Analysis

  • max time kernel
    119s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-11-2024 12:23

General

  • Target

    7588c8b1634597293f6caed069525f90e356576ac0b83b3cb6004c31929f7072N.exe

  • Size

    902KB

  • MD5

    04ef02931ad93c3c4376434c20f486f0

  • SHA1

    652201adcb624d1142aa01d7bde4dfc8977c1ea5

  • SHA256

    7588c8b1634597293f6caed069525f90e356576ac0b83b3cb6004c31929f7072

  • SHA512

    027685796daeee8a1bc38d57f5599ba9e62465f3aebddbe104bc3abd3b473f5ea1f9bb23486ac8688809d9fe5a176e9ec6e6a59ac568ef7458af0dbb6fa00a2c

  • SSDEEP

    12288:p5e/L/uQGchtN0FxSb7nT3tCMipEPfDurlKRFP7Pytafm6wY8yujWX6zZmvj1Gp:ebu6bN0FUb7FiWfD6lm7Pytae6/B1Gp

Malware Config

Extracted

Family

vipkeylogger

Credentials

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Vipkeylogger family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
  • Blocklisted process makes network request 13 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7588c8b1634597293f6caed069525f90e356576ac0b83b3cb6004c31929f7072N.exe
    "C:\Users\Admin\AppData\Local\Temp\7588c8b1634597293f6caed069525f90e356576ac0b83b3cb6004c31929f7072N.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Momentaneously=Get-Content -raw 'C:\Users\Admin\AppData\Local\peritonealizing\nomadeinvasioners\stofhandskernes\Dokumentationsniveau\Stockings.Cys';$Nontolerance95=$Momentaneously.SubString(3409,3);.$Nontolerance95($Momentaneously)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5048
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1648
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Momentaneously=Get-Content -raw 'C:\Users\Admin\AppData\Local\peritonealizing\nomadeinvasioners\stofhandskernes\Dokumentationsniveau\Stockings.Cys';$Nontolerance95=$Momentaneously.SubString(3409,3);.$Nontolerance95($Momentaneously)"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4252
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    854B

    MD5

    e935bc5762068caf3e24a2683b1b8a88

    SHA1

    82b70eb774c0756837fe8d7acbfeec05ecbf5463

    SHA256

    a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

    SHA512

    bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    5060c037573e8c49d2b974402dbb036f

    SHA1

    0fbc98aef6faab88fd16a642f48f7470f78ca50a

    SHA256

    b25254fb513c8875b550f9c3d0955a2a9d59868efc075872eb4c8d378271c4fc

    SHA512

    f984db7055f57209580e018dfd7c7558ea6480f3e50ca2079fca5377425cbf52b085355fda5fcbad9e7c1581e13445124c04ed65c0978e3a8201e15521104023

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_CC847C1C687BCB4C6B5074DF051D733B

    Filesize

    471B

    MD5

    85838d5f34f49465643c3b88b31084b2

    SHA1

    90394723146d8e01ce13211c66797e06cb5d14f4

    SHA256

    0c207ef93936f6ad3028086c21cd68e8d750393978119129680d792c596998d6

    SHA512

    0a5fcf4f95028191b29516b676d7a04e09246344fe85892a0196ff431e6ccba037a5b1f504778f557d45f6b33056dc92bff38113f7a5b0eb250a7957cebcb76c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7

    Filesize

    472B

    MD5

    ff0954ade962b7cde97c7d480974fb19

    SHA1

    d68f3eccd23c0c92edc5195105e7a949b625c8d9

    SHA256

    71ed01c9358af7fa0b39937ad31a4fab9b3719ecfcbd131ac0037ce6d14b003c

    SHA512

    3509f70a5decba14b6253f726e6f860e9d899f7ea3bd4586063f87f0823fb2e59225319425ab538a199bdaa781148a8b9ca307e9a0f30d91dea560a27cf25dd7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    170B

    MD5

    c6b99b9f0efe216cd1e29a9770a99c1f

    SHA1

    b1703da79d491ce48336edb48ac47395a24f2e76

    SHA256

    04aad4cfa071d176479fda85ee5056619b93edcdfd5be9322c20af29f08ed5b9

    SHA512

    e0e0fe9953feaebc6913085cfed4f6cc6866a3bff63e5f31b602f771f1c78728c6687004ab6b669f9a79e7fe7ab827acd8f1d6fb8435c38beea686723ef92f15

