vipkeylogger | 4b3b4e96c1ec2ea5a49e69464edfa16ebd708a9cf5119f0ccb3d8078a41ce9cc

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2025 02:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SCHEFFER ORDER N. F-1676.25.exe
Size

827KB
MD5

6f41fbaa7470af3cc1c6194d997b63d6
SHA1

9d10a3b0bf95d04c4834ebf380f22b7ad088c41e
SHA256

a62c7c9c769aa4ffdd8729d5b5c688b1ef831be21d64247d75e7285d86e78af4
SHA512

316df40ccb2cb77fc825f74e18ec03579211978438bfb8ab88e394d2d5f6008ae565efcba3dc52879c3953e90d930d788df3b2b78d14045ced315e48279f4cc7
SSDEEP

12288:ehkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aCpeVyxldN/CLgUQr:uRmJkcoQricOIQxiZY1iaCpcap/q3G

Score

10^/10

vipkeylogger discovery keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.npmmachinery.com
Port:
587
Username:
[email protected]
Password:
^@SC}ST5oCG-
Email To:
[email protected]

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
15	checkip.dyndns.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 4304	2412	SCHEFFER ORDER N. F-1676.25.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1592	4304	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SCHEFFER ORDER N. F-1676.25.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4304	RegSvcs.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2412	SCHEFFER ORDER N. F-1676.25.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4304	RegSvcs.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2412	SCHEFFER ORDER N. F-1676.25.exe
2412	SCHEFFER ORDER N. F-1676.25.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2412	SCHEFFER ORDER N. F-1676.25.exe
2412	SCHEFFER ORDER N. F-1676.25.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 4304	2412	SCHEFFER ORDER N. F-1676.25.exe	83
PID 2412 wrote to memory of 4304	2412	SCHEFFER ORDER N. F-1676.25.exe	83
PID 2412 wrote to memory of 4304	2412	SCHEFFER ORDER N. F-1676.25.exe	83
PID 2412 wrote to memory of 4304	2412	SCHEFFER ORDER N. F-1676.25.exe	83

C:\Users\Admin\AppData\Local\Temp\SCHEFFER ORDER N. F-1676.25.exe
"C:\Users\Admin\AppData\Local\Temp\SCHEFFER ORDER N. F-1676.25.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Users\Admin\AppData\Local\Temp\SCHEFFER ORDER N. F-1676.25.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 1452
    3⤵
    - Program crash
    PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4304 -ip 4304
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-6-0x00000000032F0000-0x00000000033F0000-memory.dmp

Filesize
1024KB

Download
memory/4304-7-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4304-8-0x000000007497E000-0x000000007497F000-memory.dmp

Filesize
4KB

Download
memory/4304-9-0x00000000055C0000-0x0000000005B64000-memory.dmp

Filesize
5.6MB

Download
memory/4304-10-0x0000000004EE0000-0x0000000004F7C000-memory.dmp

Filesize
624KB

Download
memory/4304-11-0x0000000074970000-0x0000000075120000-memory.dmp

Filesize
7.7MB

Download
memory/4304-12-0x0000000074970000-0x0000000075120000-memory.dmp

Filesize
7.7MB

Download