Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2025, 15:48

General

  • Target

    Vessel particulars.exe

  • Size

    1.1MB

  • MD5

    909a37e97faff915cd4906fe7684ec63

  • SHA1

    5ae37a8ae70e36e9cf4f9e8895045f77eca11c51

  • SHA256

    a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f

  • SHA512

    58bb45c2d55b4602852c0921f9aa39f3a09645689beea49b7408ce44da75eb9f9701effc765f3808e8d79eaefa9fc49531719e3d334d1d21e54ca35f78cac25d

  • SSDEEP

    24576:bAHnh+eWsN3skA4RV1Hom2KXFmIaQtS2rEDjuKsV5U5j5:2h+ZkldoPK1XaQtvEDqTV5UL

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot8043603189:AAFpR2ormgQgQpP5aDirNgZd72aHXUsGdlI/sendMessage?chat_id=2135869667

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Vipkeylogger family
  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vessel particulars.exe
    "C:\Users\Admin\AppData\Local\Temp\Vessel particulars.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4052
    • C:\Users\Admin\AppData\Local\parachronism\savagenesses.exe
      "C:\Users\Admin\AppData\Local\Temp\Vessel particulars.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4680
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Users\Admin\AppData\Local\Temp\Vessel particulars.exe"
        3⤵
          PID:3640
        • C:\Users\Admin\AppData\Local\parachronism\savagenesses.exe
          "C:\Users\Admin\AppData\Local\parachronism\savagenesses.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1600
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Users\Admin\AppData\Local\parachronism\savagenesses.exe"
            4⤵
            • Accesses Microsoft Outlook profiles
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:4380

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\autD4B6.tmp

      Filesize

      242KB

      MD5

      efa36559459d8a95d5d29596030bb9cb

      SHA1

      dd4292faa0dc9430ab8a56ebaa29e3de2169e20d

      SHA256

      cf2cd6d65a7e9be25f5fcdbbb17d69142fe1af0295a9b43328db77e91a94067c

      SHA512

      cef22a7688400302f337d27f27697da7c7f4bbac78b7c7c0b302b69fe9113399b12a8f0fb94639209442c530a5e24fba5c939af4f5ac1e0c7c0a91a355c47ec0

    • C:\Users\Admin\AppData\Local\Temp\autDACF.tmp

      Filesize

      11KB

      MD5

      02cb391fa991f4a7c4288b2636b3f432

      SHA1

      92c161c146b6d8b5f08976aefbb1b88ae2937ddb

      SHA256

      32960f8fc3a5cda77afd30fe66dedd132446acd360fc42b16c3f3cbd541d43a8

      SHA512

      818f4c28fe7d12531ea19c7df4b46ea1d1296ac6d7d922bcababc456bd295089a6e4977487dbe801ce205aab017d7c2e1b318392e9aa9bf5d912a6d0db767718

    • C:\Users\Admin\AppData\Local\Temp\scroll

      Filesize

      58KB

      MD5

      2533f891e58ed20a758e7d7694e14cce

      SHA1

      89058b25ad725522939f4d1a66cd53d706ae124b

      SHA256

      bd1f6f108b7d53e1274736692946d1fa28e51cafa3320912edced0258ec90f6c

      SHA512

      f35ced1276857655c358f6e7f5600cd2f9c89c20d9ac6ab3b0c4bed45c816c730ecee0f0012268c846faf7236e3e245327c7f2405cff69f8660a812a2b940747

    • C:\Users\Admin\AppData\Local\parachronism\savagenesses.exe

      Filesize

      1.1MB

      MD5

      909a37e97faff915cd4906fe7684ec63

      SHA1

      5ae37a8ae70e36e9cf4f9e8895045f77eca11c51

      SHA256

      a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f

      SHA512

      58bb45c2d55b4602852c0921f9aa39f3a09645689beea49b7408ce44da75eb9f9701effc765f3808e8d79eaefa9fc49531719e3d334d1d21e54ca35f78cac25d

    • memory/1600-52-0x0000000000F30000-0x000000000104C000-memory.dmp

      Filesize

      1.1MB

    • memory/1600-56-0x0000000000F30000-0x000000000104C000-memory.dmp

      Filesize

      1.1MB

    • memory/4052-13-0x0000000000FB0000-0x00000000013B0000-memory.dmp

      Filesize

      4.0MB

    • memory/4380-103-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-88-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-54-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

    • memory/4380-55-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

    • memory/4380-57-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

    • memory/4380-1156-0x0000000006920000-0x000000000692A000-memory.dmp

      Filesize

      40KB

    • memory/4380-58-0x00000000054C0000-0x000000000551E000-memory.dmp

      Filesize

      376KB

    • memory/4380-59-0x0000000005B10000-0x00000000060B4000-memory.dmp

      Filesize

      5.6MB

    • memory/4380-60-0x0000000005560000-0x00000000055BC000-memory.dmp

      Filesize

      368KB

    • memory/4380-112-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-120-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-118-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-116-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-114-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-110-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-108-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-106-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-104-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-1155-0x0000000006B20000-0x0000000006BB2000-memory.dmp

      Filesize

      584KB

    • memory/4380-98-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-97-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-94-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-90-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-53-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

    • memory/4380-86-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-84-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-82-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-80-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-78-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-74-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-72-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-70-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-68-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-66-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-64-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-100-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-92-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-76-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-62-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-61-0x0000000005560000-0x00000000055B7000-memory.dmp

      Filesize

      348KB

    • memory/4380-1151-0x0000000005660000-0x00000000056FC000-memory.dmp

      Filesize

      624KB

    • memory/4380-1152-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

    • memory/4380-1153-0x0000000006950000-0x0000000006B12000-memory.dmp

      Filesize

      1.8MB

    • memory/4380-1154-0x0000000006800000-0x0000000006850000-memory.dmp

      Filesize

      320KB

    • memory/4680-33-0x0000000000F30000-0x000000000104C000-memory.dmp

      Filesize

      1.1MB

    • memory/4680-36-0x0000000000F30000-0x000000000104C000-memory.dmp

      Filesize

      1.1MB