vipkeylogger | e763827e8385a621c0c28456d7c3fd0393b01d542b52a2b18bd5061492b97662

General

Target

SWIFT COPY 2.docx
Size

459KB
MD5

fd1963efc96cae15689f5e7eb9664b4b
SHA1

b4b13fc72a4bab883ae9ec4efc84cfe48c6b8d8a
SHA256

e763827e8385a621c0c28456d7c3fd0393b01d542b52a2b18bd5061492b97662
SHA512

50f91dba0d6180e02b8b1d5345ae024c9ed24666fb6c54e22798da122276dd1e1e85a43126826d9456e4db5e21fb762e9797d50f323cf498807d860935c04992
SSDEEP

6144:kMlcbR5HastSFXbqUAbqUAbqUvyLE8IIIIIW0ru0rqme6eeCe9vCeXhdrJ9tmYLk:/ARtUVhpr/rqIXt9mrm9Bt2mhW8G0YX

Score

10^/10

vipkeylogger discovery execution keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.covid19support.top
Port:
587
Username:
[email protected]
Password:
7213575aceACE@@
Email To:
[email protected]

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	2856	EQNEDT32.EXE

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1728	powershell.exe

Downloads MZ/PE file
Abuses OpenXML format to download file from external location

Executes dropped EXE 2 IoCs

pid	Process
1948	obirfsgjkfdsg.exe
2328	obirfsgjkfdsg.exe

Loads dropped DLL 6 IoCs

pid	Process
2856	EQNEDT32.EXE
956	WerFault.exe
956	WerFault.exe
956	WerFault.exe
956	WerFault.exe
956	WerFault.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	checkip.dyndns.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 2328	1948	obirfsgjkfdsg.exe	38

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
956	2328	WerFault.exe	38

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EQNEDT32.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	obirfsgjkfdsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	obirfsgjkfdsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Office loads VBA resources, possible macro or embedded object present

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
2856	EQNEDT32.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3024	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2328	obirfsgjkfdsg.exe
1728	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	obirfsgjkfdsg.exe
Token: SeDebugPrivilege	1728	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3024	WINWORD.EXE
3024	WINWORD.EXE

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 1948	2856	EQNEDT32.EXE	33
PID 2856 wrote to memory of 1948	2856	EQNEDT32.EXE	33
PID 2856 wrote to memory of 1948	2856	EQNEDT32.EXE	33
PID 2856 wrote to memory of 1948	2856	EQNEDT32.EXE	33
PID 3024 wrote to memory of 1368	3024	WINWORD.EXE	35
PID 3024 wrote to memory of 1368	3024	WINWORD.EXE	35
PID 3024 wrote to memory of 1368	3024	WINWORD.EXE	35
PID 3024 wrote to memory of 1368	3024	WINWORD.EXE	35
PID 1948 wrote to memory of 1728	1948	obirfsgjkfdsg.exe	36
PID 1948 wrote to memory of 1728	1948	obirfsgjkfdsg.exe	36
PID 1948 wrote to memory of 1728	1948	obirfsgjkfdsg.exe	36
PID 1948 wrote to memory of 1728	1948	obirfsgjkfdsg.exe	36
PID 1948 wrote to memory of 2328	1948	obirfsgjkfdsg.exe	38
PID 1948 wrote to memory of 2328	1948	obirfsgjkfdsg.exe	38
PID 1948 wrote to memory of 2328	1948	obirfsgjkfdsg.exe	38
PID 1948 wrote to memory of 2328	1948	obirfsgjkfdsg.exe	38
PID 1948 wrote to memory of 2328	1948	obirfsgjkfdsg.exe	38
PID 1948 wrote to memory of 2328	1948	obirfsgjkfdsg.exe	38
PID 1948 wrote to memory of 2328	1948	obirfsgjkfdsg.exe	38
PID 1948 wrote to memory of 2328	1948	obirfsgjkfdsg.exe	38
PID 1948 wrote to memory of 2328	1948	obirfsgjkfdsg.exe	38
PID 2328 wrote to memory of 956	2328	obirfsgjkfdsg.exe	39
PID 2328 wrote to memory of 956	2328	obirfsgjkfdsg.exe	39
PID 2328 wrote to memory of 956	2328	obirfsgjkfdsg.exe	39
PID 2328 wrote to memory of 956	2328	obirfsgjkfdsg.exe	39

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SWIFT COPY 2.docx"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1368

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Roaming\obirfsgjkfdsg.exe
  "C:\Users\Admin\AppData\Roaming\obirfsgjkfdsg.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\obirfsgjkfdsg.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- - C:\Users\Admin\AppData\Roaming\obirfsgjkfdsg.exe
    "C:\Users\Admin\AppData\Roaming\obirfsgjkfdsg.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 996
      4⤵
      Loads dropped DLL
      Program crash
      PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Exploitation for Client Execution

