Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-10-2024 01:35

General

  • Target

    963d35a92ffdbbdd35c71fc392a73ce49e242ca1b80f94204ef714cc42bbf8d0.exe

  • Size

    867KB

  • MD5

    25da279ad7ee7cc3b8d3e5cd5aa4b5b2

  • SHA1

    d1fc6cbe8d8cca235ed29de6b109a0cb951eb5f3

  • SHA256

    963d35a92ffdbbdd35c71fc392a73ce49e242ca1b80f94204ef714cc42bbf8d0

  • SHA512

    db074cfe6c006f194b8b4ca983fb83a88229beb229504c8eba07140fe490974e90dfe75b66b9c4d81bd319fdaaccc822473064771b7ac8d333012859f139498e

  • SSDEEP

    12288:l9Zwb4/I1H06OdtVQuqilUSDFOIBETeVlCE7vkQymGwSW01hXqvjoaCi7lnsZz0W:/dPFtVtOIB+alCJmvulW6Nd0vu

Malware Config

Extracted

Family

vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Blocklisted process makes network request 16 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\963d35a92ffdbbdd35c71fc392a73ce49e242ca1b80f94204ef714cc42bbf8d0.exe
    "C:\Users\Admin\AppData\Local\Temp\963d35a92ffdbbdd35c71fc392a73ce49e242ca1b80f94204ef714cc42bbf8d0.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Seppo=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Kontokurantens.Unc';$Underviseren=$Seppo.SubString(52189,3);.$Underviseren($Seppo)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3676
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:628
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Seppo=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Kontokurantens.Unc';$Underviseren=$Seppo.SubString(52189,3);.$Underviseren($Seppo)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3456
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:2472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    854B

    MD5

    e935bc5762068caf3e24a2683b1b8a88

    SHA1

    82b70eb774c0756837fe8d7acbfeec05ecbf5463

    SHA256

    a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

    SHA512

    bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    76b2de4276a82861ed2fc9622aca4532

    SHA1

    121d53d4ccd29ff917c424c703a718f4ce811172

    SHA256

    a5d281814ab7745a410c2de4e66244f253662f3c78fdc0d2a280632afab807e4

    SHA512

    de2758ac45fd6d48008c9ad0f58e71d064e6284f8665cd09794f9d1a6d6c2747ed7c9be6f6a784c530b72290c0de015849e9a650e2ddd7172dda1dba79562605

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD

    Filesize

    471B

    MD5

    ed2bc277627fe9729bb6e14fc0ca8651

    SHA1

    45904821d33b90391b60e1c78283343b40167f79

    SHA256

    7d3aa148aa339df14b24d65c7ec460b0bec9067dee838ef9a48a1028e393a99b

    SHA512

    e02dd1357820ef6824580e5d9277ffcaa8540f936ae076de3dca4a61c2ab4ad0b4d1b024a171473bbd65bd8a9cf27f46167f3f38be04d56280b7348abe23440a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64

    Filesize

    472B

    MD5

    452e11716ea4843afe2f66561e31bed5

    SHA1

    36e2c61b5ead22352683945567e75f3bfbfc6b3c

    SHA256

    9daa8523616103e9dd1f7ba52b95b16fcf1b6935d43488db6abf5467dceab917

    SHA512

    b9089c671248e5a4b47742756da9837ae49da54a9cd3072624266adaaf69bcc32dabde6fcd1b7529ec6fefa3b127ec745ce425f3de22bc3cff1b922be8075d89

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    170B

    MD5

    21a7970c25a078b65c5dc62049dbb8ad

    SHA1

    a748981e50aca774c23308e8c0c48be93de54c3b

    SHA256

    ce62852692f0ceac64667adfd39543604ff2387303ad85be25632d5651749881

    SHA512

    a169dca197116675c7c03fbc3c53e8f9cafe07f956ccfcbdfd8fe798d81b4d087c10407cbc40bdddb228645719917cb361cbc73d7bcbf4395e6b27638ec35a5c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    3586bcf785a9b5e614212ba28e5a4f25