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    e9362d7338b1fe68a8f88fbd706ed2a4

    SHA1

    8720f50abada01066e2d2e954e8f9913069f3258

    SHA256

    f2b6d75397734a29e2be0c9cfff560272f0b0a8069d5beb2e7c74838f68600ac

    SHA512

    52cc5e10d08263c67d6c3df4420e45a30e05de82005293e470c249f4484a2901b0ad479b3dc41f5bf518a666d706cd06011e12f0c7656fd60ef4b8a7dcacf218

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_CC847C1C687BCB4C6B5074DF051D733B

    Filesize

    402B

    MD5

    e11ba4abe6c5270980b0265f4f590efe

    SHA1

    0cb547b733d60e5c418d6647d6215287013a81af

    SHA256

    4c862c7c6c595b595eff57802b8b9f3f92b9135bf325994ac614636f63c4d69c

    SHA512

    b1c78d0f3c030a31d549c205cbbbdd870245fef9e6e3b7c92e9a9f272e0762b4cc6b8745c6c47c9621f21de301490d32dd578d6d7da0f31c6a52028cafe17cad

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7

    Filesize

    398B

    MD5

    8868ea395b63a34dec48a8f76e5cfe9b

    SHA1

    eb1eeda17e0e079fae5a4964709a7fa531de0abf

    SHA256

    64d6d794cc0d80f7f5d2506e1d7d75aab7c9e346e6050e3f73073fca3bd41f9b

    SHA512

    c2ca7c9b3ef090b7649de3e40a48abf882e35d128bc6b7c4cf7232b00561214e5af34437031b1a778ce8f1a65f9cf2dc568d8f065475be62cfc067c48de56558

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Damascenere.lnk

    Filesize

    775B

    MD5

    fb241d07e8b3558780b49a931067493f

    SHA1

    ed95b20fead530b5877817a20a8b629cd25f95b5

    SHA256

    62ad1d76ff6fd74fb79518f040a9f3b8823bb2d02c59b99d0e26a1f186c6e298

    SHA512

    a848644033ea3b2066de5847b1201ee6b766ea7405ba1adc7565c8e4dacc26513a4564b6d65850fe4bd49c84391bc5a5241b8603fa56cfb72352ac06dd621c8c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Damascenere.lnk

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_imvsq22j.5uo.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\peritonealizing\nomadeinvasioners\stofhandskernes\Dokumentationsniveau\Stockings.Cys

    Filesize

    54KB

    MD5

    6bacab132c443a2683b2d0de8cc9b00a

    SHA1

    fb935821154d82a76d41876899bb2a608b13647b

    SHA256

    96583ae3cc6a5dfdebf1422de15fde533d7fda45f63aa36a10de9103db1860fe

    SHA512

    ecc8c0d080115eb41ccae723bf86a7e6a25ffa73d5f0e632dddd650d0fa4a6b7219a5bee09429f58f2418552b4102d8b28f8bd769c3434fdf14a4126497bb2b1

  • C:\Users\Admin\AppData\Local\peritonealizing\nomadeinvasioners\stofhandskernes\Superdubiousness.Cha

    Filesize

    310KB

    MD5

    978f59a1f10ab98b598eb3bb6eef0add

    SHA1

    5664a52766c2d35aa4b327040721489b14294769

    SHA256

    70a02024cbde31d7be2f3a1e30f52b74f7ab43d9a3cb7db7cb8c5580d29a0b8c

    SHA512

    6303dbef7a9d381fb43b63a00d73cf5f27dbf5c09395598d996829c66802a1149f1743bfabc8be3f3277b36d85f6ea8086f96c63181dfdfbc643cc9abe885e1d

  • C:\Windows\Resources\Nebengeschfter.ini

    Filesize

    32B

    MD5

    53898e643bd3e0ca22a462325ad62da4

    SHA1

    e0f08a75fa5219f39e49c1b9f361119905da7d02

    SHA256

    b947991000aea669ebfeadfb12de45121d46ad3dfd02296f373f9bf8ce4f1aff

    SHA512

    aa17b99a93a04f7bbbb92f34c15921da80e20592a39b3921f1d3cc59fae55f66196b2be4f56716846daff041253cb63d7e373b84234d451181c87f1d097fe8ca

