9e969d7be44

    SHA1

    a834f6adece9367dd3926f2136a72bb29b54072d

    SHA256

    fe0ca437fd89e26cd99d3400ecf4af7f2f8de208d9e9ffec674add59a147b471

    SHA512

    f749284ff814901c56cd4c69ec33635cf93bb2582fb43f90b9c3030581de50826af88a4d2b4c063e631a0964c810ec6c70728206a1c6195d225dee5921fccf21

  • memory/648-127-0x0000000001050000-0x0000000001098000-memory.dmp

    Filesize

    288KB

  • memory/648-124-0x0000000001050000-0x00000000022A4000-memory.dmp

    Filesize

    18.3MB

  • memory/648-126-0x0000000001050000-0x00000000022A4000-memory.dmp

    Filesize

    18.3MB

  • memory/808-121-0x0000000000800000-0x0000000001A54000-memory.dmp

    Filesize

    18.3MB

  • memory/808-122-0x0000000000800000-0x0000000000848000-memory.dmp

    Filesize

    288KB

  • memory/808-123-0x0000000020EF0000-0x0000000020F8C000-memory.dmp

    Filesize

    624KB

  • memory/808-128-0x0000000021B80000-0x0000000021D42000-memory.dmp

    Filesize

    1.8MB

  • memory/808-129-0x00000000213A0000-0x00000000213F0000-memory.dmp

    Filesize

    320KB

  • memory/808-132-0x0000000021A70000-0x0000000021B02000-memory.dmp

    Filesize

    584KB

  • memory/808-133-0x0000000021A20000-0x0000000021A2A000-memory.dmp

    Filesize

    40KB

  • memory/2028-39-0x0000000006D70000-0x0000000006E06000-memory.dmp

    Filesize

    600KB

  • memory/2028-79-0x00000000739CE000-0x00000000739CF000-memory.dmp

    Filesize

    4KB

  • memory/2028-60-0x00000000739C0000-0x0000000074170000-memory.dmp

    Filesize

    7.7MB

  • memory/2028-59-0x0000000007240000-0x00000000072E3000-memory.dmp

    Filesize

    652KB

  • memory/2028-61-0x0000000007360000-0x000000000736A000-memory.dmp

    Filesize

    40KB

  • memory/2028-58-0x0000000007210000-0x000000000722E000-memory.dmp

    Filesize

    120KB

  • memory/2028-46-0x000000006FE50000-0x000000006FE9C000-memory.dmp

    Filesize

    304KB

  • memory/2028-45-0x00000000071D0000-0x0000000007202000-memory.dmp

    Filesize

    200KB

  • memory/2028-63-0x0000000007AE0000-0x0000000007B04000-memory.dmp

    Filesize

    144KB

  • memory/2028-62-0x00000000073A0000-0x00000000073CA000-memory.dmp

    Filesize

    168KB

  • memory/2028-8-0x0000000002730000-0x0000000002766000-memory.dmp

    Filesize

    216KB

  • memory/2028-9-0x00000000050F0000-0x0000000005718000-memory.dmp

    Filesize

    6.2MB

  • memory/2028-47-0x0000000070550000-0x00000000708A4000-memory.dmp

    Filesize

    3.3MB

  • memory/2028-11-0x00000000739C0000-0x0000000074170000-memory.dmp

    Filesize

    7.7MB

  • memory/2028-80-0x00000000739C0000-0x0000000074170000-memory.dmp

    Filesize

    7.7MB

  • memory/2028-21-0x0000000005720000-0x0000000005A74000-memory.dmp

    Filesize

    3.3MB

  • memory/2028-82-0x00000000739C0000-0x0000000074170000-memory.dmp

    Filesize

    7.7MB

  • memory/2028-10-0x00000000739C0000-0x0000000074170000-memory.dmp

    Filesize

    7.7MB

  • memory/2028-84-0x00000000739C0000-0x0000000074170000-memory.dmp

    Filesize

    7.7MB

  • memory/2028-51-0x00000000739C0000-0x0000000074170000-memory.dmp

    Filesize

    7.7MB

  • memory/2028-86-0x00000000739C0000-0x0000000074170000-memory.dmp

    Filesize

    7.7MB

  • memory/2028-44-0x0000000008020000-0x000000000869A000-memory.dmp

    Filesize

    6.5MB

  • memory/2028-42-0x00000000073F0000-0x0000000007994000-memory.dmp

    Filesize

    5.6MB

  • memory/2028-41-0x00000000062E0000-0x0000000006302000-memory.dmp

    Filesize

    136KB

  • memory/2028-7-0x00000000739CE000-0x00000000739CF000-memory.dmp

    Filesize

    4KB

  • memory/2028-40-0x0000000006270000-0x000000000628A000-memory.dmp

    Filesize

    104KB

  • memory/2028-12-0x0000000004E80000-0x0000000004EA2000-memory.dmp

    Filesize

    136KB

  • memory/2028-13-0x0000000004F20000-0x0000000004F86000-memory.dmp

    Filesize

    408KB

  • memory/2028-14-0x0000000005040000-0x00000000050A6000-memory.dmp

    Filesize

    408KB

  • memory/2028-26-0x0000000005E30000-0x0000000005E7C000-memory.dmp

    Filesize

    304KB

  • memory/2028-25-0x0000000005D90000-0x0000000005DAE000-memory.dmp

    Filesize

    120KB

  • memory/2252-85-0x00000000739C0000-0x0000000074170000-memory.dmp

    Filesize

    7.7MB

  • memory/2252-27-0x00000000739C0000-0x0000000074170000-memory.dmp

    Filesize

    7.7MB

  • memory/2252-28-0x00000000739C0000-0x0000000074170000-memory.dmp

    Filesize

    7.7MB

  • memory/2252-38-0x00000000739C0000-0x0000000074170000-memory.dmp

    Filesize

    7.7MB

  • memory/2252-83-0x00000000739C0000-0x0000000074170000-memory.dmp

    Filesize

    7.7MB

  • memory/2252-78-0x0000000008590000-0x0000000009CB2000-memory.dmp

    Filesize

    23.1MB

  • memory/2252-65-0x0000000070550000-0x00000000708A4000-memory.dmp

    Filesize

    3.3MB

  • memory/2252-64-0x000000006FE50000-0x000000006FE9C000-memory.dmp

    Filesize

    304KB