vipkeylogger | 372dc76e6d84b69619af43c61f21cb2fa5e0cd5ff8d0025c00858c16854ad077

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2025, 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PO202501A.exe
Size

255KB
MD5

2a39ab7049226dec986fa602a26f5372
SHA1

f0baf3b4f1dbcc6dd21e6f1279c741c0051c03cc
SHA256

ad4cd780bd7accd7482dcf6222910aafee971c7ab870ebae0022d51b237fa5cb
SHA512

5190d06d07b72f8ebaf326b6c0fcd85963afe598be499afee11881905ded944b58829a6ddc85a94f75621e5936496e151a1d8b4b96d12d38148a1f256841dafa
SSDEEP

6144:WIaCAK/UGjgTPD/CRe4GvTS8w9hzc9ap+zGj:hz7KmH9tp1

Score

10^/10

vipkeylogger collection discovery keylogger persistence stealer

Malware Config

Extracted

Family

vipkeylogger

https://api.telegram.org/bot7328132851:AAGjxJzgHhOy6CKcH2zQWuOPw-Si4v2MtvU/sendMessage?chat_id=7467176655

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO202501A = "cmd.exe /C start \"\" /D \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RootServices\" \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RootServices\\PO202501A.exe\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PO202501A = "cmd.exe /C start \"\" /D \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RootServices\" \"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RootServices\\PO202501A.exe\""	reg.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	reallyfreegeoip.org
7	checkip.dyndns.org
15	reallyfreegeoip.org
16	reallyfreegeoip.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 3836	1888	PO202501A.exe	87
PID 1888 set thread context of 2552	1888	PO202501A.exe	93

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\BugSplat64.dll	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\chrome_installer.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_000_dotnet_runtime_8.0.2_win_x64.msi.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_002_dotnet_host_8.0.2_win_x64.msi.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\wct3B4.tmp	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_001_dotnet_hostfxr_6.0.27_win_x64.msi.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_002_dotnet_host_7.0.16_win_x64.msi.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\OFGADUSE-20241007-0917.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_000_dotnet_runtime_6.0.27_win_x64.msi.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_000_dotnet_runtime_7.0.16_win_x64.msi.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\jusched.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_000_dotnet_runtime_7.0.16_win_x64.msi.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_002_dotnet_host_7.0.16_win_x64.msi.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_001_dotnet_hostfxr_8.0.2_win_x64.msi.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\{28F5FC03-762A-4FDB-B586-CCF1AA960500} - OProcSessId.dat	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_001_dotnet_hostfxr_7.0.16_win_x64.msi.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_002_dotnet_host_8.0.2_win_x64.msi.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\jawshtml.html	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_001_dotnet_hostfxr_6.0.27_win_x64.msi.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_003_windowsdesktop_runtime_8.0.2_win_x64.msi.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\wct50F4.tmp	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\msedge_installer.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\wctA316.tmp	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\aria-debug-668.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_vcredistMSI3407.txt	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\JavaDeployReg.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\jawshtml.html	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_vcredistMSI33E6.txt	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\PO202501A.exe	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\wct3B4.tmp	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_002_dotnet_host_6.0.27_win_x64.msi.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_001_dotnet_hostfxr_7.0.16_win_x64.msi.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_002_dotnet_host_6.0.27_win_x64.msi.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\wct5658.tmp	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\wctA316.tmp	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\wctCDDF.tmp	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\BugSplat64.dll	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\wct50F4.tmp	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_001_dotnet_hostfxr_8.0.2_win_x64.msi.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\jusched.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_vcredistUI3407.txt	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\OFGADUSE-20241007-0917a.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_6.0.27_(x64)_20241007091242_003_windowsdesktop_runtime_6.0.27_win_x64.msi.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\{28F5FC03-762A-4FDB-B586-CCF1AA960500} - OProcSessId.dat	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_vcredistUI33E6.txt	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_7.0.16_(x64)_20241007091324_003_windowsdesktop_runtime_7.0.16_win_x64.msi.log	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\wct5658.tmp	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\wctCDDF.tmp	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\BroadcastMsg_1728292607.txt	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\chrome_installer.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_vcredistUI33E6.txt	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\dd_vcredistUI3407.txt	PO202501A.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\BroadcastMsg_1728292607.txt	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\wmsetup.log	PO202501A.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\Microsoft_Windows_Desktop_Runtime_-_8.0.2_(x64)_20241007091345_003_windowsdesktop_runtime_8.0.2_win_x64.msi.log	PO202501A.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3836	AddInProcess32.exe
3836	AddInProcess32.exe
2552	AddInProcess32.exe
2552	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	PO202501A.exe
Token: SeDebugPrivilege	3836	AddInProcess32.exe
Token: SeDebugPrivilege	2552	AddInProcess32.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 772	1888	PO202501A.exe	83
PID 1888 wrote to memory of 772	1888	PO202501A.exe	83
PID 772 wrote to memory of 4100	772	cmd.exe	85
PID 772 wrote to memory of 4100	772	cmd.exe	85
PID 4100 wrote to memory of 3656	4100	cmd.exe	86
PID 4100 wrote to memory of 3656	4100	cmd.exe	86
PID 1888 wrote to memory of 3836	1888	PO202501A.exe	87
PID 1888 wrote to memory of 3836	1888	PO202501A.exe	87
PID 1888 wrote to memory of 3836	1888	PO202501A.exe	87
PID 1888 wrote to memory of 3836	1888	PO202501A.exe	87
PID 1888 wrote to memory of 3836	1888	PO202501A.exe	87
PID 1888 wrote to memory of 3836	1888	PO202501A.exe	87
PID 1888 wrote to memory of 3836	1888	PO202501A.exe	87
PID 1888 wrote to memory of 3836	1888	PO202501A.exe	87
PID 1888 wrote to memory of 4280	1888	PO202501A.exe	89
PID 1888 wrote to memory of 4280	1888	PO202501A.exe	89
PID 4280 wrote to memory of 3192	4280	cmd.exe	91
PID 4280 wrote to memory of 3192	4280	cmd.exe	91
PID 3192 wrote to memory of 3356	3192	cmd.exe	92
PID 3192 wrote to memory of 3356	3192	cmd.exe	92
PID 1888 wrote to memory of 2552	1888	PO202501A.exe	93
PID 1888 wrote to memory of 2552	1888	PO202501A.exe	93
PID 1888 wrote to memory of 2552	1888	PO202501A.exe	93
PID 1888 wrote to memory of 2552	1888	PO202501A.exe	93
PID 1888 wrote to memory of 2552	1888	PO202501A.exe	93
PID 1888 wrote to memory of 2552	1888	PO202501A.exe	93
PID 1888 wrote to memory of 2552	1888	PO202501A.exe	93
PID 1888 wrote to memory of 2552	1888	PO202501A.exe	93

