vipkeylogger | 0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f

General

Target

0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe
Size

797KB
MD5

7d88e5bad194e89ada135543169da996
SHA1

929a742475ae4b93a5e164b1d565d7d7f78f6b62
SHA256

0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f
SHA512

8906f861bc6049f059757a24d326b21ea626d4b890791c1e10f101a8f387ae24febcc5501440ea45d07675c775286664dcd75d4f61a2929939cc87169ae0aede
SSDEEP

12288:zibdSKErr8jptCVn7B/7jJIk9dB6g5MCao3AiqLwgDn7PK:VqpgVt/7mk9dBKo3A9LD7PK

Score

10^/10

vipkeylogger discovery keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.gtpv.online
Port:
587
Username:
[email protected]
Password:
7213575aceACE@@
Email To:
[email protected]

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 2880	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2108	2880	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe
2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe
2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe
2880	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe
Token: SeDebugPrivilege	2880	InstallUtil.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2880	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe	31
PID 2148 wrote to memory of 2880	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe	31
PID 2148 wrote to memory of 2880	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe	31
PID 2148 wrote to memory of 2880	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe	31
PID 2148 wrote to memory of 2880	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe	31
PID 2148 wrote to memory of 2880	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe	31
PID 2148 wrote to memory of 2880	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe	31
PID 2148 wrote to memory of 2880	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe	31
PID 2148 wrote to memory of 2880	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe	31
PID 2148 wrote to memory of 2880	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe	31
PID 2148 wrote to memory of 2880	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe	31
PID 2148 wrote to memory of 2880	2148	0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe	31
PID 2880 wrote to memory of 2108	2880	InstallUtil.exe	32
PID 2880 wrote to memory of 2108	2880	InstallUtil.exe	32
PID 2880 wrote to memory of 2108	2880	InstallUtil.exe	32
PID 2880 wrote to memory of 2108	2880	InstallUtil.exe	32

C:\Users\Admin\AppData\Local\Temp\0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe
"C:\Users\Admin\AppData\Local\Temp\0d6d13b615ce21e4a4ff75ec6ad0047a5664aafc05745188afc2e4497c2bed9f.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 1068
    3⤵
    - Program crash
    PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-0-0x000000007435E000-0x000000007435F000-memory.dmp

Filesize
4KB

Download
memory/2148-1-0x0000000000FC0000-0x000000000108C000-memory.dmp

Filesize
816KB

Download
memory/2148-2-0x00000000004C0000-0x0000000000502000-memory.dmp

Filesize
264KB

Download
memory/2148-3-0x0000000074350000-0x0000000074A3E000-memory.dmp

Filesize
6.9MB

Download
memory/2148-4-0x000000007435E000-0x000000007435F000-memory.dmp

Filesize
4KB

Download
memory/2148-5-0x0000000074350000-0x0000000074A3E000-memory.dmp

Filesize
6.9MB

Download
memory/2148-6-0x00000000005B0000-0x00000000005CA000-memory.dmp

Filesize
104KB

Download
memory/2148-7-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/2148-19-0x0000000074350000-0x0000000074A3E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-12-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2880-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2880-10-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2880-9-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2880-16-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2880-17-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2880-18-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2880-8-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2880-20-0x0000000074350000-0x0000000074A3E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-21-0x0000000074350000-0x0000000074A3E000-memory.dmp

Filesize
6.9MB

Download
memory/2880-22-0x0000000074350000-0x0000000074A3E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing