Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2024 14:10
Static task
static1
Behavioral task
behavioral1
Sample
248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe
-
Size
1008KB
-
MD5
ddb90d73f21bb04d0a0701542efc6a3c
-
SHA1
fc3f21cba36333991d3d417be080e28718f08bde
-
SHA256
248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2
-
SHA512
74aa87dfc14b0f3390ea64fd50e19e5e8eddaf41abcec7b45334468aedf6ecce65ece411e46a6481104e1ca99fa40e925e1f8fab19c9b677c97d8c5057748d1f
-
SSDEEP
12288:tqisoX8Q/V9qa5ZwLuEbimk3RjzF6rWowo3lItWMTCJqCOll:RHsQ9ovLSvcrh9+tW40O7
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.fibraunollc.top - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@@ - Email To:
[email protected]
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL 2 IoCs
pid Process 3020 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe 3020 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 checkip.dyndns.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1544 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3020 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe 1544 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3020 set thread context of 1544 3020 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe 95 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\resources\ttningslisternes\Poulardes50.sto 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe File opened for modification C:\Windows\resources\0409\backstrap\lejekassernerne.Osc55 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1544 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe 1544 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3020 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1544 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3020 wrote to memory of 1544 3020 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe 95 PID 3020 wrote to memory of 1544 3020 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe 95 PID 3020 wrote to memory of 1544 3020 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe 95 PID 3020 wrote to memory of 1544 3020 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe 95 PID 3020 wrote to memory of 1544 3020 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe 95 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe"C:\Users\Admin\AppData\Local\Temp\248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe"C:\Users\Admin\AppData\Local\Temp\248ee27dc6af4db223815e90c43103f7d96462a2ce88c0cfbfa2b25673c90ac2.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1544
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12B
MD5e456acec0ef7fda3aef06b03bb007e2f
SHA1a7168146dd22139e81563b24beb736179d1c8370
SHA25673842f82df7cfef99c471c4301ef8130ddcd65d831b069b880bd71695d2bf607
SHA512c641ae2e8961562f5fd0f2d258742b024c6564b3f3b6a1d3d642d72bf47a1d6c208055e31dc467a3ea41b7bac658bcbab6e1746daf08fe2484f0c860fb88d475
-
Filesize
19B
MD5a82a5da452642ddab3a7ee07f7c408df
SHA1cf937f2e7e57c21beaf57a2b7e0c4b77f37c63f7
SHA25684911471a6124a186d240b3b67eed83ba5a0a7cb911eefc790712d936c83d568
SHA51273ed822f62f762e6e8902b4a5c31ea9a0501926d2dd512f5e5285d39fa8b31e82e61294c99c341e0f2046d0cb0351396e8d97afc0ddc71d37c9b680cf757f5a0
-
Filesize
10B
MD5fa5eb52a9735c883abcf72a7f9cf2254
SHA1a043e3d3df1605300a2f5629ad7a302082814956
SHA25640ccdff1a037de0fb10d03ea9fe79c2c96e7f18c3c7dffd92b42c2f0ed749116
SHA512983e3f605f34f74e95db170da28f2584a74bf4d0047ea76c905c409e624d9db2a439e70beb07d8f879fb25549da52bb9cac6304281e2582d6e5b1b4f12ac21f2
-
Filesize
19B
MD59b81480d3420dfa314a7ca8c685e3c0f
SHA11bd4068ee9af7a94d6c59c563f191783b158c65b
SHA256ef5767399ab18e9604a1ce029f5ef4228a2421f599ab580bfff4e2e4fb6b409d
SHA5122b5ecd729d0a9b22e1744a17051745d929c686b14e3815787769d2d9577ccdf12686201a48c64103fa11d8525e70074300ea95d5e23b09bbd5df9e6752bb4731
-
Filesize
11KB
MD56ad39193ed20078aa1b23c33a1e48859
SHA195e70e4f47aa1689cc08afbdaef3ec323b5342fa
SHA256b9631423a50c666faf2cc6901c5a8d6eb2fecd306fdd2524256b7e2e37b251c2