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\PO202501A.exe
"C:\Users\Admin\AppData\Local\Temp\PO202501A.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C cmd.exe /C reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "PO202501A" /t REG_SZ /d "cmd.exe /C start \"\" /D \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\" \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\PO202501A.exe\"" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\system32\cmd.exe
    cmd.exe /C reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "PO202501A" /t REG_SZ /d "cmd.exe /C start \"\" /D \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\" \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\PO202501A.exe\"" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "PO202501A" /t REG_SZ /d "cmd.exe /C start \"\" /D \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\" \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\PO202501A.exe\"" /f
      4⤵
      Adds Run key to start application
      PID:3656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3836
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C cmd.exe /C reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "PO202501A" /t REG_SZ /d "cmd.exe /C start \"\" /D \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\" \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\PO202501A.exe\"" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\system32\cmd.exe
    cmd.exe /C reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "PO202501A" /t REG_SZ /d "cmd.exe /C start \"\" /D \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\" \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\PO202501A.exe\"" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "PO202501A" /t REG_SZ /d "cmd.exe /C start \"\" /D \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\" \"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\PO202501A.exe\"" /f
      4⤵
      Adds Run key to start application
      PID:3356
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RootServices\wct3B4.tmp

Filesize
63KB

MD5
e516a60bc980095e8d156b1a99ab5eee

SHA1
238e243ffc12d4e012fd020c9822703109b987f6

SHA256
543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

SHA512
9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

Download Submit
memory/1888-2-0x0000024D0E310000-0x0000024D0E320000-memory.dmp

Filesize
64KB

Download
memory/3836-42-0x0000000005C30000-0x00000000061D4000-memory.dmp

Filesize
5.6MB

Download
memory/3836-41-0x00000000750CE000-0x00000000750CF000-memory.dmp

Filesize
4KB

Download
memory/3836-43-0x0000000005560000-0x00000000055FC000-memory.dmp

Filesize
624KB

Download
memory/3836-44-0x00000000750C0000-0x0000000075870000-memory.dmp

Filesize
7.7MB

Download
memory/3836-40-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3836-85-0x0000000006930000-0x0000000006AF2000-memory.dmp

Filesize
1.8MB

Download
memory/3836-86-0x00000000067B0000-0x0000000006800000-memory.dmp

Filesize
320KB

Download
memory/3836-87-0x00000000750CE000-0x00000000750CF000-memory.dmp

Filesize
4KB

Download
memory/3836-88-0x0000000007030000-0x000000000755C000-memory.dmp

Filesize
5.2MB

Download
memory/3836-89-0x00000000750C0000-0x0000000075870000-memory.dmp

Filesize
7.7MB

Download
memory/3836-90-0x0000000006B00000-0x0000000006B92000-memory.dmp

Filesize
584KB

Download
memory/3836-91-0x0000000006900000-0x000000000690A000-memory.dmp

Filesize
40KB

Download