Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2024 02:56

General

  • Target

    29807b7bbe150c4005266b07919615984fcc9dec19052ae262374635024c9e2b.exe

  • Size

    747KB

  • MD5

    723e8d7420209e5658d32ebeaea45b9c

  • SHA1

    1fab08989ece01ecd3f485d33a921dd553ccc393

  • SHA256

    29807b7bbe150c4005266b07919615984fcc9dec19052ae262374635024c9e2b

  • SHA512

    bd1bb8ee484f3d0768ce1afdbc4091e168613f0d162142f8fbf916bbcf5e5e40f43fecf1452976baf898abe4077db184efda918bbedc472016953fb7f6e470e4

  • SSDEEP

    12288:hDGZKmormA1WTNBX5CN/8DCYz1JqAxQJuPLaDbguIsFFfDF/dvJimLQrU+UvdmBp:vmor/1WNBYN/iXqAxQJW0kTsF/im/mBp

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7745751910:AAGY46QDCTWO_Pw9iDqZhkNij-i4uwbMgzE/sendMessage?chat_id=7695061973

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Vipkeylogger family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Loads dropped DLL 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Blocklisted process makes network request 8 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\29807b7bbe150c4005266b07919615984fcc9dec19052ae262374635024c9e2b.exe
    "C:\Users\Admin\AppData\Local\Temp\29807b7bbe150c4005266b07919615984fcc9dec19052ae262374635024c9e2b.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:380
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "$Okkupationers=gc -raw 'C:\Users\Admin\AppData\Local\magmaet\clenched\Gascon.Som';$Indyndendes=$Okkupationers.SubString(74357,3);.$Indyndendes($Okkupationers) "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:4304

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1rmfmfqi.qqs.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\nsf92AD.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    1b0e41f60564cccccd71347d01a7c397

    SHA1

    b1bddd97765e9c249ba239e9c95ab32368098e02

    SHA256

    13ebc725f3f236e1914fe5288ad6413798ad99bef38bfe9c8c898181238e8a10

    SHA512

    b6d7925cdff358992b2682cf1485227204ce3868c981c47778dd6da32057a595caa933d8242c8d7090b0c54110d45fa8f935a1b4eec1e318d89cc0e44b115785

  • C:\Users\Admin\AppData\Local\magmaet\clenched\Feltdefinition.Mej

    Filesize

    291KB

    MD5

    8ee7284edb9d51bc050df373249bf227

    SHA1

    101b642b9a71513c06fb6bff84c068fb456cd516

    SHA256

    2c45fbf06a5dc115d518e12674070767a582f68df30a4eadffa2eaf8aaa9b53e

    SHA512

    7439d672b6c78400297b507968ff9cd45f56b5672765475307e8b8a8b84b462653f743f69cc8da32e35863475b65e15edb24230e67ec777ca4bbf1a4274b241f

  • C:\Users\Admin\AppData\Local\magmaet\clenched\Gascon.Som

    Filesize

    72KB

    MD5

    b044bd82e9954a750fd85843de1c02a3

    SHA1

    e9c94df0e6e0bdf13ab417d7fafad7cd4aaadb43

    SHA256

    54f5c7acb07bc3496890d8dadafa2e4b1073118d0e7c7e6c69b95ecdffabab98

    SHA512

    827525fbdfa186a99510e24ec56c71ee772bed322fcca2d61eef0fce33dd3d37e64b75ed62d6619973f421220746334da6b291211472e2c57eca7dfee2016351

  • C:\Windows\Resources\unthick.ini

    Filesize

    33B

    MD5

    e23f52386361095bdb7040b09e2216ae

    SHA1

    91f31dd82ab80140db621b6dce0b9b5d6b568723

    SHA256

    36467321184a76e0fea592d2896856a37ec18fc8480de66f05d719d93b39d070

    SHA512

    19d18de54b3466f0d283271786b3b308c3be07f21174c46563c4c16292716c52f2c1b85f416ed77143ea6847bfc4c4c37f22296948eac47499276b181f129b9c

