Analysis
-
max time kernel
122s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-11-2024 04:00
Behavioral task
behavioral1
Sample
ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe
Resource
win10v2004-20241007-en
General
-
Target
ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe
-
Size
929KB
-
MD5
49e9e776c6f5d00a090adbd8814ffdc7
-
SHA1
4ea5b8d7b7beb2ad75bbe583c4658093c4ab12bd
-
SHA256
ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903
-
SHA512
06e761bafcf3aa68a739ec24f17db1f9d1a36f59b940c8de12fd388dbd871dd2ab443a60c7723cd77ec1f52859cef469d9493759acc8acc1cfe1c471bf06f8cd
-
SSDEEP
24576:L4GHnhIzOa5WPGzwQA+jLgNK5O5Y1fmdruuAF:0shdaYP3t+g3d
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot6820629737:AAGJ8tOkoD9jFHkd_L1kG1ntQ1J6zLhFsMc/sendMessage?chat_id=6783205225
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Drops startup file 1 IoCs
Processes:
murkest.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\murkest.vbs murkest.exe -
Executes dropped EXE 1 IoCs
Processes:
murkest.exepid process 1776 murkest.exe -
Loads dropped DLL 1 IoCs
Processes:
ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exepid process 1748 ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 checkip.dyndns.org -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral1/memory/1748-9-0x0000000000E60000-0x000000000105D000-memory.dmp autoit_exe behavioral1/memory/1776-23-0x00000000003C0000-0x00000000005BD000-memory.dmp autoit_exe behavioral1/memory/1748-1124-0x0000000002BE0000-0x0000000002DDD000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
murkest.exedescription pid process target process PID 1776 set thread context of 2244 1776 murkest.exe RegSvcs.exe -
Processes:
resource yara_rule behavioral1/memory/1748-0-0x0000000000E60000-0x000000000105D000-memory.dmp upx \Users\Admin\AppData\Local\Keily\murkest.exe upx behavioral1/memory/1776-12-0x00000000003C0000-0x00000000005BD000-memory.dmp upx behavioral1/memory/1748-9-0x0000000000E60000-0x000000000105D000-memory.dmp upx behavioral1/memory/1776-23-0x00000000003C0000-0x00000000005BD000-memory.dmp upx behavioral1/memory/1748-1124-0x0000000002BE0000-0x0000000002DDD000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exemurkest.exeRegSvcs.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language murkest.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
RegSvcs.exepid process 2244 RegSvcs.exe 2244 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
murkest.exepid process 1776 murkest.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 2244 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exemurkest.exedescription pid process target process PID 1748 wrote to memory of 1776 1748 ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe murkest.exe PID 1748 wrote to memory of 1776 1748 ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe murkest.exe PID 1748 wrote to memory of 1776 1748 ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe murkest.exe PID 1748 wrote to memory of 1776 1748 ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe murkest.exe PID 1776 wrote to memory of 2244 1776 murkest.exe RegSvcs.exe PID 1776 wrote to memory of 2244 1776 murkest.exe RegSvcs.exe PID 1776 wrote to memory of 2244 1776 murkest.exe RegSvcs.exe PID 1776 wrote to memory of 2244 1776 murkest.exe RegSvcs.exe PID 1776 wrote to memory of 2244 1776 murkest.exe RegSvcs.exe PID 1776 wrote to memory of 2244 1776 murkest.exe RegSvcs.exe PID 1776 wrote to memory of 2244 1776 murkest.exe RegSvcs.exe PID 1776 wrote to memory of 2244 1776 murkest.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe"C:\Users\Admin\AppData\Local\Temp\ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Keily\murkest.exe"C:\Users\Admin\AppData\Local\Temp\ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2244
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
929KB
MD549e9e776c6f5d00a090adbd8814ffdc7
SHA14ea5b8d7b7beb2ad75bbe583c4658093c4ab12bd
SHA256ef25dd02f39549f22a2272768115e7704ce4fd20e305b7aa16f9906b6688e903
SHA51206e761bafcf3aa68a739ec24f17db1f9d1a36f59b940c8de12fd388dbd871dd2ab443a60c7723cd77ec1f52859cef469d9493759acc8acc1cfe1c471bf06f8cd