    SHA1

    4ea9569065e877458fba16c4e57de43192589252

    SHA256

    bd540672b4bdf4b0d1e5ec3e234fee7a3186b37b45847bd0a3ca07c07493b746

    SHA512

    728b977fded95ec86a45b9632a592a7853c6f7b1786666ee961d00d0ecde111a9b08a6eaf401ac14b46ebcb7069b4aa01a6f407d35458d8ad1e407eef1b64d2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_B60DAD4239F8DBB7FDA230724F9F9DFD

    Filesize

    406B

    MD5

    c546e0bbf27c0c58d2d4eff99e2ba7d6

    SHA1

    0d88537bd1de14795c8e308a88e2a7189e92edcd

    SHA256

    ce50f7e6a83f8c3f88c198a7ad96f50536aa363cb8fba62b042aac1fffd45a5b

    SHA512

    1ad3555644287c10d2421345e03d5046bf2ff0aa7f7b9e5f3e23ba368ba140c67be47cbe46a51dba172e14386914e975855c19417982beb9e3e94aee08628d30

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_3459237E893F04A4596206DC25825D64

    Filesize

    402B

    MD5

    f4d186701aa36a7117d76d4f6dc81971

    SHA1

    e291596f8819b2289a831d3380c2e7341453da2f

    SHA256

    52090518efb169d6c809b232d61229440996e2f00fbd654ca6bbaf13a6d740da

    SHA512

    9fac811b8e507fd6dd84338d5f6379ecb45619199c5c9361fbb4f0cb7fae6f9ee8a7861b6d1724bc89fdba9037c3c64e7497f32641e6e47216fe369e4ecaa5c1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    Filesize

    53KB

    MD5

    01404e51f6442f60e478c306b1e6e52e

    SHA1

    37f234ccf5611b8309023410ceb9e76ad81f5678

    SHA256

    d4356dd23aa2e811712132f9718786331661a1bd0d062c49cb76807b9563928b

    SHA512

    94a9d843ae4055e2a9b412f03cba85e2d7b804ec3106f059d14ca50b15ae4acc6cd452f9461c2e21d1632d06848c969732c539aea17869b8b3a2f5ab93b891d7

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rpttyzw2.afj.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Associerendes.Lov

    Filesize

    334KB

    MD5

    8dc34d1e450d9695f44738379365b189

    SHA1

    9e77d26860ba038a647b6670fd0ddd2c961d0666

    SHA256

    fb8575b17a714bab821f43e25454975876348a6ccf9fb580f25351311d09690b

    SHA512

    f842056d5dcd6f43c88ff6ba91eb6207d3fa48b4e38f050a756fbe3d281cf8483def8a4221f63407953d589be05a7505c31fc6df12a0ed77dd64581e27722f08

  • C:\Users\Admin\AppData\Roaming\underarmsmusklens\Edriophthalmian\Kontokurantens.Unc

    Filesize

    50KB

    MD5

    8a4da8bab6993bc24f8ba89b1a5035ba

    SHA1

    0266616ebaff76b9027bdf4a52742bbb6d7dbf90

    SHA256

    d19add8d848501931650d9c2f77d4519b15ffe2399a161dac88ea99c07f1b62d

    SHA512

    1f604a65b0fb4543feab6eb9584aab3c47c5ebcabf251492c7be827e3c5d547f310ff05354bf30837fe8192be427c1855ec22783a0be14db15b40b1f05a13c50

