Analysis
- max time kernel
131s - max time network
126s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
14/11/2024, 19:09
General
- Target Bank Swift Copy.docx
- Size 459KB
- Sample241114-xtsbjasbpn
- SHA256 27a37162f8f0baf5fe161825f8108f1f3e20bada83c2be08fe9919c60e4727b8
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.jhxkgroup.online
-
Port
587
-
Username
-
Password
7213575aceACE@@
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Blocklisted process makes network request 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Downloads MZ/PE file
- Abuses OpenXML format to download file from external location
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Office loads VBA resources, possible macro or embedded object present
- Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Bank Swift Copy.docx"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\obigfdsdfgh.exe"C:\Users\Admin\AppData\Roaming\obigfdsdfgh.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\obigfdsdfgh.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\obigfdsdfgh.exe"C:\Users\Admin\AppData\Roaming\obigfdsdfgh.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Exploitation for Client Execution
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
FSD-{1AA8CAA7-A5C1-4586-8C98-7D83CBE4BECF}.FSD
FSD-CNRY.FSD
FSD-{4FFE8154-F967-4E24-9842-676AD0BF4B94}.FSD
xXdquUOrM1vD3An[1].doc
{7707201D-9AE5-44E0-983E-8936FD11A26B}
ExcludeDictionaryEN0409.lex
obigfdsdfgh.exe
memory/2300-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2300-2-0x00000000715DD000-0x00000000715E8000-memory.dmp
memory/2300-61-0x00000000715DD000-0x00000000715E8000-memory.dmp
memory/2300-0-0x000000002F121000-0x000000002F122000-memory.dmp
memory/2492-109-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2492-111-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2492-122-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2492-120-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2492-118-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2492-117-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2492-115-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2492-113-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2960-106-0x0000000000400000-0x0000000000412000-memory.dmp
memory/2960-108-0x0000000005E90000-0x0000000005F1E000-memory.dmp
memory/2960-98-0x0000000001010000-0x00000000010DA000-memory.dmp