Analysis
-
max time kernel
2s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
30-01-2025 03:44
General
-
Target
f6ad2374fe19582a54ac0b9972ec41223f4291af9e49834fbd240629b9c74e62.exe
-
Size
556KB
-
MD5
6ca301ca8387dce5fd21f318ebba05c6
-
SHA1
42721db007b2a33119e951aa29749af25bc4cf01
-
SHA256
f6ad2374fe19582a54ac0b9972ec41223f4291af9e49834fbd240629b9c74e62
-
SHA512
37eb46fc6493dc3ee783a9fbfba56356f3a088dca8c53ba4d7f7aa3dd2f56c2f8ab5567bce3118f0611a7923e4cda12174f407b3262c1f4f41f07835fcc1f618
-
SSDEEP
12288:Ak2r86ZoU8clmyN7oOX4V44I5pqAm3R3W6TRVZdMN6:m86SU8clmyNI44InqRR1ZdM0
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7581561605:AAGI-5iG4DeXqVhNDvhaICvGbOejumUD6AE/sendMessage?chat_id=5434550993
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL 10 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6ad2374fe19582a54ac0b9972ec41223f4291af9e49834fbd240629b9c74e62.exe"C:\Users\Admin\AppData\Local\Temp\f6ad2374fe19582a54ac0b9972ec41223f4291af9e49834fbd240629b9c74e62.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\f6ad2374fe19582a54ac0b9972ec41223f4291af9e49834fbd240629b9c74e62.exe"C:\Users\Admin\AppData\Local\Temp\f6ad2374fe19582a54ac0b9972ec41223f4291af9e49834fbd240629b9c74e62.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f1e9eed02db3a822a7ddef0c724e5f1f
SHA165864992f5b6c79c5efbefb5b1354648a8a86709
SHA2566dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df
SHA512c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c
-
Filesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
-
Filesize
4KB
MD52e7baf4f3c9f5830af25c66ecbe1dac4
SHA1275ee3d8faeef514ec71605788561bae14f3a48a
SHA25637346b6387f7d33a9eab62407f94cd716081eb80d7443db91b788479e6fcaf4c
SHA512a7900cc0e56998f9cd30b24584c15a8a533139cb01d16bf2046c1b1bf5ffbd67216aac69a83d1968206a99185f692bf21429622cbf53a9abbbf528ff21f7cb45
-
Filesize
32.7MB
-
Filesize
32.7MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
32.7MB
-
Filesize
18.3MB
-
Filesize
32.7MB
-
Filesize
288KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
32.7MB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
5.2MB
-
Filesize
584KB
-
Filesize
40KB