Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2024 06:59
Static task
static1
Behavioral task
behavioral1
Sample
AmountXpayable.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
AmountXpayable.exe
Resource
win10v2004-20241007-en
General
-
Target
AmountXpayable.exe
-
Size
774KB
-
MD5
34cc9882e5f377e3cedc9cd76033afca
-
SHA1
2fe1fb1c072b31f9df45170add68c6c7cf59d27d
-
SHA256
326d05c29c46e6ca7f2f1a9b534d8a2ffb98a13f74f8f26fff2057ad1f8e0ca8
-
SHA512
fc8c41243ee2fc468a2df74ec573ccb955a05b580ed7855c007079edbede6b2e4872de847b73d530809a67edb672ce9932b6be14309e300a32d05e4392c3b45e
-
SSDEEP
12288:BJqGG8+FBxjYKsZAEEErsEKbRsuKJJtJ7e+fGR4o58gkR:dCF7URXr3K9stJi+fGGo5u
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7563060616:AAGgGu8pocoVNLzoow0Ge2U2GVDS9nDmL6Q/sendMessage?chat_id=7222025033
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AmountXpayable.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation AmountXpayable.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
AmountXpayable.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AmountXpayable.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AmountXpayable.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AmountXpayable.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 30 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
AmountXpayable.exedescription pid process target process PID 884 set thread context of 956 884 AmountXpayable.exe AmountXpayable.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
schtasks.exeAmountXpayable.exeAmountXpayable.exepowershell.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AmountXpayable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AmountXpayable.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
AmountXpayable.exepowershell.exeAmountXpayable.exepid process 884 AmountXpayable.exe 884 AmountXpayable.exe 884 AmountXpayable.exe 884 AmountXpayable.exe 884 AmountXpayable.exe 884 AmountXpayable.exe 3108 powershell.exe 884 AmountXpayable.exe 884 AmountXpayable.exe 884 AmountXpayable.exe 884 AmountXpayable.exe 884 AmountXpayable.exe 956 AmountXpayable.exe 3108 powershell.exe 956 AmountXpayable.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
AmountXpayable.exepowershell.exeAmountXpayable.exedescription pid process Token: SeDebugPrivilege 884 AmountXpayable.exe Token: SeDebugPrivilege 3108 powershell.exe Token: SeDebugPrivilege 956 AmountXpayable.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
AmountXpayable.exedescription pid process target process PID 884 wrote to memory of 3108 884 AmountXpayable.exe powershell.exe PID 884 wrote to memory of 3108 884 AmountXpayable.exe powershell.exe PID 884 wrote to memory of 3108 884 AmountXpayable.exe powershell.exe PID 884 wrote to memory of 3728 884 AmountXpayable.exe schtasks.exe PID 884 wrote to memory of 3728 884 AmountXpayable.exe schtasks.exe PID 884 wrote to memory of 3728 884 AmountXpayable.exe schtasks.exe PID 884 wrote to memory of 844 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 844 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 844 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 2520 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 2520 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 2520 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 1780 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 1780 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 1780 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 956 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 956 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 956 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 956 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 956 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 956 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 956 884 AmountXpayable.exe AmountXpayable.exe PID 884 wrote to memory of 956 884 AmountXpayable.exe AmountXpayable.exe -
outlook_office_path 1 IoCs
Processes:
AmountXpayable.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AmountXpayable.exe -
outlook_win_path 1 IoCs
Processes:
AmountXpayable.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AmountXpayable.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AmountXpayable.exe"C:\Users\Admin\AppData\Local\Temp\AmountXpayable.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\urzvuvVy.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\urzvuvVy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAC8C.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3728
-
-
C:\Users\Admin\AppData\Local\Temp\AmountXpayable.exe"C:\Users\Admin\AppData\Local\Temp\AmountXpayable.exe"2⤵PID:844
-
-
C:\Users\Admin\AppData\Local\Temp\AmountXpayable.exe"C:\Users\Admin\AppData\Local\Temp\AmountXpayable.exe"2⤵PID:2520
-
-
C:\Users\Admin\AppData\Local\Temp\AmountXpayable.exe"C:\Users\Admin\AppData\Local\Temp\AmountXpayable.exe"2⤵PID:1780
-
-
C:\Users\Admin\AppData\Local\Temp\AmountXpayable.exe"C:\Users\Admin\AppData\Local\Temp\AmountXpayable.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:956
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD530cc1c4c5c73b42517c389ab8c1a6b17
SHA1212ad387aae56cc4a3f881cde533f190a6571c02
SHA2562d2986beae554f1ba35eb5ab357c9a3d3303913a9e4daa7c731a88a3e37221a5
SHA5123fcb036807c712de61ce1ed8fddb95a04924aa08d41e1ad798d72961f8bd70d4cd874d69158ed6b50dbbf0cfbbf9388bc75aa64629f9794e404d2f45d067fc31