Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-10-2024 09:52

General

  • Target

    226999705-124613-sanlccjavap0004-67.exe

  • Size

    980KB

  • MD5

    3496733f467e1bb42564ad985eb7e4bf

  • SHA1

    a7ee45e43e2c18b48a3f7fd2db51d60d4f8a303b

  • SHA256

    bce4a013376b64f537dacb8d7667847f0d1d20f5e73494aee22cddc86af5366b

  • SHA512

    c95486995e16f19954cb3d110693c9dd9635e5fd2d75fd998974ff5479851f56118efc90f0905c698aaf2274c4aa63cd70a2316a4f829348cd540a0f7e6f36dd

  • SSDEEP

    24576:U+63T2jeQojtnk3VKvNr8xAGuwIm/yWiopvC9wd:U+/j96Lq/RaWi6Mwd

Malware Config

Extracted

Family

vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Blocklisted process makes network request 8 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\226999705-124613-sanlccjavap0004-67.exe
    "C:\Users\Admin\AppData\Local\Temp\226999705-124613-sanlccjavap0004-67.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "$Bentinas=Get-Content -raw 'C:\Users\Admin\AppData\Local\fona\Kvit\Alphabetism.Pre';$Mesocardium=$Bentinas.SubString(53974,3);.$Mesocardium($Bentinas)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4564
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:3480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rzknxhhb.a41.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\fona\Kvit\Alphabetism.Pre

    Filesize

    52KB

    MD5

    cd7e46b01dd5a4d151b79a64c053c906

    SHA1

    de93ac5f7194e81de277bcafcd0deb8c00308e5a

    SHA256

    575008f2a446a1a6c7817a571622b79935b1a07316a7276b7b4308f773b7284b

    SHA512

    96d4892c094f415d3c635bb9e9493a6d1c7ada6ea97b9b6df6a23b548511181d24dd3fd27e49df497bdcc878fb0009d2710cebbd427558cf91f89a71aeb0afa9

  • C:\Users\Admin\AppData\Local\fona\Kvit\Lamkws.Sap

    Filesize

    316KB

    MD5

    dccd26366e977c50c8f074b3fe7c5368

    SHA1

    e07cdd760cf5b837910149ef4fdd3da49b1942db

    SHA256

    1ceda590c7286d96500369210522187d2b2158d67c4bf5195a65f7c839a008e0

    SHA512

    f9e5a72a404df41bfeaef36c9b972614d2ca119ba94ea134a1dbd6b9f69f30eddab67c8bd66d5c5e8a99042bae83695b7a43063385cec3f9af8ab3bf8c6de3f9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\depoh.lnk

    Filesize

    962B

    MD5

    4175ecb262be1bc4e64242555f578c79

    SHA1

    83561197740e3e597bef4e41067463e09834d860

    SHA256

    c0dd8d05ab7bf58e4ed4c4643d5e6879a66efb93b715412652ece73d00032ca7

    SHA512

    ba3d9d008462d2fb99e6581c74661c8cc1757520312688562a3765a333cf29bd4b5e15f94e2c8c057969b123fe62a6abe2826ce24b3c198d22ffd98ef924c74d

  • memory/3480-224-0x0000000024A40000-0x0000000024A4A000-memory.dmp

    Filesize

    40KB

  • memory/3480-223-0x0000000025240000-0x00000000252D2000-memory.dmp

    Filesize

    584KB

  • memory/3480-221-0x0000000024960000-0x00000000249B0000-memory.dmp

    Filesize

    320KB

  • memory/3480-220-0x0000000025070000-0x0000000025232000-memory.dmp

    Filesize

    1.8MB

  • memory/3480-219-0x0000000024510000-0x00000000245AC000-memory.dmp

    Filesize

    624KB

  • memory/3480-218-0x0000000000CC0000-0x0000000000D08000-memory.dmp

    Filesize

    288KB

  • memory/3480-217-0x0000000000CC0000-0x0000000001F14000-memory.dmp

    Filesize

    18.3MB

  • memory/3480-216-0x0000000000CC0000-0x0000000001F14000-memory.dmp

    Filesize

    18.3MB

  • memory/4564-184-0x00000000074A0000-0x00000000074BE000-memory.dmp

    Filesize

    120KB

  • memory/4564-193-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-166-0x0000000006540000-0x000000000655A000-memory.dmp

    Filesize

    104KB

  • memory/4564-167-0x0000000006560000-0x0000000006582000-memory.dmp

    Filesize

    136KB

  • memory/4564-168-0x0000000007640000-0x0000000007BE4000-memory.dmp

    Filesize

    5.6MB

  • memory/4564-164-0x00000000060A0000-0x00000000060EC000-memory.dmp

    Filesize

    304KB

  • memory/4564-170-0x0000000008270000-0x00000000088EA000-memory.dmp

    Filesize

    6.5MB

  • memory/4564-173-0x00000000707F0000-0x0000000070B44000-memory.dmp

    Filesize

    3.3MB

  • memory/4564-183-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-185-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-172-0x0000000070660000-0x00000000706AC000-memory.dmp

    Filesize

    304KB

  • memory/4564-171-0x0000000007460000-0x0000000007492000-memory.dmp

    Filesize

    200KB

  • memory/4564-163-0x0000000006000000-0x000000000601E000-memory.dmp

    Filesize

    120KB

  • memory/4564-186-0x00000000074D0000-0x0000000007573000-memory.dmp

    Filesize

    652KB

  • memory/4564-187-0x00000000075D0000-0x00000000075DA000-memory.dmp

    Filesize

    40KB

  • memory/4564-188-0x0000000007610000-0x000000000763A000-memory.dmp

    Filesize

    168KB

  • memory/4564-189-0x0000000007D30000-0x0000000007D54000-memory.dmp

    Filesize

    144KB

  • memory/4564-190-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-191-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-165-0x0000000006FF0000-0x0000000007086000-memory.dmp

    Filesize

    600KB

  • memory/4564-162-0x0000000005A70000-0x0000000005DC4000-memory.dmp

    Filesize

    3.3MB

  • memory/4564-195-0x00000000741EE000-0x00000000741EF000-memory.dmp

    Filesize

    4KB

  • memory/4564-196-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-197-0x00000000088F0000-0x000000000CE7D000-memory.dmp

    Filesize

    69.6MB

  • memory/4564-198-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-199-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-200-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-201-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-203-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-157-0x0000000005900000-0x0000000005966000-memory.dmp

    Filesize

    408KB

  • memory/4564-156-0x00000000057E0000-0x0000000005846000-memory.dmp

    Filesize

    408KB

  • memory/4564-150-0x0000000005070000-0x0000000005092000-memory.dmp

    Filesize

    136KB

  • memory/4564-148-0x0000000005100000-0x0000000005728000-memory.dmp

    Filesize

    6.2MB

  • memory/4564-149-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-147-0x00000000741E0000-0x0000000074990000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-146-0x0000000002A50000-0x0000000002A86000-memory.dmp

    Filesize

    216KB

  • memory/4564-145-0x00000000741EE000-0x00000000741EF000-memory.dmp

    Filesize

    4KB