Analysis

  • max time kernel
    133s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-10-2024 06:59

General

  • Target

    FINAL SHIPPING DOCS.exe

  • Size

    1.2MB

  • MD5

    6512e4d388177410e48046e3c357e3ba

  • SHA1

    bb948656b8965a0d0648e8a21d468385b9d8daee

  • SHA256

    3fb2216af508fb7f6d8e248f586a2b637865ac885bb4da8b736f343dd719f862

  • SHA512

    207a58ef5b1d083f6a622d84aeec7aada62b11f5e7f6ac0b43cf847204d28f3cd5c53cfeeeafbeb07de6c960ccddad9b83aca286a2334d37a18f744096ffe2f3

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLwmOb1lKAoHpr0rvOfsWZsnhh2rmIc5Vmb7i:f3v+7/5QLVAiwvOyh2rsVmb7i

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.ujexchange.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    UJ@2022

Extracted

Family

vipkeylogger

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FINAL SHIPPING DOCS.exe
    "C:\Users\Admin\AppData\Local\Temp\FINAL SHIPPING DOCS.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3360
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\FINAL SHIPPING DOCS.exe"
      2⤵
        PID:2712
      • C:\Users\Admin\AppData\Local\Temp\FINAL SHIPPING DOCS.exe
        "C:\Users\Admin\AppData\Local\Temp\FINAL SHIPPING DOCS.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Users\Admin\AppData\Local\Temp\FINAL SHIPPING DOCS.exe"
          3⤵
            PID:60
          • C:\Users\Admin\AppData\Local\Temp\FINAL SHIPPING DOCS.exe
            "C:\Users\Admin\AppData\Local\Temp\FINAL SHIPPING DOCS.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2808
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
              "C:\Users\Admin\AppData\Local\Temp\FINAL SHIPPING DOCS.exe"
              4⤵
              • Accesses Microsoft Outlook profiles
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • outlook_office_path
              • outlook_win_path
              PID:1324

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Milburt

        Filesize

        243KB

        MD5

        ca25cfa6817514002ae8cfcc68d07176

        SHA1

        d4c7e99b1406f63d9727bf607bbad7c1ec396737

        SHA256

        ac1467e13856ddfd617ecc8668a9e215db77d24e2662ca1ab59cfede46b900f1

        SHA512

        2186c8c5911849fad464e8083ba1b5a1f08cc1acb4ecc15063532a7966cd1bd2f8564183441dc6911c66233ebd39bfd1e3a1d82bd7ded8ad21ba3fe0e1fbfe8c

      • C:\Users\Admin\AppData\Local\Temp\Milburt

        MD5

        d41d8cd98f00b204e9800998ecf8427e

        SHA1

        da39a3ee5e6b4b0d3255bfef95601890afd80709

        SHA256

        e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

        SHA512

        cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

      • memory/1324-11-0x0000000000400000-0x0000000000441000-memory.dmp

        Filesize

        260KB

      • memory/1324-13-0x0000000000400000-0x0000000000441000-memory.dmp

        Filesize

        260KB

      • memory/1324-14-0x0000000000400000-0x0000000000441000-memory.dmp

        Filesize

        260KB

      • memory/1324-12-0x0000000000400000-0x0000000000441000-memory.dmp

        Filesize

        260KB

      • memory/1324-15-0x00000000056D0000-0x000000000572E000-memory.dmp

        Filesize

        376KB

      • memory/1324-16-0x0000000005D70000-0x0000000006314000-memory.dmp

        Filesize

        5.6MB

      • memory/1324-17-0x00000000057C0000-0x000000000581C000-memory.dmp

        Filesize

        368KB

      • memory/1324-71-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-77-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-75-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-73-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-69-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-67-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-65-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-63-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-57-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-55-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-53-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-51-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-47-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-45-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-43-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-41-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-39-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-35-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-33-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-29-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-27-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-23-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-21-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-18-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-61-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-59-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-50-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-37-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-31-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-25-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-19-0x00000000057C0000-0x0000000005817000-memory.dmp

        Filesize

        348KB

      • memory/1324-1108-0x00000000058C0000-0x000000000595C000-memory.dmp

        Filesize

        624KB

      • memory/1324-1109-0x0000000006D30000-0x0000000006EF2000-memory.dmp

        Filesize

        1.8MB

      • memory/1324-1110-0x0000000006BC0000-0x0000000006C10000-memory.dmp

        Filesize

        320KB

      • memory/1324-1111-0x0000000000400000-0x0000000000441000-memory.dmp

        Filesize

        260KB

      • memory/1324-1112-0x0000000007430000-0x000000000795C000-memory.dmp

        Filesize

        5.2MB

      • memory/1324-1113-0x0000000006FA0000-0x0000000007032000-memory.dmp

        Filesize

        584KB

      • memory/1324-1114-0x0000000006F20000-0x0000000006F2A000-memory.dmp

        Filesize

        40KB

      • memory/2040-6-0x0000000003C80000-0x0000000003E80000-memory.dmp

        Filesize

        2.0MB

      • memory/2808-10-0x0000000003CC0000-0x0000000003EC0000-memory.dmp

        Filesize

        2.0MB

      • memory/3360-2-0x00000000040F0000-0x00000000042F0000-memory.dmp

        Filesize

        2.0MB