Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11-12-2024 07:58
Static task
static1
Behavioral task
behavioral1
Sample
DEC 2024 RFQ.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
DEC 2024 RFQ.exe
Resource
win10v2004-20241007-en
General
-
Target
DEC 2024 RFQ.exe
-
Size
987KB
-
MD5
34b4d7918dc670f64013e5d1f58a85cd
-
SHA1
dc5af092e9c5b2b38a2e72b03a2784fad36f20e6
-
SHA256
3a0034689c3ef94d1e243b02eeca73fa564da13b1f09509d9cc290240ccc2b17
-
SHA512
080f3df60bff200c4d29a65eb67dcc381bc04200c5b6e3681b2592ef64aa776e04cb71e8966b8cb56c42577cbc2be89ff8beb1e1d99ff54f1d18a7fdd2102907
-
SSDEEP
24576:tu6J33O0c+JY5UZ+XC0kGso6FaSrQ00voPIWY:fu0c++OCvkGs9FaSrZ0wDY
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.wxtp.store - Port:
587 - Username:
[email protected] - Password:
7213575aceACE@@ - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2340 set thread context of 3000 2340 DEC 2024 RFQ.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEC 2024 RFQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3000 RegSvcs.exe 3000 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2340 DEC 2024 RFQ.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3000 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2340 DEC 2024 RFQ.exe 2340 DEC 2024 RFQ.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2340 DEC 2024 RFQ.exe 2340 DEC 2024 RFQ.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2340 wrote to memory of 3000 2340 DEC 2024 RFQ.exe 30 PID 2340 wrote to memory of 3000 2340 DEC 2024 RFQ.exe 30 PID 2340 wrote to memory of 3000 2340 DEC 2024 RFQ.exe 30 PID 2340 wrote to memory of 3000 2340 DEC 2024 RFQ.exe 30 PID 2340 wrote to memory of 3000 2340 DEC 2024 RFQ.exe 30 PID 2340 wrote to memory of 3000 2340 DEC 2024 RFQ.exe 30 PID 2340 wrote to memory of 3000 2340 DEC 2024 RFQ.exe 30 PID 2340 wrote to memory of 3000 2340 DEC 2024 RFQ.exe 30 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DEC 2024 RFQ.exe"C:\Users\Admin\AppData\Local\Temp\DEC 2024 RFQ.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\DEC 2024 RFQ.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3000
-