vipkeylogger | 99bdd17942ceb530cca3a05bf80a1f6a01cc938a90bfc8ececa680503669bfde

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2025 03:56

Target

PO202501F.exe
Size

615KB
MD5

a70322c6cc4b2cf7b2e21e54eaa49643
SHA1

3da33eb5a8bcdbc578b56984d9883c598f3786c1
SHA256

ceba2c86afbcafec83c35c4a501db488ededa75515d55df652aa22ac9bc9dac6
SHA512

accda190a6ab65b2a5929cf17eea28b3812858b0a629a6aa92e5b41c8cd1d1d183763ec7c59abd800ffdedb0b06006a36a30a6f875c08a7279d456090ea60124
SSDEEP

12288:hQUqaxXOuZv5s2PIbZyxyLUL+z14JqY+W6Y6Y4CYYYY4pYYYYdYYYYwYYYYaYYYn:hQUnZa2wbZyxyLG+z1VY+W6Y6Y4CYYYQ

Score

10^/10

Family

vipkeylogger

https://api.telegram.org/bot7965348925:AAGe8wdrvk9A3lxr1GIjGigodJ_zZ7prhfs/sendMessage?chat_id=6848903538

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4264 set thread context of 464	4264	PO202501F.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1644	464	WerFault.exe	83

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 464	4264	PO202501F.exe	83
PID 4264 wrote to memory of 464	4264	PO202501F.exe	83
PID 4264 wrote to memory of 464	4264	PO202501F.exe	83
PID 4264 wrote to memory of 464	4264	PO202501F.exe	83
PID 4264 wrote to memory of 464	4264	PO202501F.exe	83
PID 4264 wrote to memory of 464	4264	PO202501F.exe	83
PID 4264 wrote to memory of 464	4264	PO202501F.exe	83
PID 4264 wrote to memory of 464	4264	PO202501F.exe	83

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 464 -ip 464
1⤵
PID:4928

memory/464-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download