1

T1203

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{D4A4D759-428A-4F54-9C61-5C5B1E813594}.FSD

Filesize
128KB

MD5
b7b696d9c70c6a6caecaef5fa92e8580

SHA1
b98df6c7fcb55e40b972100714de324ff017b538

SHA256
6ae0f4fe6c3aff8dbef15e2b1204b8cb1502d780865388dc38169e938d593ce0

SHA512
da99b2c6dfb40cea86364832bfa94e209720befc645dada083efe4a87db0d0c179dfd7168bf3c7ef80a7e09b53dfa5d8a188838552c17de28dfb8e15e317166b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

Filesize
128KB

MD5
f523b640503613dac426ca005e43a97f

SHA1
13447d387112fd63bb03eeda8086af61b2ff77a1

SHA256
62bcd97495525d922cf382ea9c66b18fd5434cf6affc69c47edd4c286610999c

SHA512
f488bb9062b77bdf8242aacc42f3c70e4bb68c5c963f76440e5d44312df5e722f67463572699452e1edbb3cfccb21b1fa3ef54e64e0c3bc5e63a0e60d3e5ff6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

Filesize
128KB

MD5
ed133b59e0f2244c6ed7b3d9dac30f13

SHA1
ca00df555bec0a0614bf1295ed145cce542526b2

SHA256
b0e4cbf1bb3d7137942cf97013f05aeef5932276a7e87ce3e01719a4856d875f

SHA512
08cbafa284bb76d2c08ecec11772b629852f817a731ebfacc64eefa83f768f9154e3601c7665a1759a5c4cc4bbc161f264f9c92c2f735f5116f874499bc9b683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{E02648A0-D73D-4F36-B9E0-3FD5D8868662}.FSD

Filesize
128KB

MD5
ba77ac38f4e8de16cb59536241ae34a6

SHA1
c68a453a1a0c56fe2b729551cb9b2e66b3f23d09

SHA256
b8275298fd90ef63691275752522ffa54bb947a73334feca8a99aba3e6a8767e

SHA512
7774a41d3c86d48728a1a34c219434880ea5072a3c2bd8816de1e404ccedb84feb3103986d353452292fec0ba47b1b76ec110ae7c642c50764a1aa58cad92b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AS91FDNI\EN7nq8lm3v7yww0[1].doc

Filesize
920KB

MD5
7dcb918d1d06064ea8ac517cf90113cb

SHA1
d669c4f7b46d0ec5ef9d66bb8aa5a650913c9e4b

SHA256
4a1ca6523f044927f03a353dca5742012370035ee216214bb8f0342ed113763c

SHA512
cb3b4ab3281f9018d52f635843abb72b962ae158adf7cbb020986cf05aae9a506234090c6cd0d39adefbc3cd2becbe3ec19b11ae59e934cdafbf260b68a5aec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\{97FDB7E9-97FF-49D1-BE62-6E3A8DB30FE7}

Filesize
128KB

MD5
1a680a780ed50d1bc7f8e21873a525de

SHA1
e3218d2088af4b1a94cc9732b81589e64df80f6b

SHA256
fbb7686c071bbeb8e34b2a6cc586609a79151d8a6d9e84336f4046e43adb2f58

SHA512
d1a6ff4dae23cd8e60df1b85be2bc176d95d00a43cafc91237afd5c62985df5d59675e4fdc9107a580244c6579a25659aaed5aa36167c011ec5a164f2e5a7cd7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
\Users\Admin\AppData\Roaming\obirfsgjkfdsg.exe

Filesize
834KB

MD5
4b68371dba131b97f5bce58054f59684

SHA1
0e4a34a65ff81594361188766039c1f2fa4c366a

SHA256
66c525114240093bc408138d4c93c51e7c09a235e183fca73ee66ebd150e4fe1

SHA512
898e2f9772146bd72934719e9b56ef40ecfb33e30a59ba1a911e2c14eb4feafab92ce68cfcd32f66ee05d7a34db58d3314e34045e038c3f0e1f6ca1b57066e20

Download Submit
memory/1948-94-0x00000000009D0000-0x0000000000AA6000-memory.dmp

Filesize
856KB

Download
memory/1948-101-0x00000000005F0000-0x000000000060C000-memory.dmp

Filesize
112KB

Download
memory/1948-111-0x0000000001EB0000-0x0000000001F3A000-memory.dmp

Filesize
552KB

Download
memory/2328-112-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2328-114-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2328-118-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2328-125-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2328-123-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2328-121-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2328-120-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2328-117-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/3024-100-0x00000000713ED000-0x00000000713F8000-memory.dmp

Filesize
44KB

Download
memory/3024-2-0x00000000713ED000-0x00000000713F8000-memory.dmp

Filesize
44KB

Download
memory/3024-0-0x000000002FD71000-0x000000002FD72000-memory.dmp

Filesize
4KB

Download
memory/3024-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing