vipkeylogger | 6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5

General

Target

6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe
Size

972KB
MD5

faaeca52d0c68d9b5574032cd91bacac
SHA1

f26d81b5697b350bc857c0a91d7c2a05d9b8ccf2
SHA256

6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5
SHA512

ddd6e1496b422a59eb9a4c4ae1a98a1cf7978abe741f68264ff1e41aeb66394179eecd0f10479ac74906a62e351f525c8cf644e18f40da6d7cd6140cd17c4cec
SSDEEP

12288:tqiaD9ZddrmFBBYLc1u1rmNa1zF6rWowo3lItWMTCJqCOlQ:RM93ozYLb1CNGcrh9+tW40OO

Score

10^/10

vipkeylogger discovery keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
hosting1.ro.hostsailor.com
Port:
587
Username:
[email protected]
Password:
7213575aceACE@@
Email To:
[email protected]

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Loads dropped DLL 2 IoCs

pid	Process
1508	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe
1508	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	checkip.dyndns.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
280	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1508	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe
280	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1508 set thread context of 280	1508	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe	31

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\backstrap\lejekassernerne.Osc55	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe
File opened for modification	C:\Windows\resources\ttningslisternes\Poulardes50.sto	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
280	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1508	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	280	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 280	1508	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe	31
PID 1508 wrote to memory of 280	1508	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe	31
PID 1508 wrote to memory of 280	1508	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe	31
PID 1508 wrote to memory of 280	1508	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe	31
PID 1508 wrote to memory of 280	1508	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe	31
PID 1508 wrote to memory of 280	1508	6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe	31

C:\Users\Admin\AppData\Local\Temp\6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe
"C:\Users\Admin\AppData\Local\Temp\6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Users\Admin\AppData\Local\Temp\6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe
  "C:\Users\Admin\AppData\Local\Temp\6062a990795f7af3b1199402759b849f50a98bc6702a5b8dd3298bebcca108a5.exe"
  2⤵
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nseF0F8.tmp

Filesize
60B

MD5
bf52d40b1511466d295685b54dbc3d59

SHA1
88162c1863a24daf1f888b5c13aec2f03b6898ac

SHA256
54d387d41b4e0e02dea90966ff6c8e28b66741b74cd43380fb02638d643d8919

SHA512
6b99610a877d14ec763574171a55e30a35343012388ad0c9f5a5fc2525dfd3f3d388041e188d5eb332bab0b7283b869802d27a0e5441d4a00e954f610b2c9f7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoF097.tmp

Filesize
74B

MD5
16d513397f3c1f8334e8f3e4fc49828f

SHA1
4ee15afca81ca6a13af4e38240099b730d6931f0

SHA256
d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36

SHA512
4a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstF108.tmp

Filesize
56B

MD5
bb7e90db1f0b57af0d0b53819d13ec01

SHA1
6af6105d870c458fab9ee20b3bcc4060e3172a13

SHA256
b3b03b5bec21acaa9b8ca4906ef2a4fcb404490ceccdb4d7859189bcf61f6c78

SHA512
b85eafb4003ee1cc1c3413371148f9b08a36042aedb84f412189829f5f80a82a21945c4f3abf1e872a15e81cb7e528bd634cb6bc3d2c334b1d4a9cb8692b42c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF0D7.tmp

Filesize
52B

MD5
5d04a35d3950677049c7a0cf17e37125

SHA1
cafdd49a953864f83d387774b39b2657a253470f

SHA256
a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266

SHA512
c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyF1C4.tmp

Filesize
30B

MD5
f15bfdebb2df02d02c8491bde1b4e9bd

SHA1
93bd46f57c3316c27cad2605ddf81d6c0bde9301

SHA256
c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043

SHA512
1757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1

Download Submit
\Users\Admin\AppData\Local\Temp\nstF0B7.tmp\System.dll

Filesize
11KB

MD5
6ad39193ed20078aa1b23c33a1e48859

SHA1
95e70e4f47aa1689cc08afbdaef3ec323b5342fa

SHA256
b9631423a50c666faf2cc6901c5a8d6eb2fecd306fdd2524256b7e2e37b251c2

SHA512
78c89bb8c86f3b68e5314467eca4e8e922d143335081fa66b01d756303e1aec68ed01f4be7098dbe06a789ca32a0f31102f5ba408bc5ab28e61251611bb4f62b

Download Submit
memory/280-569-0x0000000076FC0000-0x0000000077169000-memory.dmp

Filesize
1.7MB

Download
memory/280-570-0x0000000000480000-0x00000000014E2000-memory.dmp

Filesize
16.4MB

Download
memory/280-571-0x0000000000480000-0x00000000004C8000-memory.dmp

Filesize
288KB

Download
memory/1508-567-0x0000000076FC1000-0x00000000770C2000-memory.dmp

Filesize
1.0MB

Download
memory/1508-568-0x0000000076FC0000-0x0000000077169000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing