Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-10-2024 09:52
Static task
static1
Behavioral task
behavioral1
Sample
226999705-124613-sanlccjavap0004-67.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
226999705-124613-sanlccjavap0004-67.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Alphabetism.ps1
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Alphabetism.ps1
Resource
win10v2004-20241007-en
General
-
Target
226999705-124613-sanlccjavap0004-67.exe
-
Size
980KB
-
MD5
3496733f467e1bb42564ad985eb7e4bf
-
SHA1
a7ee45e43e2c18b48a3f7fd2db51d60d4f8a303b
-
SHA256
bce4a013376b64f537dacb8d7667847f0d1d20f5e73494aee22cddc86af5366b
-
SHA512
c95486995e16f19954cb3d110693c9dd9635e5fd2d75fd998974ff5479851f56118efc90f0905c698aaf2274c4aa63cd70a2316a4f829348cd540a0f7e6f36dd
-
SSDEEP
24576:U+63T2jeQojtnk3VKvNr8xAGuwIm/yWiopvC9wd:U+/j96Lq/RaWi6Mwd
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
smtp.ionos.es - Port:
587 - Username:
[email protected] - Password:
Escaragol?24 - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
msiexec.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
Blocklisted process makes network request 8 IoCs
Processes:
msiexec.exeflow pid process 26 3480 msiexec.exe 28 3480 msiexec.exe 30 3480 msiexec.exe 32 3480 msiexec.exe 36 3480 msiexec.exe 49 3480 msiexec.exe 53 3480 msiexec.exe 57 3480 msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 48 checkip.dyndns.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
msiexec.exepid process 3480 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
powershell.exemsiexec.exepid process 4564 powershell.exe 3480 msiexec.exe -
Drops file in Windows directory 3 IoCs
Processes:
226999705-124613-sanlccjavap0004-67.exedescription ioc process File created C:\Windows\resources\0409\syntonolydian\statsminister.lnk 226999705-124613-sanlccjavap0004-67.exe File opened for modification C:\Windows\resources\0409\federalt\Telephonists230.Ube 226999705-124613-sanlccjavap0004-67.exe File opened for modification C:\Windows\resources\snagline.sub 226999705-124613-sanlccjavap0004-67.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
powershell.exemsiexec.exe226999705-124613-sanlccjavap0004-67.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 226999705-124613-sanlccjavap0004-67.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
powershell.exemsiexec.exepid process 4564 powershell.exe 4564 powershell.exe 4564 powershell.exe 4564 powershell.exe 4564 powershell.exe 4564 powershell.exe 4564 powershell.exe 4564 powershell.exe 4564 powershell.exe 3480 msiexec.exe 3480 msiexec.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
powershell.exepid process 4564 powershell.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
powershell.exemsiexec.exedescription pid process Token: SeDebugPrivilege 4564 powershell.exe Token: SeIncreaseQuotaPrivilege 4564 powershell.exe Token: SeSecurityPrivilege 4564 powershell.exe Token: SeTakeOwnershipPrivilege 4564 powershell.exe Token: SeLoadDriverPrivilege 4564 powershell.exe Token: SeSystemProfilePrivilege 4564 powershell.exe Token: SeSystemtimePrivilege 4564 powershell.exe Token: SeProfSingleProcessPrivilege 4564 powershell.exe Token: SeIncBasePriorityPrivilege 4564 powershell.exe Token: SeCreatePagefilePrivilege 4564 powershell.exe Token: SeBackupPrivilege 4564 powershell.exe Token: SeRestorePrivilege 4564 powershell.exe Token: SeShutdownPrivilege 4564 powershell.exe Token: SeDebugPrivilege 4564 powershell.exe Token: SeSystemEnvironmentPrivilege 4564 powershell.exe Token: SeRemoteShutdownPrivilege 4564 powershell.exe Token: SeUndockPrivilege 4564 powershell.exe Token: SeManageVolumePrivilege 4564 powershell.exe Token: 33 4564 powershell.exe Token: 34 4564 powershell.exe Token: 35 4564 powershell.exe Token: 36 4564 powershell.exe Token: SeDebugPrivilege 3480 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
226999705-124613-sanlccjavap0004-67.exepowershell.exedescription pid process target process PID 2776 wrote to memory of 4564 2776 226999705-124613-sanlccjavap0004-67.exe powershell.exe PID 2776 wrote to memory of 4564 2776 226999705-124613-sanlccjavap0004-67.exe powershell.exe PID 2776 wrote to memory of 4564 2776 226999705-124613-sanlccjavap0004-67.exe powershell.exe PID 4564 wrote to memory of 3480 4564 powershell.exe msiexec.exe PID 4564 wrote to memory of 3480 4564 powershell.exe msiexec.exe PID 4564 wrote to memory of 3480 4564 powershell.exe msiexec.exe PID 4564 wrote to memory of 3480 4564 powershell.exe msiexec.exe -
outlook_office_path 1 IoCs
Processes:
msiexec.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
outlook_win_path 1 IoCs
Processes:
msiexec.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\226999705-124613-sanlccjavap0004-67.exe"C:\Users\Admin\AppData\Local\Temp\226999705-124613-sanlccjavap0004-67.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Bentinas=Get-Content -raw 'C:\Users\Admin\AppData\Local\fona\Kvit\Alphabetism.Pre';$Mesocardium=$Bentinas.SubString(53974,3);.$Mesocardium($Bentinas)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3480
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
52KB
MD5cd7e46b01dd5a4d151b79a64c053c906
SHA1de93ac5f7194e81de277bcafcd0deb8c00308e5a
SHA256575008f2a446a1a6c7817a571622b79935b1a07316a7276b7b4308f773b7284b
SHA51296d4892c094f415d3c635bb9e9493a6d1c7ada6ea97b9b6df6a23b548511181d24dd3fd27e49df497bdcc878fb0009d2710cebbd427558cf91f89a71aeb0afa9
-
Filesize
316KB
MD5dccd26366e977c50c8f074b3fe7c5368
SHA1e07cdd760cf5b837910149ef4fdd3da49b1942db
SHA2561ceda590c7286d96500369210522187d2b2158d67c4bf5195a65f7c839a008e0
SHA512f9e5a72a404df41bfeaef36c9b972614d2ca119ba94ea134a1dbd6b9f69f30eddab67c8bd66d5c5e8a99042bae83695b7a43063385cec3f9af8ab3bf8c6de3f9
-
Filesize
962B
MD54175ecb262be1bc4e64242555f578c79
SHA183561197740e3e597bef4e41067463e09834d860
SHA256c0dd8d05ab7bf58e4ed4c4643d5e6879a66efb93b715412652ece73d00032ca7
SHA512ba3d9d008462d2fb99e6581c74661c8cc1757520312688562a3765a333cf29bd4b5e15f94e2c8c057969b123fe62a6abe2826ce24b3c198d22ffd98ef924c74d