Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2025, 16:08
Static task
static1
Behavioral task
behavioral1
Sample
NewOrder837989.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
NewOrder837989.exe
Resource
win10v2004-20241007-en
General
-
Target
NewOrder837989.exe
-
Size
885KB
-
MD5
d8f3a68154ffc12d0677b879a386dc0f
-
SHA1
8be35f2b7a4c5454191181d72fc8da4eb7f48d1a
-
SHA256
061bc2648b58846a4dc7cc468cbf1b4bcd2be744502ea0775b705b04ef536dfe
-
SHA512
d119cd6f765b5de4095aba48ad0618623c78ebd9ca7c157d1cc48688af69e2b37e2e7a204dc01145c0c4425a113398c1feba26e84cc2df8a298a5bf4927942e8
-
SSDEEP
12288:fzH2iNtAmJPkvxkTLj5+hMfgwBoyum1gfDWnKGv9TCf1povSAYqcv2ShtTFn+Kbt:fL1XAsWIL+MfDumwALv9mbOSAkZ+6us
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.aktagor-prom.by - Port:
587 - Username:
[email protected] - Password:
71z&rRC84 - Email To:
[email protected]
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 NewOrder837989.exe Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 NewOrder837989.exe Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 NewOrder837989.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 checkip.dyndns.org 23 reallyfreegeoip.org 24 reallyfreegeoip.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2332 set thread context of 5104 2332 NewOrder837989.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NewOrder837989.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NewOrder837989.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2332 NewOrder837989.exe 2332 NewOrder837989.exe 5104 NewOrder837989.exe 5104 NewOrder837989.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2332 NewOrder837989.exe Token: SeDebugPrivilege 5104 NewOrder837989.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2332 wrote to memory of 1040 2332 NewOrder837989.exe 89 PID 2332 wrote to memory of 1040 2332 NewOrder837989.exe 89 PID 2332 wrote to memory of 1040 2332 NewOrder837989.exe 89 PID 2332 wrote to memory of 5104 2332 NewOrder837989.exe 90 PID 2332 wrote to memory of 5104 2332 NewOrder837989.exe 90 PID 2332 wrote to memory of 5104 2332 NewOrder837989.exe 90 PID 2332 wrote to memory of 5104 2332 NewOrder837989.exe 90 PID 2332 wrote to memory of 5104 2332 NewOrder837989.exe 90 PID 2332 wrote to memory of 5104 2332 NewOrder837989.exe 90 PID 2332 wrote to memory of 5104 2332 NewOrder837989.exe 90 PID 2332 wrote to memory of 5104 2332 NewOrder837989.exe 90 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 NewOrder837989.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 NewOrder837989.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NewOrder837989.exe"C:\Users\Admin\AppData\Local\Temp\NewOrder837989.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\NewOrder837989.exe"C:\Users\Admin\AppData\Local\Temp\NewOrder837989.exe"2⤵PID:1040
-
-
C:\Users\Admin\AppData\Local\Temp\NewOrder837989.exe"C:\Users\Admin\AppData\Local\Temp\NewOrder837989.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:5104
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58ec831f3e3a3f77e4a7b9cd32b48384c
SHA1d83f09fd87c5bd86e045873c231c14836e76a05c
SHA2567667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA51226bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3