Analysis
- max time kernel
144s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
06/11/2024, 02:21
General
- Target 2d3d809456f1b8181541bafb523c4ec83b4c4a4183378da9d9bd7b8d23aa79aa.exe
- Size 657KB
- Sample241106-ctf82sshqg
- SHA256 2d3d809456f1b8181541bafb523c4ec83b4c4a4183378da9d9bd7b8d23aa79aa
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.turktav.com
-
Port
587
-
Username
-
Password
)d!s~MV@X;!M
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Blocklisted process makes network request 8 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 3 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d3d809456f1b8181541bafb523c4ec83b4c4a4183378da9d9bd7b8d23aa79aa.exe"C:\Users\Admin\AppData\Local\Temp\2d3d809456f1b8181541bafb523c4ec83b4c4a4183378da9d9bd7b8d23aa79aa.exe"1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Bogdebat=Get-Content -raw 'C:\Users\Admin\AppData\Local\Mixende\Klausuleringerne\otherworldly.Kas';$Urfugl=$Bogdebat.SubString(55559,3);.$Urfugl($Bogdebat)2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Administrationschefer.Unp52
otherworldly.Kas
__PSScriptPolicyTest_zglrgkp4.rxi.ps1
memory/3088-25-0x00000000068C0000-0x000000000690C000-memory.dmp
memory/3088-10-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3088-11-0x00000000058C0000-0x00000000058E2000-memory.dmp
memory/3088-12-0x00000000060A0000-0x0000000006106000-memory.dmp
memory/3088-13-0x0000000006110000-0x0000000006176000-memory.dmp
memory/3088-9-0x0000000005980000-0x0000000005FA8000-memory.dmp
memory/3088-23-0x0000000006280000-0x00000000065D4000-memory.dmp
memory/3088-24-0x0000000006870000-0x000000000688E000-memory.dmp
memory/3088-6-0x00000000742BE000-0x00000000742BF000-memory.dmp
memory/3088-26-0x0000000006E20000-0x0000000006EB6000-memory.dmp
memory/3088-27-0x0000000006D80000-0x0000000006D9A000-memory.dmp
memory/3088-28-0x0000000007870000-0x0000000007892000-memory.dmp
memory/3088-29-0x0000000007ED0000-0x0000000008474000-memory.dmp
memory/3088-8-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3088-31-0x0000000008B00000-0x000000000917A000-memory.dmp
memory/3088-32-0x0000000007AC0000-0x0000000007AF2000-memory.dmp
memory/3088-33-0x0000000070740000-0x000000007078C000-memory.dmp
memory/3088-35-0x0000000070D10000-0x0000000071064000-memory.dmp
memory/3088-45-0x0000000007D00000-0x0000000007D1E000-memory.dmp
memory/3088-34-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3088-48-0x0000000007E30000-0x0000000007E3A000-memory.dmp
memory/3088-46-0x0000000007D30000-0x0000000007DD3000-memory.dmp
memory/3088-47-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3088-50-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3088-51-0x0000000007EA0000-0x0000000007EC4000-memory.dmp
memory/3088-49-0x0000000007E70000-0x0000000007E9A000-memory.dmp
memory/3088-52-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3088-55-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3088-54-0x00000000742BE000-0x00000000742BF000-memory.dmp
memory/3088-56-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3088-7-0x0000000005310000-0x0000000005346000-memory.dmp
memory/3088-58-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3088-60-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3088-59-0x0000000009180000-0x000000000BA51000-memory.dmp
memory/3088-61-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3088-62-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3088-63-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/4620-77-0x0000000000E80000-0x0000000000EC2000-memory.dmp
memory/4620-76-0x0000000000E80000-0x00000000020D4000-memory.dmp
memory/4620-78-0x0000000021EB0000-0x0000000021F4C000-memory.dmp
memory/4620-80-0x0000000022B70000-0x0000000022D32000-memory.dmp
memory/4620-81-0x00000000223B0000-0x0000000022400000-memory.dmp
memory/4620-82-0x00000000224A0000-0x0000000022532000-memory.dmp
memory/4620-83-0x0000000022D50000-0x0000000022D5A000-memory.dmp