Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 08:59
Behavioral task
behavioral1
Sample
INQUIRY -HQ242654.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
INQUIRY -HQ242654.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
out.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win10v2004-20241007-en
General
-
Target
INQUIRY -HQ242654.exe
-
Size
880KB
-
MD5
c6c43489f393bf91583e443ba7abe9a2
-
SHA1
728c1ddaef19694bf7f509db6dcf77923684c98c
-
SHA256
86cf677cb017e9dabac429f6da02582beca7747a2971db750ee64b480be81236
-
SHA512
919ea7a6a732fa5bdbab3bdeb62b16eb4ab24dd0a32455aa4498dfec8d33a7745a608795b5a930f42fe20cf09d31c1c643b8e5be05546e25c72991143cdf4c03
-
SSDEEP
24576:tthEVaPqLKp26vHrsXLz5+5Yehl7qV0JHf91x:VEVUcKp2QsJ+OeLFTx
Malware Config
Extracted
Protocol: smtp- Host:
mail.vvtrade.vn - Port:
587 - Username:
[email protected] - Password:
qVyP6qyv6MQCmZJBRs4t
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.vvtrade.vn - Port:
587 - Username:
[email protected] - Password:
qVyP6qyv6MQCmZJBRs4t - Email To:
[email protected]
https://api.telegram.org/bot7323823089:AAFBRsTW94zIpSoDS8yfGsotlQLqF2I6TU0/sendMessage?chat_id=5013849544
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\soliloquise.vbs soliloquise.exe -
Executes dropped EXE 1 IoCs
pid Process 2196 soliloquise.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 checkip.dyndns.org 15 reallyfreegeoip.org 16 reallyfreegeoip.org -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1768-9-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/2196-17-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2196 set thread context of 3172 2196 soliloquise.exe 84 -
resource yara_rule behavioral2/memory/1768-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/1768-9-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x000a000000023b90-8.dat upx behavioral2/memory/2196-17-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language INQUIRY -HQ242654.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language soliloquise.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3172 RegSvcs.exe 3172 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2196 soliloquise.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3172 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1768 INQUIRY -HQ242654.exe 1768 INQUIRY -HQ242654.exe 2196 soliloquise.exe 2196 soliloquise.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1768 INQUIRY -HQ242654.exe 1768 INQUIRY -HQ242654.exe 2196 soliloquise.exe 2196 soliloquise.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1768 wrote to memory of 2196 1768 INQUIRY -HQ242654.exe 83 PID 1768 wrote to memory of 2196 1768 INQUIRY -HQ242654.exe 83 PID 1768 wrote to memory of 2196 1768 INQUIRY -HQ242654.exe 83 PID 2196 wrote to memory of 3172 2196 soliloquise.exe 84 PID 2196 wrote to memory of 3172 2196 soliloquise.exe 84 PID 2196 wrote to memory of 3172 2196 soliloquise.exe 84 PID 2196 wrote to memory of 3172 2196 soliloquise.exe 84 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INQUIRY -HQ242654.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY -HQ242654.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\nasal\soliloquise.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY -HQ242654.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\INQUIRY -HQ242654.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:3172
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
880KB
MD5c6c43489f393bf91583e443ba7abe9a2
SHA1728c1ddaef19694bf7f509db6dcf77923684c98c
SHA25686cf677cb017e9dabac429f6da02582beca7747a2971db750ee64b480be81236
SHA512919ea7a6a732fa5bdbab3bdeb62b16eb4ab24dd0a32455aa4498dfec8d33a7745a608795b5a930f42fe20cf09d31c1c643b8e5be05546e25c72991143cdf4c03