Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
26/11/2024, 02:35
General
- Target 5cba2773587387ad35e187bf5135467da368909ae0d4dd1a0f1d80be6338fc44.exe
- Size 553KB
- Sample241126-c3c8rawnhj
- SHA256 5cba2773587387ad35e187bf5135467da368909ae0d4dd1a0f1d80be6338fc44
Malware Config
Extracted
-
vipkeylogger
Signatures
- Guloader family
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Loads dropped DLL 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cba2773587387ad35e187bf5135467da368909ae0d4dd1a0f1d80be6338fc44.exe"C:\Users\Admin\AppData\Local\Temp\5cba2773587387ad35e187bf5135467da368909ae0d4dd1a0f1d80be6338fc44.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5cba2773587387ad35e187bf5135467da368909ae0d4dd1a0f1d80be6338fc44.exe"C:\Users\Admin\AppData\Local\Temp\5cba2773587387ad35e187bf5135467da368909ae0d4dd1a0f1d80be6338fc44.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
System.dll
memory/1184-24-0x0000000000400000-0x0000000001654000-memory.dmp
memory/1184-23-0x0000000001660000-0x0000000003B2F000-memory.dmp
memory/1184-30-0x0000000037820000-0x000000003782A000-memory.dmp
memory/1184-29-0x0000000037C60000-0x0000000037CF2000-memory.dmp
memory/1184-27-0x00000000370F0000-0x000000003761C000-memory.dmp
memory/1184-13-0x0000000000400000-0x0000000001654000-memory.dmp
memory/1184-14-0x0000000001660000-0x0000000003B2F000-memory.dmp
memory/1184-15-0x0000000000400000-0x0000000001654000-memory.dmp
memory/1184-19-0x0000000035F10000-0x0000000035F60000-memory.dmp
memory/1184-26-0x0000000037010000-0x0000000037060000-memory.dmp
memory/1184-22-0x0000000036620000-0x00000000366BC000-memory.dmp
memory/1184-21-0x0000000035FA0000-0x0000000035FEE000-memory.dmp
memory/1184-20-0x0000000036070000-0x0000000036614000-memory.dmp
memory/1184-16-0x0000000000400000-0x0000000001654000-memory.dmp
memory/1184-25-0x0000000036E20000-0x0000000036FE2000-memory.dmp
memory/4816-8-0x0000000002DF0000-0x00000000052BF000-memory.dmp
memory/4816-9-0x00000000773F1000-0x0000000077511000-memory.dmp
memory/4816-12-0x0000000002DF0000-0x00000000052BF000-memory.dmp
memory/4816-10-0x0000000002DF0000-0x00000000052BF000-memory.dmp
memory/4816-11-0x00000000740E4000-0x00000000740E5000-memory.dmp