  • memory/628-128-0x0000000001290000-0x00000000012D8000-memory.dmp

    Filesize

    288KB

  • memory/628-125-0x0000000001290000-0x00000000024E4000-memory.dmp

    Filesize

    18.3MB

  • memory/628-129-0x0000000025690000-0x000000002572C000-memory.dmp

    Filesize

    624KB

  • memory/628-127-0x0000000001290000-0x00000000024E4000-memory.dmp

    Filesize

    18.3MB

  • memory/628-134-0x0000000026320000-0x00000000264E2000-memory.dmp

    Filesize

    1.8MB

  • memory/628-135-0x0000000025AA0000-0x0000000025AF0000-memory.dmp

    Filesize

    320KB

  • memory/628-138-0x00000000261F0000-0x0000000026282000-memory.dmp

    Filesize

    584KB

  • memory/628-139-0x0000000025B70000-0x0000000025B7A000-memory.dmp

    Filesize

    40KB

  • memory/2472-131-0x0000000000A20000-0x0000000000A68000-memory.dmp

    Filesize

    288KB

  • memory/2472-130-0x0000000000A20000-0x0000000001C74000-memory.dmp

    Filesize

    18.3MB

  • memory/3456-64-0x000000006F720000-0x000000006F76C000-memory.dmp

    Filesize

    304KB

  • memory/3456-65-0x000000006F890000-0x000000006FBE4000-memory.dmp

    Filesize

    3.3MB

  • memory/3456-26-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3456-27-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3456-28-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3456-91-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3456-81-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3456-80-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3456-79-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3676-75-0x000000007329E000-0x000000007329F000-memory.dmp

    Filesize

    4KB

  • memory/3676-41-0x0000000007DD0000-0x0000000008374000-memory.dmp

    Filesize

    5.6MB

  • memory/3676-59-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3676-58-0x0000000007BB0000-0x0000000007C53000-memory.dmp

    Filesize

    652KB

  • memory/3676-78-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3676-63-0x0000000007D20000-0x0000000007D44000-memory.dmp

    Filesize

    144KB

  • memory/3676-62-0x0000000007CF0000-0x0000000007D1A000-memory.dmp

    Filesize

    168KB

  • memory/3676-60-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

    Filesize

    40KB

  • memory/3676-82-0x0000000009080000-0x000000000E1E7000-memory.dmp

    Filesize

    81.4MB

  • memory/3676-83-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3676-84-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3676-86-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3676-45-0x000000006F720000-0x000000006F76C000-memory.dmp

    Filesize

    304KB

  • memory/3676-90-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3676-61-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3676-44-0x0000000007B40000-0x0000000007B72000-memory.dmp

    Filesize

    200KB

  • memory/3676-43-0x0000000008A00000-0x000000000907A000-memory.dmp

    Filesize

    6.5MB

  • memory/3676-7-0x000000007329E000-0x000000007329F000-memory.dmp

    Filesize

    4KB

  • memory/3676-39-0x0000000006C00000-0x0000000006C1A000-memory.dmp

    Filesize

    104KB

  • memory/3676-40-0x0000000006C50000-0x0000000006C72000-memory.dmp

    Filesize

    136KB

  • memory/3676-38-0x0000000007780000-0x0000000007816000-memory.dmp

    Filesize

    600KB

  • memory/3676-46-0x000000006F890000-0x000000006FBE4000-memory.dmp

    Filesize

    3.3MB

  • memory/3676-56-0x0000000007B80000-0x0000000007B9E000-memory.dmp

    Filesize

    120KB

  • memory/3676-57-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3676-24-0x00000000066E0000-0x00000000066FE000-memory.dmp

    Filesize

    120KB

  • memory/3676-25-0x0000000006710000-0x000000000675C000-memory.dmp

    Filesize

    304KB

  • memory/3676-23-0x0000000006120000-0x0000000006474000-memory.dmp

    Filesize

    3.3MB

  • memory/3676-12-0x0000000005FC0000-0x0000000006026000-memory.dmp

    Filesize

    408KB

  • memory/3676-13-0x0000000006030000-0x0000000006096000-memory.dmp

    Filesize

    408KB

  • memory/3676-11-0x00000000056B0000-0x00000000056D2000-memory.dmp

    Filesize

    136KB

  • memory/3676-9-0x0000000073290000-0x0000000073A40000-memory.dmp

    Filesize

    7.7MB

  • memory/3676-10-0x0000000005890000-0x0000000005EB8000-memory.dmp

    Filesize

    6.2MB

  • memory/3676-8-0x00000000050B0000-0x00000000050E6000-memory.dmp

    Filesize

    216KB