Analysis
- max time kernel
148s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
08/11/2024, 15:15
General
- Target fatura.exe
- Size 929KB
- Sample241108-smwcdsvbka
- SHA256 ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903
Malware Config
Extracted
-
vipkeylogger
-
https://api.telegram.org/bot6820629737:AAGJ8tOkoD9jFHkd_L1kG1ntQ1J6zLhFsMc/sendMessage?chat_id=6783205225
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
- Suspicious use of SetThreadContext 1 IoCs
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fatura.exe"C:\Users\Admin\AppData\Local\Temp\fatura.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Keily\murkest.exe"C:\Users\Admin\AppData\Local\Temp\fatura.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\fatura.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
murkest.exe
memory/1672-7-0x0000000000620000-0x000000000081D000-memory.dmp
memory/1672-14-0x0000000000D00000-0x0000000001100000-memory.dmp
memory/1672-21-0x0000000000620000-0x000000000081D000-memory.dmp
memory/1740-0-0x0000000000B80000-0x0000000000D7D000-memory.dmp
memory/1740-3-0x00000000011E0000-0x00000000015E0000-memory.dmp
memory/1740-9-0x0000000000B80000-0x0000000000D7D000-memory.dmp
memory/2152-65-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-53-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-20-0x0000000000400000-0x0000000000441000-memory.dmp
memory/2152-17-0x0000000000400000-0x0000000000441000-memory.dmp
memory/2152-22-0x0000000073F5E000-0x0000000073F5F000-memory.dmp
memory/2152-23-0x0000000002870000-0x00000000028D0000-memory.dmp
memory/2152-24-0x0000000073F50000-0x0000000074700000-memory.dmp
memory/2152-25-0x0000000073F50000-0x0000000074700000-memory.dmp
memory/2152-26-0x0000000005660000-0x0000000005C04000-memory.dmp
memory/2152-27-0x0000000004F80000-0x0000000004FDE000-memory.dmp
memory/2152-31-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-51-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-85-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-83-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-81-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-79-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-78-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-75-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-73-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-71-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-69-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-67-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-16-0x0000000000400000-0x0000000000441000-memory.dmp
memory/2152-61-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-59-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-57-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-55-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-18-0x0000000000400000-0x0000000000441000-memory.dmp
memory/2152-49-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-47-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-45-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-43-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-39-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-37-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-63-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-29-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-28-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-41-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-35-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-33-0x0000000004F80000-0x0000000004FD8000-memory.dmp
memory/2152-1120-0x00000000050B0000-0x000000000514C000-memory.dmp
memory/2152-1121-0x0000000073F50000-0x0000000074700000-memory.dmp
memory/2152-1122-0x0000000000400000-0x0000000000441000-memory.dmp
memory/2152-1123-0x0000000073F5E000-0x0000000073F5F000-memory.dmp
memory/2152-1124-0x0000000073F50000-0x0000000074700000-memory.dmp
memory/2152-1125-0x0000000073F50000-0x0000000074700000-memory.dmp
memory/2152-1126-0x0000000073F50000-0x0000000074700000-memory.dmp
memory/2152-1127-0x0000000073F50000-0x0000000074700000-memory.dmp
memory/2152-1128-0x00000000064F0000-0x00000000066B2000-memory.dmp
memory/2152-1129-0x00000000063B0000-0x0000000006400000-memory.dmp
memory/2152-1130-0x0000000006BF0000-0x000000000711C000-memory.dmp
memory/2152-1131-0x0000000006760000-0x00000000067F2000-memory.dmp
memory/2152-1132-0x0000000006710000-0x000000000671A000-memory.dmp