SHA51278c89bb8c86f3b68e5314467eca4e8e922d143335081fa66b01d756303e1aec68ed01f4be7098dbe06a789ca32a0f31102f5ba408bc5ab28e61251611bb4f62b
-
Filesize
6B
MD550484c19f1afdaf3841a0d821ed393d2
SHA1c65a0fb7e74ffd2c9fc3a0f9aacb0f6a24b0a68b
SHA2566923dd1bc0460082c5d55a831908c24a282860b7f1cd6c2b79cf1bc8857c639c
SHA512d51a20d67571fe70bcd6c36e1382a3c342f42671c710090b75fcfc2405ce24488e03a7131eefe4751d0bd3aeaad816605ad10c8e3258d72fcf379e32416cbf3b
-
Filesize
8B
MD5c3cb69218b85c3260387fb582cb518dd
SHA1961c892ded09a4cbb5392097bb845ccba65902ad
SHA2561c329924865741e0222d3ead23072cfbed14f96e2b0432573068eb0640513101
SHA5122402fffeb89c531db742bf6f5466eee8fe13edf97b8ecfc2cace3522806b322924d1ca81dda25e59b4047b8f40ad11ae9216e0a0d5c7fc6beef4368eb9551422
-
Filesize
49B
MD560368bfdbde845633fbdb631d01c69af
SHA14b3a68b98d054ddd465dd03bf7b791266aa3ef25
SHA2561348ddead6b30e22258a0bbbb45246cba7c9bbe21348d28e857063ea0bcbfdf1
SHA5120faec262e08ca6c903521e53ac286c828b268f2df71db7b55bf38a1d43cc07e09605da65745c47a4cdf928f093b9ebedf66e9269f7ad8541c9f907801008f6ed
-
Filesize
56B
MD52563ed9a5f15b7b75be13f254f868dca
SHA1fe6f09d0fc7344e54543161695dd2f6b8ed1455f
SHA256984d94c5fd030638553b8398a286b3c3593be044bc951c27ab633befad97e761
SHA5127b4fd2210322a8bce12ec71cab491826d6d6be4d63007eee4301ae5fe6b5b5774f05a9c084a9328ef013141023842a599eb46208ba32b1955377b2f9033e33a2
-
Filesize
1B
MD58ce4b16b22b58894aa86c421e8759df3
SHA113fbd79c3d390e5d6585a21e11ff5ec1970cff0c
SHA2568254c329a92850f6d539dd376f4816ee2764517da5e0235514af433164480d7a
SHA5122af8a9104b3f64ed640d8c7e298d2d480f03a3610cbc2b33474321ec59024a48592ea8545e41e09d5d1108759df48ede0054f225df39d4f0f312450e0aa9dd25
-
Filesize
2B
MD525bc6654798eb508fa0b6343212a74fe
SHA115d5e1d3b948fd5986aaff7d9419b5e52c75fc93
SHA2568e5202705183bd3a20a29e224499b0f77a8273ee33cd93cca71043c57ad4bdfc
SHA5125868c6241ed3cfcc5c34bfe42e4b9f5c69e74975e524771d8c9f35cafc13fd01cd943ec4d8caefee79a1f4a457e69d20b7a86f88db83a5bc3e6bd8a619972898
-
Filesize
3B
MD54e27f2226785e9abbe046fc592668860
SHA128b18a7f383131df509f7191f946a32c5a2e410c
SHA25601a219245e1501fee01ce0baea8f6065ce5162cea12fa570689a07c9717be81d
SHA5122a23585835bdb5db8175cab265566042282841efdcee8aaba8b9b5d466b0f165c0c5973033ce94bb9a8f07a956689247981ea07ac5a51408263e1653d9710adb
-
Filesize
4B
MD5cde63b34c142af0a38cbe83791c964f8
SHA1ece2b194b486118b40ad12c1f0e9425dd0672424
SHA25665e2d70166c9a802b7ad2a87129b8945f083e5f268878790a9d1f1c03f47938d
SHA5120559d3d34ad64ccc27e685431c24fc6ead0f645db14fa0e125a64fb67dbd158c15432c1fc5407811aac8a3486090dfbcfcbc3c6bf5aa0ec73f979ef62d14853c
-
Filesize
5B
MD5e2fecc970546c3418917879fe354826c
SHA163f1c1dd01b87704a6b6c99fd9f141e0a3064f16
SHA256ff91566d755f5d038ae698a2cc0a7d4d14e5273afafc37b6f03afda163768fa0
SHA5123c4a68cbaee94f986515f43305a0e7620c14c30213d4a17db4a3e8a1b996764eb688bf733f472fc52073c2c80bb5229bb29411d7601aefe1c4370e230c341a0a
-
Filesize
9B
MD52b3884fe02299c565e1c37ee7ef99293
SHA1d8e2ef2a52083f6df210109fea53860ea227af9c
SHA256ae789a65914ed002efb82dad89e5a4d4b9ec8e7faae30d0ed6e3c0d20f7d3858
SHA512aeb9374a52d0ad99336bfd4ec7bb7c5437b827845b8784d9c21f7d96a931693604689f6adc3ca25fad132a0ad6123013211ff550f427fa86e4f26c122ac6a0fe
-
Filesize
10B
MD59a53fc1d7126c5e7c81bb5c15b15537b
SHA1e2d13e0fa37de4c98f30c728210d6afafbb2b000
SHA256a7de06c22e4e67908840ec3f00ab8fe9e04ae94fb16a74136002afbaf607ff92
SHA512b0bffbb8072dbdcfc68f0e632f727c08fe3ef936b2ef332c08486553ff2cef7b0bcdb400e421a117e977bb0fac17ce4706a8097e32d558a918433646b6d5f1a1
-
Filesize
16B
MD56cc8ad9db8f0ba7f81660ccd69b64a98
SHA191dc056ad77f912e803c37ffea075118f19e7634
SHA256cc88cad1427b013d4e18f53bbcf978b7d06baae78929230ef5c7ff06d2b8f03d
SHA51294272e4a4b39622a108f0d11fffc37825719aa911720c9a39482198e8360cbd11fdcd5535fa765f3c8677375da930f5dfd8408c3135bddd7a5a954397c85866a
-
Filesize
54B
MD53530051cabbb49cf27e05fb5d0081b02
SHA149f48d07329ec9d9e12a74e6d516c35fd4dcc68c
SHA25617874b4305e6623f5490e458bb695490f31ef79111435e010ad2fc8446029a19
SHA51248d9f91bcc3a06aecc6b0508cf19bf8b090248b10f9ccbe930a7a009cef71131b6609b13d43abeca72c3b945e33da5ec0eba867f1b8d0bccfb2094237deb0152