  • memory/4304-212-0x0000000001A70000-0x00000000028A4000-memory.dmp

    Filesize

    14.2MB

  • memory/4304-236-0x000000001E3A0000-0x000000001E3AA000-memory.dmp

    Filesize

    40KB

  • memory/4304-235-0x0000000021420000-0x00000000214B2000-memory.dmp

    Filesize

    584KB

  • memory/4304-232-0x0000000021C50000-0x000000002217C000-memory.dmp

    Filesize

    5.2MB

  • memory/4304-231-0x0000000020CE0000-0x0000000020D30000-memory.dmp

    Filesize

    320KB

  • memory/4304-230-0x0000000021550000-0x0000000021712000-memory.dmp

    Filesize

    1.8MB

  • memory/4304-229-0x0000000001A70000-0x00000000028A4000-memory.dmp

    Filesize

    14.2MB

  • memory/4304-227-0x0000000020820000-0x00000000208BC000-memory.dmp

    Filesize

    624KB

  • memory/4304-226-0x0000000000810000-0x000000000085A000-memory.dmp

    Filesize

    296KB

  • memory/4304-225-0x0000000000810000-0x0000000001A64000-memory.dmp

    Filesize

    18.3MB

  • memory/4632-191-0x00000000074D0000-0x0000000007573000-memory.dmp

    Filesize

    652KB

  • memory/4632-199-0x0000000007DD0000-0x0000000007DFA000-memory.dmp

    Filesize

    168KB

  • memory/4632-172-0x0000000007050000-0x00000000070E6000-memory.dmp

    Filesize

    600KB

  • memory/4632-173-0x0000000006570000-0x000000000658A000-memory.dmp

    Filesize

    104KB

  • memory/4632-174-0x00000000065C0000-0x00000000065E2000-memory.dmp

    Filesize

    136KB

  • memory/4632-175-0x00000000076D0000-0x0000000007C74000-memory.dmp

    Filesize

    5.6MB

  • memory/4632-177-0x0000000008300000-0x000000000897A000-memory.dmp

    Filesize

    6.5MB

  • memory/4632-178-0x0000000007280000-0x00000000072B2000-memory.dmp

    Filesize

    200KB

  • memory/4632-180-0x000000006FD00000-0x000000006FD4C000-memory.dmp

    Filesize

    304KB

  • memory/4632-179-0x0000000073880000-0x0000000074030000-memory.dmp

    Filesize

    7.7MB

  • memory/4632-190-0x0000000007260000-0x000000000727E000-memory.dmp

    Filesize

    120KB

  • memory/4632-170-0x0000000006070000-0x000000000608E000-memory.dmp

    Filesize

    120KB

  • memory/4632-192-0x00000000075F0000-0x00000000075FA000-memory.dmp

    Filesize

    40KB

  • memory/4632-193-0x0000000073880000-0x0000000074030000-memory.dmp

    Filesize

    7.7MB

  • memory/4632-194-0x0000000007610000-0x0000000007621000-memory.dmp

    Filesize

    68KB

  • memory/4632-195-0x0000000007680000-0x000000000768E000-memory.dmp

    Filesize

    56KB

  • memory/4632-196-0x0000000007690000-0x00000000076A4000-memory.dmp

    Filesize

    80KB

  • memory/4632-197-0x0000000007DC0000-0x0000000007DDA000-memory.dmp

    Filesize

    104KB

  • memory/4632-198-0x00000000076C0000-0x00000000076C8000-memory.dmp

    Filesize

    32KB

  • memory/4632-171-0x00000000060B0000-0x00000000060FC000-memory.dmp

    Filesize

    304KB

  • memory/4632-200-0x0000000007E00000-0x0000000007E24000-memory.dmp

    Filesize

    144KB

  • memory/4632-201-0x0000000073880000-0x0000000074030000-memory.dmp

    Filesize

    7.7MB

  • memory/4632-204-0x0000000073880000-0x0000000074030000-memory.dmp

    Filesize

    7.7MB

  • memory/4632-203-0x000000007388E000-0x000000007388F000-memory.dmp

    Filesize

    4KB

  • memory/4632-205-0x0000000073880000-0x0000000074030000-memory.dmp

    Filesize

    7.7MB

  • memory/4632-207-0x0000000073880000-0x0000000074030000-memory.dmp

    Filesize

    7.7MB

  • memory/4632-208-0x0000000008980000-0x00000000097B4000-memory.dmp

    Filesize

    14.2MB

  • memory/4632-209-0x0000000073880000-0x0000000074030000-memory.dmp

    Filesize

    7.7MB

  • memory/4632-210-0x0000000073880000-0x0000000074030000-memory.dmp

    Filesize

    7.7MB

  • memory/4632-160-0x00000000059A0000-0x0000000005CF4000-memory.dmp

    Filesize

    3.3MB

  • memory/4632-158-0x00000000058C0000-0x0000000005926000-memory.dmp

    Filesize

    408KB

  • memory/4632-159-0x0000000005930000-0x0000000005996000-memory.dmp

    Filesize

    408KB

  • memory/4632-157-0x00000000050B0000-0x00000000050D2000-memory.dmp

    Filesize

    136KB

  • memory/4632-155-0x0000000005290000-0x00000000058B8000-memory.dmp

    Filesize

    6.2MB

  • memory/4632-156-0x0000000073880000-0x0000000074030000-memory.dmp

    Filesize

    7.7MB

  • memory/4632-154-0x0000000073880000-0x0000000074030000-memory.dmp

    Filesize

    7.7MB

  • memory/4632-153-0x0000000002AA0000-0x0000000002AD6000-memory.dmp

    Filesize

    216KB

  • memory/4632-152-0x000000007388E000-0x000000007388F000-memory.dmp

    Filesize

    4KB

  • memory/4632-211-0x0000000073880000-0x0000000074030000-memory.dmp

    Filesize

    7.7MB