Analysis
-
max time kernel
150s -
max time network
271s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-12-2024 00:27
Static task
static1
Behavioral task
behavioral1
Sample
SWIFT.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SWIFT.exe
Resource
win10v2004-20241007-en
General
-
Target
SWIFT.exe
-
Size
1.0MB
-
MD5
a1e12d2c6554aba6dc559c70c6e73de4
-
SHA1
c3efbc42b9216818cae4745be17f10a45d312b20
-
SHA256
8268222de842c98e6109c0edb31d03ee82ef3df1f09dceaebf6d63818adc356e
-
SHA512
6a2913655b66975cf92219f24906824224a127b08a4290dd57d9403802b7572a925169550e180c33e1779734935c5a2bbe661e75a199d7a0bfd0e3e23d019471
-
SSDEEP
24576:Hu6J33O0c+JY5UZ+XC0kGso6FaS1dieGnses7ThWY:Bu0c++OCvkGs9FaS1dX0mAY
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.chata66.sk - Port:
25 - Username:
[email protected] - Password:
bGf865RweX - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4860 set thread context of 3188 4860 SWIFT.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWIFT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3188 RegSvcs.exe 3188 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4860 SWIFT.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3188 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4860 SWIFT.exe 4860 SWIFT.exe 4860 SWIFT.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4860 SWIFT.exe 4860 SWIFT.exe 4860 SWIFT.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4860 wrote to memory of 3188 4860 SWIFT.exe 85 PID 4860 wrote to memory of 3188 4860 SWIFT.exe 85 PID 4860 wrote to memory of 3188 4860 SWIFT.exe 85 PID 4860 wrote to memory of 3188 4860 SWIFT.exe 85 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SWIFT.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\SWIFT.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3188
-