  • memory/1112-420-0x0000000001000000-0x0000000002254000-memory.dmp

    Filesize

    18.3MB

  • memory/1112-421-0x0000000001000000-0x0000000001048000-memory.dmp

    Filesize

    288KB

  • memory/1648-424-0x0000000022550000-0x00000000225A0000-memory.dmp

    Filesize

    320KB

  • memory/1648-423-0x0000000022CF0000-0x0000000022EB2000-memory.dmp

    Filesize

    1.8MB

  • memory/1648-416-0x0000000000D80000-0x0000000001FD4000-memory.dmp

    Filesize

    18.3MB

  • memory/1648-418-0x0000000022230000-0x00000000222CC000-memory.dmp

    Filesize

    624KB

  • memory/1648-417-0x0000000000D80000-0x0000000000DC8000-memory.dmp

    Filesize

    288KB

  • memory/1648-427-0x0000000022650000-0x00000000226E2000-memory.dmp

    Filesize

    584KB

  • memory/1648-428-0x0000000022600000-0x000000002260A000-memory.dmp

    Filesize

    40KB

  • memory/4252-344-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/4252-341-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/4252-395-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/4252-391-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/4252-366-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/4252-389-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/4252-374-0x0000000070550000-0x00000000708A4000-memory.dmp

    Filesize

    3.3MB

  • memory/4252-373-0x000000006FDD0000-0x000000006FE1C000-memory.dmp

    Filesize

    304KB

  • memory/5048-188-0x0000000006AD0000-0x0000000006AF2000-memory.dmp

    Filesize

    136KB

  • memory/5048-343-0x000000006FDD0000-0x000000006FE1C000-memory.dmp

    Filesize

    304KB

  • memory/5048-371-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/5048-369-0x0000000007B90000-0x0000000007BBA000-memory.dmp

    Filesize

    168KB

  • memory/5048-368-0x0000000007B30000-0x0000000007B3A000-memory.dmp

    Filesize

    40KB

  • memory/5048-386-0x000000007395E000-0x000000007395F000-memory.dmp

    Filesize

    4KB

  • memory/5048-385-0x0000000008E90000-0x000000000B5CF000-memory.dmp

    Filesize

    39.2MB

  • memory/5048-387-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/5048-388-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/5048-367-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/5048-355-0x00000000079A0000-0x00000000079BE000-memory.dmp

    Filesize

    120KB

  • memory/5048-392-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/5048-393-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/5048-394-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/5048-342-0x00000000079C0000-0x00000000079F2000-memory.dmp

    Filesize

    200KB

  • memory/5048-370-0x00000000082D0000-0x00000000082F4000-memory.dmp

    Filesize

    144KB

  • memory/5048-364-0x0000000007A10000-0x0000000007AB3000-memory.dmp

    Filesize

    652KB

  • memory/5048-345-0x0000000070550000-0x00000000708A4000-memory.dmp

    Filesize

    3.3MB

  • memory/5048-193-0x0000000008810000-0x0000000008E8A000-memory.dmp

    Filesize

    6.5MB

  • memory/5048-189-0x0000000007BE0000-0x0000000008184000-memory.dmp

    Filesize

    5.6MB

  • memory/5048-187-0x0000000006A80000-0x0000000006A9A000-memory.dmp

    Filesize

    104KB

  • memory/5048-186-0x0000000007540000-0x00000000075D6000-memory.dmp

    Filesize

    600KB

  • memory/5048-182-0x0000000006580000-0x000000000659E000-memory.dmp

    Filesize

    120KB

  • memory/5048-183-0x0000000006620000-0x000000000666C000-memory.dmp

    Filesize

    304KB

  • memory/5048-175-0x0000000005F50000-0x00000000062A4000-memory.dmp

    Filesize

    3.3MB

  • memory/5048-168-0x0000000005E70000-0x0000000005ED6000-memory.dmp

    Filesize

    408KB

  • memory/5048-169-0x0000000005EE0000-0x0000000005F46000-memory.dmp

    Filesize

    408KB

  • memory/5048-167-0x0000000005570000-0x0000000005592000-memory.dmp

    Filesize

    136KB

  • memory/5048-166-0x0000000005650000-0x0000000005C78000-memory.dmp

    Filesize

    6.2MB

  • memory/5048-165-0x0000000073950000-0x0000000074100000-memory.dmp

    Filesize

    7.7MB

  • memory/5048-164-0x0000000002F50000-0x0000000002F86000-memory.dmp

    Filesize

    216KB

  • memory/5048-163-0x000000007395E000-0x000000007395F000-memory.dmp

    Filesize

    4KB