Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 05:11
Static task
static1
Behavioral task
behavioral1
Sample
Overdue Invoices2.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Overdue Invoices2.exe
Resource
win10v2004-20241007-en
General
-
Target
Overdue Invoices2.exe
-
Size
993KB
-
MD5
6d4d3a02ec57daf6c2bbd7a10091b3b6
-
SHA1
da5738e98d1e876b1488cce6423ec6ab315cb6d7
-
SHA256
4cbe8b8e32857886cae80d2249216f71c9d97df2c4f4574211357acd6cc95dfd
-
SHA512
45bd166a2bf62e51a1f4e50d3e543636a70591081d750fae7a4c7cc0109ae2eb1febc1293197a195d1bc1fd718f61824a972d4d48951abfee4aca28d68e7f6d5
-
SSDEEP
24576:8u6J33O0c+JY5UZ+XC0kGso6FaHYJ4CPbtxWY:mu0c++OCvkGs9FaHS4gmY
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
smtp.ionos.es - Port:
587 - Username:
[email protected] - Password:
KNB01_generico - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1940 set thread context of 3440 1940 Overdue Invoices2.exe 83 -
Program crash 1 IoCs
pid pid_target Process procid_target 3724 1940 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Overdue Invoices2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3440 RegSvcs.exe 3440 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1940 Overdue Invoices2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3440 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1940 Overdue Invoices2.exe 1940 Overdue Invoices2.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1940 Overdue Invoices2.exe 1940 Overdue Invoices2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1940 wrote to memory of 3440 1940 Overdue Invoices2.exe 83 PID 1940 wrote to memory of 3440 1940 Overdue Invoices2.exe 83 PID 1940 wrote to memory of 3440 1940 Overdue Invoices2.exe 83 PID 1940 wrote to memory of 3440 1940 Overdue Invoices2.exe 83 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Overdue Invoices2.exe"C:\Users\Admin\AppData\Local\Temp\Overdue Invoices2.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Overdue Invoices2.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3440
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 6642⤵
- Program crash
PID:3724
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1940 -ip 19401⤵PID:4808