Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 06:16
Static task
static1
Behavioral task
behavioral1
Sample
APQSKVTvd60SdAM.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
APQSKVTvd60SdAM.exe
Resource
win10v2004-20241007-en
General
-
Target
APQSKVTvd60SdAM.exe
-
Size
909KB
-
MD5
ff7e78da9c8e580229fe95dfdfe5b098
-
SHA1
ab968e47e463f29426116753b0ca086fd5b33cdb
-
SHA256
cefa40083339d42320bc1f9ba33c578b8abe47e15eb0dd6b0ba2f734aa8f3d6d
-
SHA512
45517b8bc96613daeabb738a42188b8ef19b0ac2b53e3202f7d86f683dacdbe1c4a78414938ab5ad0b48b7c546bc89a78932e3b8a1dbf6604e59b4887de48409
-
SSDEEP
12288:v9Qw+JBpSqWsX8yViJMjLDXGn6pYn21S20YDOcAvrFa1:lUJBp3WxqiJs2IYn21SwacAv
Malware Config
Extracted
Protocol: smtp- Host:
mail.vvtrade.vn - Port:
587 - Username:
[email protected] - Password:
qVyP6qyv6MQCmZJBRs4t
Extracted
vipkeylogger
https://api.telegram.org/bot7339564661:AAFzTB6gEWMndjXYyD5LCn17UEBISRR8wDI/sendMessage?chat_id=6443825857
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3676 powershell.exe 2236 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation APQSKVTvd60SdAM.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 APQSKVTvd60SdAM.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 APQSKVTvd60SdAM.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 APQSKVTvd60SdAM.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3940 set thread context of 4988 3940 APQSKVTvd60SdAM.exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APQSKVTvd60SdAM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language APQSKVTvd60SdAM.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3584 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3940 APQSKVTvd60SdAM.exe 3676 powershell.exe 3940 APQSKVTvd60SdAM.exe 2236 powershell.exe 4988 APQSKVTvd60SdAM.exe 3676 powershell.exe 2236 powershell.exe 4988 APQSKVTvd60SdAM.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3940 APQSKVTvd60SdAM.exe Token: SeDebugPrivilege 3676 powershell.exe Token: SeDebugPrivilege 2236 powershell.exe Token: SeDebugPrivilege 4988 APQSKVTvd60SdAM.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3940 wrote to memory of 3676 3940 APQSKVTvd60SdAM.exe 96 PID 3940 wrote to memory of 3676 3940 APQSKVTvd60SdAM.exe 96 PID 3940 wrote to memory of 3676 3940 APQSKVTvd60SdAM.exe 96 PID 3940 wrote to memory of 2236 3940 APQSKVTvd60SdAM.exe 98 PID 3940 wrote to memory of 2236 3940 APQSKVTvd60SdAM.exe 98 PID 3940 wrote to memory of 2236 3940 APQSKVTvd60SdAM.exe 98 PID 3940 wrote to memory of 3584 3940 APQSKVTvd60SdAM.exe 100 PID 3940 wrote to memory of 3584 3940 APQSKVTvd60SdAM.exe 100 PID 3940 wrote to memory of 3584 3940 APQSKVTvd60SdAM.exe 100 PID 3940 wrote to memory of 4988 3940 APQSKVTvd60SdAM.exe 102 PID 3940 wrote to memory of 4988 3940 APQSKVTvd60SdAM.exe 102 PID 3940 wrote to memory of 4988 3940 APQSKVTvd60SdAM.exe 102 PID 3940 wrote to memory of 4988 3940 APQSKVTvd60SdAM.exe 102 PID 3940 wrote to memory of 4988 3940 APQSKVTvd60SdAM.exe 102 PID 3940 wrote to memory of 4988 3940 APQSKVTvd60SdAM.exe 102 PID 3940 wrote to memory of 4988 3940 APQSKVTvd60SdAM.exe 102 PID 3940 wrote to memory of 4988 3940 APQSKVTvd60SdAM.exe 102 PID 3940 wrote to memory of 4988 3940 APQSKVTvd60SdAM.exe 102 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 APQSKVTvd60SdAM.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 APQSKVTvd60SdAM.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\APQSKVTvd60SdAM.exe"C:\Users\Admin\AppData\Local\Temp\APQSKVTvd60SdAM.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\APQSKVTvd60SdAM.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GJgncWe.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GJgncWe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1400.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3584
-
-
C:\Users\Admin\AppData\Local\Temp\APQSKVTvd60SdAM.exe"C:\Users\Admin\AppData\Local\Temp\APQSKVTvd60SdAM.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4988
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5f8d2055a8ee53786fd280a4c77d2370c
SHA179dc3cb30a9b3d86923d76c94f15a4d50b18ef6f
SHA256075ccd49af56ab6684432e0cf8737e4167d04f140559a086d53c91d201d73b5b
SHA512b60b7b9ea4a875941949ff678c1c31509f3d862492c6c2eb8eacd08b3999b279cae1cc86ad3738e100a5187becc0b91e4c754cb52fa1d0a5683bf951159fe842
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD52c3755f8cda04c67463f8e9bbb8a7a4e
SHA14126a07800af0313200db24a1d118c9d695c71bf
SHA256a44a715a46c747011487ed7d43c9fdf41e10b81940ba55f536492ca0e132c773
SHA5120ebe28345867cf710038b63299ddb344ceca5a204b0a428c25bef7fe793787de7b27c618fecf7b7f228169639fd4cfb109b8f30b820d139bd369aaa0056bc5a8