vipkeylogger | 06795a5a7eb5d44e427c0adeeac9867dd8f2e0a73b2bbbbba47b36c10df70bce

Analysis

max time kernel
22s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/11/2024, 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Maksājums10312024,jpg.exe
Size

1.4MB
MD5

d155bbf3b7aeebfcd96f0ad99ab8d634
SHA1

22150906ad0e14b9385ae7fd079f37d960be4213
SHA256

140f74d6834ec93d4279dd1f3c9efe3a0a68c8ee78a63cb9556d990fd6753fe5
SHA512

eb3b5ff3b002329bb6ea0e1c1ed30d0273b361984dfc8942f1d5cc34f4462d9499cfbfb8742f6f31d93f3416c6936c00aa379cc3f5b0a6f78380746f1f12dc6c
SSDEEP

24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8aTdo8vtaByatj8iZCMkb0k//Mz:sTvC/MTQYxsWR7aTNveHtRZCM+M

Score

10^/10

vipkeylogger discovery keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2696 set thread context of 2964	2696	Maksājums10312024,jpg.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Maksājums10312024,jpg.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2964	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2696	Maksājums10312024,jpg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2964	2696	Maksājums10312024,jpg.exe	31
PID 2696 wrote to memory of 2964	2696	Maksājums10312024,jpg.exe	31
PID 2696 wrote to memory of 2964	2696	Maksājums10312024,jpg.exe	31
PID 2696 wrote to memory of 2964	2696	Maksājums10312024,jpg.exe	31
PID 2696 wrote to memory of 2964	2696	Maksājums10312024,jpg.exe	31

C:\Users\Admin\AppData\Local\Temp\Maksājums10312024,jpg.exe
"C:\Users\Admin\AppData\Local\Temp\Maksājums10312024,jpg.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Maksājums10312024,jpg.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2696-2-0x0000000000D10000-0x0000000000E10000-memory.dmp

Filesize
1024KB

Download
memory/2964-3-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2964-7-0x00000000745BE000-0x00000000745BF000-memory.dmp

Filesize
4KB

Download
memory/2964-8-0x00000000009B0000-0x00000000009FE000-memory.dmp

Filesize
312KB

Download
memory/2964-5-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2964-10-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-9-0x0000000004090000-0x00000000040DE000-memory.dmp

Filesize
312KB

Download
memory/2964-11-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-13-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-12-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-6-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2964-14-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2964-15-0x00000000745BE000-0x00000000745BF000-memory.dmp

Filesize
4KB

Download
memory/2964-16-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-17-0x00000000745B0000-0x0000000074C9E000-memory.dmp

Filesize
6.9MB

Download