Analysis

  • max time kernel
    111s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/12/2024, 02:43

General

  • Target

    Receipt.exe

  • Size

    1.1MB

  • MD5

    1d0c53e42bd84b7b7cfabed7dae7f570

  • SHA1

    0b0df40afe9bed5720c361fe7ed63395e1a25f41

  • SHA256

    ddadbda4f90dc1d05f3e78ac6e5009c2e6608137b60bce3427e25ffea1b4d944

  • SHA512

    9ab7671f48d5dbeb58c93b61998762ed91da2f566421ff11f53edfdb6a65af0199ff4bb31647ec296cae7f85ba7cfc71340fbb931e6a05fd5aa03a43f5026057

  • SSDEEP

    24576:cu6J33O0c+JY5UZ+XC0kGso6FaNAaW2Kh7ZClY9lnmWY:Gu0c++OCvkGs9FaNAaWphNCC1Y

Malware Config

Extracted

Family

vipkeylogger

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Vipkeylogger family
  • Drops startup file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Receipt.exe
    "C:\Users\Admin\AppData\Local\Temp\Receipt.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Users\Admin\AppData\Local\Okeghem\ghauts.exe
      "C:\Users\Admin\AppData\Local\Temp\Receipt.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3172
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Users\Admin\AppData\Local\Temp\Receipt.exe"
        3⤵
          PID:3840
        • C:\Users\Admin\AppData\Local\Okeghem\ghauts.exe
          "C:\Users\Admin\AppData\Local\Okeghem\ghauts.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2524
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Users\Admin\AppData\Local\Okeghem\ghauts.exe"
            4⤵
              PID:2344
            • C:\Users\Admin\AppData\Local\Okeghem\ghauts.exe
              "C:\Users\Admin\AppData\Local\Okeghem\ghauts.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:312
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                "C:\Users\Admin\AppData\Local\Okeghem\ghauts.exe"
                5⤵
                • Accesses Microsoft Outlook profiles
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • outlook_office_path
                • outlook_win_path
                PID:1612

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Okeghem\ghauts.exe

              Filesize

              1.1MB

              MD5

              1d0c53e42bd84b7b7cfabed7dae7f570

              SHA1

              0b0df40afe9bed5720c361fe7ed63395e1a25f41

              SHA256

              ddadbda4f90dc1d05f3e78ac6e5009c2e6608137b60bce3427e25ffea1b4d944

              SHA512

              9ab7671f48d5dbeb58c93b61998762ed91da2f566421ff11f53edfdb6a65af0199ff4bb31647ec296cae7f85ba7cfc71340fbb931e6a05fd5aa03a43f5026057

            • C:\Users\Admin\AppData\Local\Temp\aut83E5.tmp

              Filesize

              235KB

              MD5

              3efef33de4b9a0746f48ed50d0329ca5

              SHA1

              c3827793ff34405cfe9960d58cf1a1fa9c93eca2

              SHA256

              6348a723fda7f47d932d00e92f6e5ffc24228b6931f819aedeec3a078a3eca25

              SHA512

              888f7d9df9c3001807e6dc3101e488599fa4dcbca8b3472c6261ac37e8082fe6a5150965c06d48d106edc12665ee7af06b6062adc7fc89acd90e928b1db7188a

            • C:\Users\Admin\AppData\Local\Temp\nondefinition

              Filesize

              237KB

              MD5

              58412bc618cb35e18913d632db5bfcdf

              SHA1

              1f83979bdb99c654a742f47ca514e621dcdf8e92

              SHA256

              e7316a4ed2628ffe37fe57e711b0dd9f3b06706e3f269f8bb0c454debae0265c

              SHA512

              9c55e9d63f0e14f4cd99fbd2d4e82912a399b79cfdda5e0f6914de85599155611ad3cbd8a64b962bfdc9c8263de420153afc21843b114bb520809c0a2f293830

            • memory/1612-101-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-47-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-1136-0x0000000006500000-0x000000000650A000-memory.dmp

              Filesize

              40KB

            • memory/1612-37-0x0000000000400000-0x0000000000440000-memory.dmp

              Filesize

              256KB

            • memory/1612-38-0x0000000000400000-0x0000000000440000-memory.dmp

              Filesize

              256KB

            • memory/1612-39-0x0000000004EF0000-0x0000000004F50000-memory.dmp

              Filesize

              384KB

            • memory/1612-40-0x0000000005530000-0x0000000005AD4000-memory.dmp

              Filesize

              5.6MB

            • memory/1612-41-0x0000000004FC0000-0x000000000501E000-memory.dmp

              Filesize

              376KB

            • memory/1612-51-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-49-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-94-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-90-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-72-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-91-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-53-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-95-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-45-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-43-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-42-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-103-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-1135-0x0000000006700000-0x0000000006792000-memory.dmp

              Filesize

              584KB

            • memory/1612-99-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-1134-0x00000000063E0000-0x0000000006430000-memory.dmp

              Filesize

              320KB

            • memory/1612-97-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-58-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-87-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-85-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-83-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-81-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-79-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-77-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-75-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-73-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-69-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-67-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-65-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-63-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-61-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-59-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-55-0x0000000004FC0000-0x0000000005018000-memory.dmp

              Filesize

              352KB

            • memory/1612-1132-0x00000000050C0000-0x000000000515C000-memory.dmp

              Filesize

              624KB

            • memory/1612-1133-0x0000000006530000-0x00000000066F2000-memory.dmp

              Filesize

              1.8MB

            • memory/2524-28-0x0000000000D20000-0x0000000001120000-memory.dmp

              Filesize

              4.0MB

            • memory/2640-6-0x0000000001890000-0x0000000001C90000-memory.dmp

              Filesize

              4.0MB

            • memory/3172-18-0x0000000001160000-0x0000000001560000-memory.dmp

              Filesize

              4.0MB