Analysis
-
max time kernel
121s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-12-2024 03:23
Static task
static1
Behavioral task
behavioral1
Sample
BQ_PO#385995.exe
Resource
win7-20240903-en
General
-
Target
BQ_PO#385995.exe
-
Size
398KB
-
MD5
7e3e88fad78dff83ea421084315bfd78
-
SHA1
2e185874ff61f0097b34ae66cdc09bbbf1951f62
-
SHA256
26c434592adaffa102b1cc61983fd9355dfa4fe0e06ad3acb50732892f67d466
-
SHA512
432da571335f6eb1b827eceb1bf0b0cc62b2a1a7734fce3374620769487e908916a39b0e4c94ef6e764f65f3ce7066040055e52d14a7b84bb1e1650ec355460f
-
SSDEEP
6144:OzzpHNxvSI3xlkVxOwDWcvPRavLhOPxersLWd3JyQdETiOhhe3DU705AN8u1tdQM:INxvSec3RMY+sLSZyyETvzck05AGuvr
Malware Config
Extracted
xworm
3.1
69.174.100.131:7000
I1KOVoZcD6Qqbmm9
-
install_file
USB.exe
Extracted
vipkeylogger
https://api.telegram.org/bot7721085569:AAH1tkciy-nKykIEUNjOAUsItTcvNCVmFLo/sendMessage?chat_id=6236275763
Signatures
-
Detect Xworm Payload 5 IoCs
resource yara_rule behavioral1/memory/2560-9-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm behavioral1/memory/2560-6-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm behavioral1/memory/2560-7-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm behavioral1/memory/2560-13-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm behavioral1/memory/2560-11-0x0000000000400000-0x000000000040E000-memory.dmp family_xworm -
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2888 powershell.exe 3028 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 1528 voinhk.exe -
Loads dropped DLL 1 IoCs
pid Process 2560 regsvcs.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 voinhk.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 voinhk.exe Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 voinhk.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2148 set thread context of 2560 2148 BQ_PO#385995.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language voinhk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2888 powershell.exe 3028 powershell.exe 1528 voinhk.exe 1528 voinhk.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2560 regsvcs.exe Token: SeDebugPrivilege 2888 powershell.exe Token: SeDebugPrivilege 3028 powershell.exe Token: SeDebugPrivilege 1528 voinhk.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2560 2148 BQ_PO#385995.exe 31 PID 2148 wrote to memory of 2560 2148 BQ_PO#385995.exe 31 PID 2148 wrote to memory of 2560 2148 BQ_PO#385995.exe 31 PID 2148 wrote to memory of 2560 2148 BQ_PO#385995.exe 31 PID 2148 wrote to memory of 2560 2148 BQ_PO#385995.exe 31 PID 2148 wrote to memory of 2560 2148 BQ_PO#385995.exe 31 PID 2148 wrote to memory of 2560 2148 BQ_PO#385995.exe 31 PID 2148 wrote to memory of 2560 2148 BQ_PO#385995.exe 31 PID 2148 wrote to memory of 2560 2148 BQ_PO#385995.exe 31 PID 2148 wrote to memory of 2560 2148 BQ_PO#385995.exe 31 PID 2148 wrote to memory of 2560 2148 BQ_PO#385995.exe 31 PID 2148 wrote to memory of 2560 2148 BQ_PO#385995.exe 31 PID 2148 wrote to memory of 2128 2148 BQ_PO#385995.exe 33 PID 2148 wrote to memory of 2128 2148 BQ_PO#385995.exe 33 PID 2148 wrote to memory of 2128 2148 BQ_PO#385995.exe 33 PID 2560 wrote to memory of 2888 2560 regsvcs.exe 34 PID 2560 wrote to memory of 2888 2560 regsvcs.exe 34 PID 2560 wrote to memory of 2888 2560 regsvcs.exe 34 PID 2560 wrote to memory of 2888 2560 regsvcs.exe 34 PID 2560 wrote to memory of 3028 2560 regsvcs.exe 36 PID 2560 wrote to memory of 3028 2560 regsvcs.exe 36 PID 2560 wrote to memory of 3028 2560 regsvcs.exe 36 PID 2560 wrote to memory of 3028 2560 regsvcs.exe 36 PID 2560 wrote to memory of 1528 2560 regsvcs.exe 39 PID 2560 wrote to memory of 1528 2560 regsvcs.exe 39 PID 2560 wrote to memory of 1528 2560 regsvcs.exe 39 PID 2560 wrote to memory of 1528 2560 regsvcs.exe 39 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 voinhk.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 voinhk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BQ_PO#385995.exe"C:\Users\Admin\AppData\Local\Temp\BQ_PO#385995.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'regsvcs.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Users\Admin\AppData\Local\Temp\voinhk.exe"C:\Users\Admin\AppData\Local\Temp\voinhk.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1528
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2148 -s 6322⤵PID:2128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD543ff8a264da0a7d0263ea745eec24a1f
SHA1a9a33125a2b68ccee74b874bc6f34f73b0815d5f
SHA256d571a8f07bea68258e814c59c91c868ab05e8ac25ed61426277c00f87cc32b82
SHA512e80d7e3eee9e44c43e7fba5875451c7bb4a335b7956c35691ed0a8684ab70d4e28279924c7dc9a303c5322cae255b236c2f12bbbe9cf3e3962faaf262ccba7da
-
Filesize
271KB
MD54c8c1ceb91408ad5a5011b56b325419e
SHA11c4164b98be5d5235eebfd8a54f45a8e07b229ea
SHA2563dcb27942e0687d24841db48d2b91ff2ae749be95655af9bb10f8a2c46052773
SHA512a4be594b66ef0981edd13519690395405d1a982d35eba8814b8fc69c1a4b6693df382c4d979b277615728c593942be9fcd6494dc12510f4eb71f233b1e7fb6a2