vipkeylogger | a2eecfa58a1a154e79979fa5f3ff39269d33e3624446bb60ce83800cc3ba19f8

General

Target

Shipping Documents 240384.exe
Size

771KB
MD5

70338f79bb11ee88003ea5f2d0d363c1
SHA1

85d426e23b7223faacea8b78c6de345098ccfbad
SHA256

50bcb2857ce3d005fad3479253fa1c7a8cf0cd667c16d9d7c292d9307011dadf
SHA512

bace26acc95d929c703e437d5adc360bb54190aaa6f054ff4e77a9bc183bf17603f4a806344de80538c0669ede1c5f085bae9c2a355cbfdbd3cf2d08c2df8295
SSDEEP

12288:113LrfXYb+9JKV6WpWlCFl2SQ2gkXb4uvzt0FpIrlIK25FBc:nYb+9i11HDIkXb4gztLIDFBc

Score

10^/10

vipkeylogger collection discovery execution keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.bulatpharmaceutical.com
Port:
587
Username:
[email protected]
Password:
XRM)dWOF&~z3
Email To:
[email protected]

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1896	powershell.exe
2776	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1680 set thread context of 1100	1680	Shipping Documents 240384.exe	36

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Shipping Documents 240384.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1680	Shipping Documents 240384.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1680	Shipping Documents 240384.exe
1680	Shipping Documents 240384.exe
1680	Shipping Documents 240384.exe
1680	Shipping Documents 240384.exe
1680	Shipping Documents 240384.exe
2776	powershell.exe
1896	powershell.exe
1100	RegSvcs.exe
1100	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1680	Shipping Documents 240384.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	1896	powershell.exe
Token: SeDebugPrivilege	1100	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1896	1680	Shipping Documents 240384.exe	30
PID 1680 wrote to memory of 1896	1680	Shipping Documents 240384.exe	30
PID 1680 wrote to memory of 1896	1680	Shipping Documents 240384.exe	30
PID 1680 wrote to memory of 1896	1680	Shipping Documents 240384.exe	30
PID 1680 wrote to memory of 2776	1680	Shipping Documents 240384.exe	32
PID 1680 wrote to memory of 2776	1680	Shipping Documents 240384.exe	32
PID 1680 wrote to memory of 2776	1680	Shipping Documents 240384.exe	32
PID 1680 wrote to memory of 2776	1680	Shipping Documents 240384.exe	32
PID 1680 wrote to memory of 2680	1680	Shipping Documents 240384.exe	34
PID 1680 wrote to memory of 2680	1680	Shipping Documents 240384.exe	34
PID 1680 wrote to memory of 2680	1680	Shipping Documents 240384.exe	34
PID 1680 wrote to memory of 2680	1680	Shipping Documents 240384.exe	34
PID 1680 wrote to memory of 1100	1680	Shipping Documents 240384.exe	36
PID 1680 wrote to memory of 1100	1680	Shipping Documents 240384.exe	36
PID 1680 wrote to memory of 1100	1680	Shipping Documents 240384.exe	36
PID 1680 wrote to memory of 1100	1680	Shipping Documents 240384.exe	36
PID 1680 wrote to memory of 1100	1680	Shipping Documents 240384.exe	36
PID 1680 wrote to memory of 1100	1680	Shipping Documents 240384.exe	36
PID 1680 wrote to memory of 1100	1680	Shipping Documents 240384.exe	36
PID 1680 wrote to memory of 1100	1680	Shipping Documents 240384.exe	36
PID 1680 wrote to memory of 1100	1680	Shipping Documents 240384.exe	36
PID 1680 wrote to memory of 1100	1680	Shipping Documents 240384.exe	36
PID 1680 wrote to memory of 1100	1680	Shipping Documents 240384.exe	36
PID 1680 wrote to memory of 1100	1680	Shipping Documents 240384.exe	36

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Shipping Documents 240384.exe
"C:\Users\Admin\AppData\Local\Temp\Shipping Documents 240384.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Shipping Documents 240384.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1896
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tdcorV.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2776
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tdcorV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpABBA.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpABBA.tmp

Filesize
1KB

MD5
99c4ae8cfa3b702b37c179c3231ade61

SHA1
635fc9b64f330740b1dbab555be5a15ff0e9bc05

SHA256
538b0b83ecf5b98269af84f919afc9d9715f7130129cf18d1ff8ead1118045c9

SHA512
c2a70b326d43e36837c0263aeeec0b5f96aefd8bcbaa178de3ce38117281c26c45475b12db8c5ca97a12df89b11f47e01a2ef1015b862e6f38956a99ce2cf7d4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
ff1f3f8b687d99050101c7ddce186e0e

SHA1
c186a3e4bca2da74f9ce650c24a756af3eac1f63

SHA256
d4b87862d68b9710b6d941050c188b691b3cb71568f9c00a3624773859baa0e1

SHA512
35267e030bddf562400a17bb82c32018061f78dc434256ef15e09fa82d1fbec0e1961b8a76d6b01bced5ca4c9e2b8fb3ded62d721329231898c683469fc74205

Download Submit
memory/1100-29-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1100-28-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1100-21-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1100-23-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1100-25-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1100-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1100-30-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1100-19-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1680-6-0x000000000AA10000-0x000000000AA9C000-memory.dmp

Filesize
560KB

Download
memory/1680-1-0x0000000000950000-0x0000000000A18000-memory.dmp

Filesize
800KB

Download
memory/1680-0-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

Filesize
4KB

Download
memory/1680-2-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/1680-3-0x0000000000920000-0x000000000093E000-memory.dmp

Filesize
120KB

Download
memory/1680-5-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/1680-4-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

Filesize
4KB

Download
memory/1680-31-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads