Analysis
- max time kernel
111s - max time network
98s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
08/11/2024, 18:43
General
- Target a286c68d65f2582414caf8229aeaba8365d7b84de92c5da4c39b7482136b5271N.exe
- Size 900KB
- Sample241108-xc5waswpgt
- SHA256 a286c68d65f2582414caf8229aeaba8365d7b84de92c5da4c39b7482136b5271
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
smtp.ionos.es
-
Port
587
-
Username
-
Password
Comercialplastico3.
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Blocklisted process makes network request 16 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Drops file in Windows directory 4 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a286c68d65f2582414caf8229aeaba8365d7b84de92c5da4c39b7482136b5271N.exe"C:\Users\Admin\AppData\Local\Temp\a286c68d65f2582414caf8229aeaba8365d7b84de92c5da4c39b7482136b5271N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Brankedes=Get-Content -raw 'C:\Users\Admin\AppData\Local\peritonealizing\nomadeinvasioners\stofhandskernes\Vesperkost.Ufo';$Udskibningshavnene=$Brankedes.SubString(28086,3);.$Udskibningshavnene($Brankedes)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle hidden "$Brankedes=Get-Content -raw 'C:\Users\Admin\AppData\Local\peritonealizing\nomadeinvasioners\stofhandskernes\Vesperkost.Ufo';$Udskibningshavnene=$Brankedes.SubString(28086,3);.$Udskibningshavnene($Brankedes)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
05DDC6AA91765AACACDB0A5F96DF8199
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
4FA45AE1010E09657982D8D28B3BD38E_CC847C1C687BCB4C6B5074DF051D733B
B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7
05DDC6AA91765AACACDB0A5F96DF8199
24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
4FA45AE1010E09657982D8D28B3BD38E_CC847C1C687BCB4C6B5074DF051D733B
B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7
Damascenere.lnk
__PSScriptPolicyTest_dkzoited.hh3.ps1
Arachnidan.Und
Vesperkost.Ufo
Nebengeschfter.ini
memory/1124-434-0x0000000000E00000-0x0000000002054000-memory.dmp
memory/1124-436-0x0000000000E00000-0x0000000000E48000-memory.dmp
memory/1764-438-0x00000000228C0000-0x0000000022A82000-memory.dmp
memory/1764-431-0x0000000000AD0000-0x0000000001D24000-memory.dmp
memory/1764-432-0x0000000000AD0000-0x0000000000B18000-memory.dmp
memory/1764-433-0x0000000021C70000-0x0000000021D0C000-memory.dmp
memory/1764-439-0x00000000226F0000-0x0000000022740000-memory.dmp
memory/1764-442-0x00000000227E0000-0x0000000022872000-memory.dmp
memory/1764-443-0x0000000022790000-0x000000002279A000-memory.dmp
memory/1960-370-0x0000000007530000-0x000000000755A000-memory.dmp
memory/1960-185-0x0000000005F80000-0x0000000005FCC000-memory.dmp
memory/1960-365-0x00000000073C0000-0x00000000073DE000-memory.dmp
memory/1960-360-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/1960-354-0x0000000070C40000-0x0000000070F94000-memory.dmp
memory/1960-367-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/1960-368-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/1960-369-0x00000000074F0000-0x00000000074FA000-memory.dmp
memory/1960-352-0x0000000007380000-0x00000000073B2000-memory.dmp
memory/1960-371-0x0000000007560000-0x0000000007584000-memory.dmp
memory/1960-165-0x00000000740CE000-0x00000000740CF000-memory.dmp
memory/1960-166-0x0000000002960000-0x0000000002996000-memory.dmp
memory/1960-383-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/1960-385-0x00000000740CE000-0x00000000740CF000-memory.dmp
memory/1960-353-0x0000000070540000-0x000000007058C000-memory.dmp
memory/1960-387-0x0000000008850000-0x000000000A9DB000-memory.dmp
memory/1960-388-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/1960-167-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/1960-168-0x00000000051C0000-0x00000000057E8000-memory.dmp
memory/1960-392-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/1960-393-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/1960-394-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/1960-395-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/1960-171-0x0000000004F60000-0x0000000004F82000-memory.dmp
memory/1960-351-0x00000000081D0000-0x000000000884A000-memory.dmp
memory/1960-172-0x0000000005100000-0x0000000005166000-memory.dmp
memory/1960-173-0x00000000058F0000-0x0000000005956000-memory.dmp
memory/1960-338-0x00000000075A0000-0x0000000007B44000-memory.dmp
memory/1960-335-0x0000000006F20000-0x0000000006FB6000-memory.dmp
memory/1960-337-0x00000000064A0000-0x00000000064C2000-memory.dmp
memory/1960-336-0x0000000006420000-0x000000000643A000-memory.dmp
memory/1960-366-0x00000000073F0000-0x0000000007493000-memory.dmp
memory/1960-184-0x0000000005F50000-0x0000000005F6E000-memory.dmp
memory/1960-183-0x0000000005960000-0x0000000005CB4000-memory.dmp
memory/3964-339-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/3964-340-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/3964-396-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/3964-391-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/3964-389-0x00000000740C0000-0x0000000074870000-memory.dmp
memory/3964-373-0x0000000070C40000-0x0000000070F94000-memory.dmp
memory/3964-372-0x0000000070540000-0x000000007058C000-memory.dmp