vipkeylogger | d99e9e3d982f4b8edbf8c316a6f830009944ad89c1d144d478c2849c091f5b6a

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

noah s crypt.exe
Size

1.1MB
MD5

1a74dbd880003ff0dfcc93dd83631743
SHA1

c9bc0027273ad74ff97d1d7b8a0668e5e750a604
SHA256

63f122de6bc1f877eccfddb4a3a34b93177203cdd3b906e02f6045d71917dd34
SHA512

ed2c727b17db2d77e8ef79263b838bdb777bc71c0a2588e8b818c0f34d550c9b8b73b969b9f5a8ccb6abee5cd0bfd5699ebe108609ae646093f01bea643f123b
SSDEEP

24576:Pu6J33O0c+JY5UZ+XC0kGso6FahQoisynLIJ9HWY:5u0c++OCvkGs9FahQoTcEoY

Score

10^/10

vipkeylogger collection discovery keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2808 set thread context of 2780	2808	noah s crypt.exe	35

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	noah s crypt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	noah s crypt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	noah s crypt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2780	RegSvcs.exe
2780	RegSvcs.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2328	noah s crypt.exe
2132	noah s crypt.exe
2808	noah s crypt.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	RegSvcs.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2328	noah s crypt.exe
2328	noah s crypt.exe
2132	noah s crypt.exe
2132	noah s crypt.exe
2808	noah s crypt.exe
2808	noah s crypt.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
2328	noah s crypt.exe
2328	noah s crypt.exe
2132	noah s crypt.exe
2132	noah s crypt.exe
2808	noah s crypt.exe
2808	noah s crypt.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 1484	2328	noah s crypt.exe	31
PID 2328 wrote to memory of 1484	2328	noah s crypt.exe	31
PID 2328 wrote to memory of 1484	2328	noah s crypt.exe	31
PID 2328 wrote to memory of 1484	2328	noah s crypt.exe	31
PID 2328 wrote to memory of 1484	2328	noah s crypt.exe	31
PID 2328 wrote to memory of 1484	2328	noah s crypt.exe	31
PID 2328 wrote to memory of 1484	2328	noah s crypt.exe	31
PID 2328 wrote to memory of 2132	2328	noah s crypt.exe	32
PID 2328 wrote to memory of 2132	2328	noah s crypt.exe	32
PID 2328 wrote to memory of 2132	2328	noah s crypt.exe	32
PID 2328 wrote to memory of 2132	2328	noah s crypt.exe	32
PID 2132 wrote to memory of 2756	2132	noah s crypt.exe	33
PID 2132 wrote to memory of 2756	2132	noah s crypt.exe	33
PID 2132 wrote to memory of 2756	2132	noah s crypt.exe	33
PID 2132 wrote to memory of 2756	2132	noah s crypt.exe	33
PID 2132 wrote to memory of 2756	2132	noah s crypt.exe	33
PID 2132 wrote to memory of 2756	2132	noah s crypt.exe	33
PID 2132 wrote to memory of 2756	2132	noah s crypt.exe	33
PID 2132 wrote to memory of 2808	2132	noah s crypt.exe	34
PID 2132 wrote to memory of 2808	2132	noah s crypt.exe	34
PID 2132 wrote to memory of 2808	2132	noah s crypt.exe	34
PID 2132 wrote to memory of 2808	2132	noah s crypt.exe	34
PID 2808 wrote to memory of 2780	2808	noah s crypt.exe	35
PID 2808 wrote to memory of 2780	2808	noah s crypt.exe	35
PID 2808 wrote to memory of 2780	2808	noah s crypt.exe	35
PID 2808 wrote to memory of 2780	2808	noah s crypt.exe	35
PID 2808 wrote to memory of 2780	2808	noah s crypt.exe	35
PID 2808 wrote to memory of 2780	2808	noah s crypt.exe	35
PID 2808 wrote to memory of 2780	2808	noah s crypt.exe	35
PID 2808 wrote to memory of 2780	2808	noah s crypt.exe	35

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\noah s crypt.exe
"C:\Users\Admin\AppData\Local\Temp\noah s crypt.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\noah s crypt.exe"
  2⤵
  PID:1484
- C:\Users\Admin\AppData\Local\Temp\noah s crypt.exe
  "C:\Users\Admin\AppData\Local\Temp\noah s crypt.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\noah s crypt.exe"
    3⤵
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\noah s crypt.exe
    "C:\Users\Admin\AppData\Local\Temp\noah s crypt.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\noah s crypt.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autDE9C.tmp

