vipkeylogger | c3a99726270b8bdb50ec74391f81b4009e6d3dedfb1ace4baaaa344268e19f37

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-01-2025 07:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
Size

1.2MB
MD5

4e7fb712b6378a30717e7f3035ceb7b6
SHA1

3689e20b5f1b3ad0f72084db5b135271e7f8fe78
SHA256

c3a99726270b8bdb50ec74391f81b4009e6d3dedfb1ace4baaaa344268e19f37
SHA512

dfbad75dd71eb3d553a30ed1fc3e1f2f71877d87a012441ba6269417061098dedda198114ff8c4ea7d8ff4800aca1da0e9d9a8dc8d3ef9dc82a9bd35cc6869b8
SSDEEP

24576:eqDEvCTbMWu7rQYlBQcBiT6rprG8aCHaAmUe7DCmq:eTvC/MTQYxsWR7aC6A47

Score

10^/10

vipkeylogger collection discovery keylogger stealer

Malware Config

Extracted

Credentials

Protocol: smtp
Host:
mail.humatextiles.com
Port:
587
Username:
[email protected]
Password:
humatex786

Extracted

Family

vipkeylogger

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
14	checkip.dyndns.org
16	reallyfreegeoip.org
17	reallyfreegeoip.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3832 set thread context of 4432	3832	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	87

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4432	RegSvcs.exe
4432	RegSvcs.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
1852	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
452	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
3832	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	RegSvcs.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
1852	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
1852	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
452	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
452	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
3832	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
3832	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1852	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
1852	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
452	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
452	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
3832	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
3832	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 860	1852	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	83
PID 1852 wrote to memory of 860	1852	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	83
PID 1852 wrote to memory of 860	1852	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	83
PID 1852 wrote to memory of 452	1852	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	84
PID 1852 wrote to memory of 452	1852	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	84
PID 1852 wrote to memory of 452	1852	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	84
PID 452 wrote to memory of 4068	452	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	85
PID 452 wrote to memory of 4068	452	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	85
PID 452 wrote to memory of 4068	452	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	85
PID 452 wrote to memory of 3832	452	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	86
PID 452 wrote to memory of 3832	452	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	86
PID 452 wrote to memory of 3832	452	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	86
PID 3832 wrote to memory of 4432	3832	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	87
PID 3832 wrote to memory of 4432	3832	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	87
PID 3832 wrote to memory of 4432	3832	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	87
PID 3832 wrote to memory of 4432	3832	C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe	87

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
"C:\Users\Admin\AppData\Local\Temp\C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe"
  2⤵
  PID:860
- C:\Users\Admin\AppData\Local\Temp\C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
  "C:\Users\Admin\AppData\Local\Temp\C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Users\Admin\AppData\Local\Temp\C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe"
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe
    "C:\Users\Admin\AppData\Local\Temp\C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3832
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\C3A99726270B8BDB50EC74391F81B4009E6D3DEDFB1ACE4BAAAA344268E19F37.exe"
      4⤵
      Accesses Microsoft Outlook profiles
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      outlook_office_path
      outlook_win_path
      PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\autB2D5.tmp

Filesize
241KB

MD5
e7c7867293a0c99f14bbe43950d0a81b

SHA1
269f5fdbb1f3d6abed260e87e356432adf12d203

SHA256
cab7b20ffa7dc7e089c2717d273732fba6bf51942a96216cf7abf8c2d055328d

SHA512
69c58bbb259b7a12d12088946edafdb67395c8454d07eaa291f221d36d8d89928a734959a33aa6c6fb910918128c82b2e7bf7891a28e072fede003ffe0d5f6d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\autB2D6.tmp

Filesize
9KB

MD5
6f5e1056ca1259dd55b640731ba95618

SHA1
529aba113d59af72690e198723bf4ad32eaa2f58

SHA256
75157ae2a39d541c724b3268d451451ae4f4ff459cdf7de0df7b81fe3e753d9d

SHA512
1f4839c04a33c521ec3dea537678dbdab3d17448ca508914c3af5d49b52315741711eaed9ee7be9911c0b8fdb507b9b242752beea3029526442dc59a057576e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\electicism

Filesize
243KB

MD5
a10a42bc5f37d2f7d706d7e463afbb5e

SHA1
bcc445429fcbf6d7055b3ff91f036728709b3f33

SHA256
444a96a1bdb6cfaf025e6942a71387826e79c6c9858d19988cc20eefaf98aa87

SHA512
28ff2c1cc40be089350e27a5db89484b49af4be826a6bb439ba85d8f5a7cd2229a9f999f46831f4e72a04eabf3d1913fe60d0fa69dd2c11412bbc30c0ea75374

Download Submit
C:\Users\Admin\AppData\Local\Temp\strangulating

Filesize
28KB

MD5
c6d96a7bcabb521adfa6242b450e308c

SHA1
bfe30c5c8d007dfd1d4704d8562dd32c638fe9cc

SHA256
0e64f6d7ec21b1ce7077b6bfa0fe6632a8117a8fc9f322891b37766a7727f5d6

SHA512
b7bd5a854bd320d7d4ba3a5c82e86285e9fbec2d79a03f868c33de93da9b371c8eec3d48a637f9fd5be0d4993eb457a6ea4b83f2c2afa53e98501c0ce15b5216

Download Submit
memory/1852-11-0x0000000004560000-0x0000000004564000-memory.dmp

Filesize
16KB

Download
memory/4432-38-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4432-39-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4432-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4432-41-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4432-42-0x0000000002D20000-0x0000000002D7E000-memory.dmp

Filesize
376KB

Download
memory/4432-43-0x0000000005840000-0x0000000005DE4000-memory.dmp

Filesize
5.6MB

Download
memory/4432-44-0x00000000052A0000-0x00000000052FC000-memory.dmp

Filesize
368KB

Download
memory/4432-88-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-104-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-102-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-100-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-98-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-96-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-94-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-92-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-90-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-86-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-84-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-82-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-80-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-78-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-76-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-74-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-72-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-70-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-68-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-66-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-62-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-60-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-58-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-64-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-56-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-54-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-52-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-50-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-48-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-46-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-45-0x00000000052A0000-0x00000000052F7000-memory.dmp

Filesize
348KB

Download
memory/4432-1135-0x00000000053D0000-0x000000000546C000-memory.dmp

Filesize
624KB

Download
memory/4432-1136-0x0000000006860000-0x0000000006A22000-memory.dmp

Filesize
1.8MB

Download
memory/4432-1137-0x00000000066F0000-0x0000000006740000-memory.dmp

Filesize
320KB

Download
memory/4432-1138-0x0000000006F60000-0x000000000748C000-memory.dmp

Filesize
5.2MB

Download
memory/4432-1139-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4432-1140-0x0000000006AD0000-0x0000000006B62000-memory.dmp

Filesize
584KB

Download
memory/4432-1141-0x0000000006A40000-0x0000000006A4A000-memory.dmp

Filesize
40KB

Download