Analysis
- max time kernel
135s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
06/11/2024, 00:16
General
- Target Order.exe
- Size 937KB
- Sample241106-akgr4strgr
- SHA256 e3c81d02ea9f4168e60e8d6b41230245bfbaed8a67b9f23f7fe00ffb4931ce19
Malware Config
Extracted
-
vipkeylogger
-
https://api.telegram.org/bot6820629737:AAGJ8tOkoD9jFHkd_L1kG1ntQ1J6zLhFsMc/sendMessage?chat_id=6783205225
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Keily\nasal.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
nasal.exe
benting
memory/3112-19-0x0000000005510000-0x0000000005AB4000-memory.dmp
memory/3112-20-0x0000000004F60000-0x0000000004FFC000-memory.dmp
memory/3112-28-0x0000000006560000-0x000000000656A000-memory.dmp
memory/3112-27-0x00000000065E0000-0x0000000006672000-memory.dmp
memory/3112-26-0x0000000073F40000-0x00000000746F0000-memory.dmp
memory/3112-15-0x0000000000400000-0x000000000044A000-memory.dmp
memory/3112-25-0x0000000006A70000-0x0000000006F9C000-memory.dmp
memory/3112-18-0x0000000073F4E000-0x0000000073F4F000-memory.dmp
memory/3112-24-0x0000000006210000-0x0000000006260000-memory.dmp
memory/3112-23-0x0000000006370000-0x0000000006532000-memory.dmp
memory/3112-21-0x0000000073F40000-0x00000000746F0000-memory.dmp
memory/3112-22-0x0000000073F4E000-0x0000000073F4F000-memory.dmp
memory/3736-0-0x0000000000100000-0x0000000000301000-memory.dmp
memory/3736-3-0x0000000001380000-0x0000000001780000-memory.dmp
memory/3736-7-0x0000000000100000-0x0000000000301000-memory.dmp
memory/3976-8-0x00000000009D0000-0x0000000000BD1000-memory.dmp
memory/3976-17-0x00000000009D0000-0x0000000000BD1000-memory.dmp
memory/3976-13-0x0000000001200000-0x0000000001600000-memory.dmp