Filesize
240KB

MD5
0ef9ccb309dee8af6c25c405d0e1d63f

SHA1
260340af7f655b386eb30873151edd4971455050

SHA256
6ed6b21ca0d2855200f6dabbee4cbad6e5848a8ba215674fafc65ab3e420964b

SHA512
8fb54059acaef03182dae4bb7666aeec1c8a2756092a219389d9b6f4c1416f8fd4b2407597ed83f38a452589123d22b8ed068cac8c395edb55078f965c7423b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\autDECC.tmp

Filesize
14KB

MD5
de82f68665593e05654429baf7863d4e

SHA1
5784211dd29bccf111990b4979cfe41c22ff0234

SHA256
5f46c948be6a24cc76779c4d94116bbc263cb39d9ca4bcf0bb99bd805b5ca2e7

SHA512
451aa39e11add849d4044126680284d33448d3d945d4e303869be18b6d79480bc85788b01955618ba5936f52a29c897bdc5b1a0a22fe35f073c34bcf3c109790

Download Submit
C:\Users\Admin\AppData\Local\Temp\derogates

Filesize
140KB

MD5
73cd8dc4abeb26df42f871d12e3ff551

SHA1
cb5ccfbc9009254a9534138ff3aecbe39247be36

SHA256
d76257846f3a8e362792a2c8effeaeec74f99d1b16760f5f1b8bd7c68aaab55c

SHA512
7fd624d59934f3f22dbc869136e4707009e31715e3619e81f63043f42b1523b355f6461c8a5922916799544956a07a0c3916254e718c90e4bbdb773661273156

Download Submit
C:\Users\Admin\AppData\Local\Temp\overroughly

Filesize
243KB

MD5
8f8c259493543a04aa5ec85e48b56bf2

SHA1
10fa768bb1cf3794a120da2874bea01316eed406

SHA256
b13878c191b22cd045d7274dcc0bb4f051b774018ae19af051144294c6442825

SHA512
a618a165945fa617181296bf893c9bbc8bbaa7285591480248859d0ac178d56f0e30940e22fda92f20839fcc812135f142e16e92e4a57e382203de0e9a800b5c

Download Submit
memory/2132-25-0x0000000000670000-0x0000000000A70000-memory.dmp

Filesize
4.0MB

Download
memory/2328-11-0x0000000000670000-0x0000000000A70000-memory.dmp

Filesize
4.0MB

Download
memory/2780-87-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-79-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-42-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2780-44-0x0000000073D9E000-0x0000000073D9F000-memory.dmp

Filesize
4KB

Download
memory/2780-45-0x0000000000250000-0x00000000002AE000-memory.dmp

Filesize
376KB

Download
memory/2780-46-0x0000000073D90000-0x000000007447E000-memory.dmp

Filesize
6.9MB

Download
memory/2780-47-0x0000000000C70000-0x0000000000CCC000-memory.dmp

Filesize
368KB

Download
memory/2780-89-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-108-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-170-0x0000000073D90000-0x000000007447E000-memory.dmp

Filesize
6.9MB

Download
memory/2780-106-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-104-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-102-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-100-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-98-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-96-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-94-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-91-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-92-0x0000000073D90000-0x000000007447E000-memory.dmp

Filesize
6.9MB

Download
memory/2780-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2780-85-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-83-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-81-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-43-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2780-77-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-75-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-73-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-71-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-69-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-67-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-65-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-63-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-61-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-59-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-57-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-55-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-53-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-51-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-49-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-48-0x0000000000C70000-0x0000000000CC7000-memory.dmp

Filesize
348KB

Download
memory/2780-1140-0x0000000073D90000-0x000000007447E000-memory.dmp

Filesize
6.9MB

Download
memory/2780-1141-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2780-1142-0x0000000073D9E000-0x0000000073D9F000-memory.dmp

Filesize
4KB

Download
memory/2780-1143-0x0000000073D90000-0x000000007447E000-memory.dmp

Filesize
6.9MB

Download
memory/2780-1144-0x0000000073D90000-0x000000007447E000-memory.dmp

Filesize
6.9MB

Download
memory/2780-1145-0x0000000073D90000-0x000000007447E000-memory.dmp

Filesize
6.9MB

Download
memory/2808-39-0x00000000006B0000-0x0000000000AB0000-memory.dmp

Filesize
4.0MB

Download