Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2024 02:54
Static task
static1
Behavioral task
behavioral1
Sample
93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe
Resource
win10v2004-20241007-en
General
-
Target
93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe
-
Size
1.1MB
-
MD5
f0fadc1fc5492e928e1b0f1110910dc3
-
SHA1
b5b3829ef9e5b94c00acc84be0a9054c98cd57d0
-
SHA256
93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861
-
SHA512
2f185f8c33301e7e7db59e6e26ebe2703a3a6cf9dd85eda837f5597d17af450f956574286b73a92d8eebd94552927ef3240d6ed317768662be3220ed6a7b31b3
-
SSDEEP
24576:vu6J33O0c+JY5UZ+XC0kGso6FaNQk2kARqoZzpWY:Zu0c++OCvkGs9FaNQkGR9eY
Malware Config
Extracted
vipkeylogger
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\leucoryx.vbs leucoryx.exe -
Executes dropped EXE 1 IoCs
pid Process 3648 leucoryx.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 checkip.dyndns.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023c99-9.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3648 set thread context of 5008 3648 leucoryx.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language leucoryx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 5008 RegSvcs.exe 5008 RegSvcs.exe 5008 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3648 leucoryx.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5008 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4212 93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe 4212 93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe 3648 leucoryx.exe 3648 leucoryx.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 4212 93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe 4212 93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe 3648 leucoryx.exe 3648 leucoryx.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4212 wrote to memory of 3648 4212 93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe 83 PID 4212 wrote to memory of 3648 4212 93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe 83 PID 4212 wrote to memory of 3648 4212 93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe 83 PID 3648 wrote to memory of 5008 3648 leucoryx.exe 84 PID 3648 wrote to memory of 5008 3648 leucoryx.exe 84 PID 3648 wrote to memory of 5008 3648 leucoryx.exe 84 PID 3648 wrote to memory of 5008 3648 leucoryx.exe 84 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe"C:\Users\Admin\AppData\Local\Temp\93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Maianthemum\leucoryx.exe"C:\Users\Admin\AppData\Local\Temp\93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\93cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:5008
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5f0fadc1fc5492e928e1b0f1110910dc3
SHA1b5b3829ef9e5b94c00acc84be0a9054c98cd57d0
SHA25693cc7fdbc44befd6926f08604df3baea4698df845cb80d97f026eb5481341861
SHA5122f185f8c33301e7e7db59e6e26ebe2703a3a6cf9dd85eda837f5597d17af450f956574286b73a92d8eebd94552927ef3240d6ed317768662be3220ed6a7b31b3
-
Filesize
237KB
MD5cf4705b4539e8273d6e840dccf5ee9cc
SHA11771003c925e2ecc94bf13653525dd2d6f9e2da7
SHA256ff2b70e8533f939e9d53a114addcef4db4d594699d0164c7a30ba439c19b0a5e
SHA512ed91c6de4d7919e362cd06e12d49de8f0c150b9ca2e679eebbe146d0d56207c3dbd76afcceb27ebe5672c683833589cbf6d0774f93949ee58bb3572419e160ec