Overview

overview

10

Static

static

3

ALI HASSO ...18.exe

windows7-x64

10

ALI HASSO ...18.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    144s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 06:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ALI HASSO - P02515 & P02518.exe

  • Size

    694KB

  • MD5

    964744dc0ee9f5fcb1c2d50553c1a080

  • SHA1

    b097808717cf2aed2109c0191b6a32471a97b1c5

  • SHA256

    25e63b30d14cfb8e34d5223ad2d2eee2d684603b5e74b91fdecd2ff9b8945066

  • SHA512

    9151bfa7447126013681209b92e46f8049a8bea2d09fb972a19942795d0a16274c191bbb654eb66465011da5260fc34c08b0eb456348ab377e5bde1aa90713f0

  • SSDEEP

    12288:sMwaWgmqtOAmk6kIATs0yjE8HELsQP04nwNtsgw3PgAeeVhGctH74:sMwaWgqkJIAw0yghs2f2Mobev74

Score
10/10
guloadervipkeyloggercollectiondiscoverydownloaderkeyloggerspywarestealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.foodex.com.pk
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    wajahat1975

Extracted

Family

vipkeylogger

Credentials

Signatures

  • Guloader family
    guloader
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger
  • Vipkeylogger family
    vipkeylogger
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ALI HASSO - P02515 & P02518.exe
    "C:\Users\Admin\AppData\Local\Temp\ALI HASSO - P02515 & P02518.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:5084
    • C:\Users\Admin\AppData\Local\Temp\ALI HASSO - P02515 & P02518.exe
      "C:\Users\Admin\AppData\Local\Temp\ALI HASSO - P02515 & P02518.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:4824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nshB140.tmp\System.dll
    Filesize

    12KB

    MD5

    564bb0373067e1785cba7e4c24aab4bf

    SHA1

    7c9416a01d821b10b2eef97b80899d24014d6fc1

    SHA256

    7a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5

    SHA512

    22c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472

    Download Submit

  • memory/4824-26-0x0000000035400000-0x000000003549C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/4824-29-0x00000000359D0000-0x0000000035B92000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/4824-24-0x0000000000460000-0x00000000004AA000-memory.dmp

    Filesize

    296KB

    Download

  • memory/4824-25-0x0000000034E50000-0x00000000353F4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/4824-16-0x00000000016C0000-0x00000000022D2000-memory.dmp

    Filesize

    12.1MB

    Download

  • memory/4824-17-0x00000000773E8000-0x00000000773E9000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4824-18-0x0000000077405000-0x0000000077406000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4824-23-0x0000000077361000-0x0000000077481000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/4824-34-0x0000000036310000-0x000000003631A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4824-22-0x0000000000460000-0x00000000016B4000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/4824-33-0x0000000036220000-0x00000000362B2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/4824-31-0x0000000035CA0000-0x00000000361CC000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/4824-27-0x00000000016C0000-0x00000000022D2000-memory.dmp

    Filesize

    12.1MB

    Download

  • memory/4824-30-0x0000000035BC0000-0x0000000035C10000-memory.dmp

    Filesize

    320KB

    Download

  • memory/5084-13-0x0000000077361000-0x0000000077481000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/5084-12-0x0000000003280000-0x0000000003E92000-memory.dmp

    Filesize

    12.1MB

    Download

  • memory/5084-15-0x0000000003280000-0x0000000003E92000-memory.dmp

    Filesize

    12.1MB

    Download

  • memory/5084-14-0x0000000074055000-0x0000000074056000-memory.dmp

    Filesize

    4KB

    Download