Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
08/11/2024, 12:14
General
- Target d47cf218c7f1a32c556e0501c3d1f00c420fa75ace47ad2b4fd6242aec388580.exe
- Size 632KB
- Sample241108-pebfgasbrf
- SHA256 d47cf218c7f1a32c556e0501c3d1f00c420fa75ace47ad2b4fd6242aec388580
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
smtp.ionos.fr
-
Port
587
-
Username
-
Password
Rajahsouthfruits5
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 2 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d47cf218c7f1a32c556e0501c3d1f00c420fa75ace47ad2b4fd6242aec388580.exe"C:\Users\Admin\AppData\Local\Temp\d47cf218c7f1a32c556e0501c3d1f00c420fa75ace47ad2b4fd6242aec388580.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Paasknnelsers=Get-Content -raw 'C:\Users\Admin\AppData\Local\Skaberkrfters\Klembt\indgivelsers\Analytiske.Ant';$Besnrelsers=$Paasknnelsers.SubString(54211,3);.$Besnrelsers($Paasknnelsers)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Kvartsholdigt.exe"C:\Users\Admin\AppData\Local\Temp\Kvartsholdigt.exe"3⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Paasknnelsers=Get-Content -raw 'C:\Users\Admin\AppData\Local\Skaberkrfters\Klembt\indgivelsers\Analytiske.Ant';$Besnrelsers=$Paasknnelsers.SubString(54211,3);.$Besnrelsers($Paasknnelsers)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Kvartsholdigt.exe"C:\Users\Admin\AppData\Local\Temp\Kvartsholdigt.exe"3⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
05DDC6AA91765AACACDB0A5F96DF8199
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
4FA45AE1010E09657982D8D28B3BD38E_CC847C1C687BCB4C6B5074DF051D733B
B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7
05DDC6AA91765AACACDB0A5F96DF8199
05DDC6AA91765AACACDB0A5F96DF8199
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
4FA45AE1010E09657982D8D28B3BD38E_CC847C1C687BCB4C6B5074DF051D733B
B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7
ModuleAnalysisCache
Analytiske.Ant
Organicistic250.Chr
Kvartsholdigt.exe
__PSScriptPolicyTest_xftusg5y.wmg.ps1
memory/624-132-0x0000000000480000-0x00000000016D4000-memory.dmp
memory/3508-45-0x0000000070080000-0x00000000700CC000-memory.dmp
memory/3508-83-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3508-40-0x0000000007710000-0x0000000007732000-memory.dmp
memory/3508-41-0x0000000007D80000-0x0000000008324000-memory.dmp
memory/3508-38-0x0000000006C70000-0x0000000006D06000-memory.dmp
memory/3508-43-0x00000000089B0000-0x000000000902A000-memory.dmp
memory/3508-44-0x0000000007B60000-0x0000000007B92000-memory.dmp
memory/3508-53-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3508-59-0x0000000007B40000-0x0000000007B5E000-memory.dmp
memory/3508-7-0x0000000005180000-0x00000000051B6000-memory.dmp
memory/3508-9-0x00000000057F0000-0x0000000005E18000-memory.dmp
memory/3508-11-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3508-46-0x0000000070480000-0x00000000707D4000-memory.dmp
memory/3508-15-0x0000000005F00000-0x0000000005F66000-memory.dmp
memory/3508-70-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3508-72-0x0000000007D20000-0x0000000007D4A000-memory.dmp
memory/3508-73-0x0000000007D50000-0x0000000007D74000-memory.dmp
memory/3508-6-0x0000000073BFE000-0x0000000073BFF000-memory.dmp
memory/3508-25-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3508-26-0x0000000006170000-0x00000000064C4000-memory.dmp
memory/3508-97-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3508-37-0x0000000006760000-0x00000000067AC000-memory.dmp
memory/3508-79-0x0000000073BFE000-0x0000000073BFF000-memory.dmp
memory/3508-13-0x0000000005E90000-0x0000000005EF6000-memory.dmp
memory/3508-86-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3508-82-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3508-39-0x0000000006C20000-0x0000000006C3A000-memory.dmp
memory/3508-84-0x0000000009030000-0x000000000D0F3000-memory.dmp
memory/3628-69-0x0000000007C10000-0x0000000007CB3000-memory.dmp
memory/3628-77-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3628-88-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3628-36-0x0000000006750000-0x000000000676E000-memory.dmp
memory/3628-80-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3628-96-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3628-12-0x00000000056A0000-0x00000000056C2000-memory.dmp
memory/3628-76-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3628-74-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3628-14-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3628-87-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3628-71-0x0000000007D20000-0x0000000007D2A000-memory.dmp
memory/3628-58-0x0000000070480000-0x00000000707D4000-memory.dmp
memory/3628-52-0x0000000070080000-0x00000000700CC000-memory.dmp
memory/3628-10-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3628-8-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/3628-81-0x0000000073BF0000-0x00000000743A0000-memory.dmp
memory/4404-134-0x0000000000480000-0x00000000016D4000-memory.dmp
memory/4404-136-0x0000000000480000-0x00000000004C8000-memory.dmp
memory/4404-137-0x0000000023CF0000-0x0000000023D8C000-memory.dmp
memory/4404-141-0x00000000249F0000-0x0000000024BB2000-memory.dmp
memory/4404-142-0x0000000024BC0000-0x0000000024C10000-memory.dmp
memory/4404-145-0x0000000024C90000-0x0000000024D22000-memory.dmp
memory/4404-146-0x0000000024D60000-0x0000000024D6A000-memory.dmp