vipkeylogger | 490fe7bd44360112ebedc61afeedc1d73c65369d62a655c6c0e78b33023ce776

General

Target

order.exe
Size

1019KB
MD5

d9db66e37915ab21e28573d7f6bf310e
SHA1

daa966d3d523214c4de2d70e958e3686618800b9
SHA256

9e7e7c7a7cfe618cb154602ed9de8022dea6c07420c0b5361d57c8e2016bb109
SHA512

6fde4ab22e6aa120b80f3f512976a74014758f698560c169d162d3288acb54a2ea39d5d8b5af4e77f67236b687c07d599f5862378c7b10c9084c989c79e1fa32
SSDEEP

24576:1tb20pkaCqT5TBWgNQ7aquX9g1Ffa/6A:mVg5tQ7aqAqm5

Score

10^/10

vipkeylogger collection discovery keylogger stealer

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
gain.co.id
Port:
587
Username:
[email protected]
Password:
Gavur#123!!

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
gain.co.id
Port:
587
Username:
[email protected]
Password:
Gavur#123!!
Email To:
[email protected]

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

RegSvcs.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

order.exe

description	pid	Process	procid_target
PID 2348 set thread context of 1620	2348	order.exe	30

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

order.exeRegSvcs.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	order.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RegSvcs.exe

pid	Process
1620	RegSvcs.exe
1620	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

order.exe

pid	Process
2348	order.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description	pid	Process
Token: SeDebugPrivilege	1620	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

order.exe

pid	Process
2348	order.exe
2348	order.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

order.exe

pid	Process
2348	order.exe
2348	order.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

order.exe

description	pid	Process	procid_target
PID 2348 wrote to memory of 1620	2348	order.exe	30
PID 2348 wrote to memory of 1620	2348	order.exe	30
PID 2348 wrote to memory of 1620	2348	order.exe	30
PID 2348 wrote to memory of 1620	2348	order.exe	30
PID 2348 wrote to memory of 1620	2348	order.exe	30
PID 2348 wrote to memory of 1620	2348	order.exe	30
PID 2348 wrote to memory of 1620	2348	order.exe	30
PID 2348 wrote to memory of 1620	2348	order.exe	30

outlook_office_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

Processes:

RegSvcs.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\order.exe
"C:\Users\Admin\AppData\Local\Temp\order.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\order.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-7-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1620-11-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1620-9-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1620-12-0x0000000073F0E000-0x0000000073F0F000-memory.dmp

Filesize
4KB

Download
memory/1620-13-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download
memory/1620-14-0x0000000073F0E000-0x0000000073F0F000-memory.dmp

Filesize
4KB

Download
memory/1620-15-0x0000000073F00000-0x00000000745EE000-memory.dmp

Filesize
6.9MB

Download
memory/2348-6-0x0000000000980000-0x0000000000D80000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads