Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/01/2025, 06:32

General

  • Target

    a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f.exe

  • Size

    1.1MB

  • MD5

    909a37e97faff915cd4906fe7684ec63

  • SHA1

    5ae37a8ae70e36e9cf4f9e8895045f77eca11c51

  • SHA256

    a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f

  • SHA512

    58bb45c2d55b4602852c0921f9aa39f3a09645689beea49b7408ce44da75eb9f9701effc765f3808e8d79eaefa9fc49531719e3d334d1d21e54ca35f78cac25d

  • SSDEEP

    24576:bAHnh+eWsN3skA4RV1Hom2KXFmIaQtS2rEDjuKsV5U5j5:2h+ZkldoPK1XaQtvEDqTV5UL

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot8043603189:AAFpR2ormgQgQpP5aDirNgZd72aHXUsGdlI/sendMessage?chat_id=2135869667

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Vipkeylogger family
  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f.exe
    "C:\Users\Admin\AppData\Local\Temp\a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Local\parachronism\savagenesses.exe
      "C:\Users\Admin\AppData\Local\Temp\a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2196
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Users\Admin\AppData\Local\Temp\a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f.exe"
        3⤵
          PID:3048
        • C:\Users\Admin\AppData\Local\parachronism\savagenesses.exe
          "C:\Users\Admin\AppData\Local\parachronism\savagenesses.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2668
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Users\Admin\AppData\Local\parachronism\savagenesses.exe"
            4⤵
            • Accesses Microsoft Outlook profiles
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:880

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\aut6A76.tmp

      Filesize

      11KB

      MD5

      02cb391fa991f4a7c4288b2636b3f432

      SHA1

      92c161c146b6d8b5f08976aefbb1b88ae2937ddb

      SHA256

      32960f8fc3a5cda77afd30fe66dedd132446acd360fc42b16c3f3cbd541d43a8

      SHA512

      818f4c28fe7d12531ea19c7df4b46ea1d1296ac6d7d922bcababc456bd295089a6e4977487dbe801ce205aab017d7c2e1b318392e9aa9bf5d912a6d0db767718

    • C:\Users\Admin\AppData\Local\Temp\saccule

      Filesize

      242KB

      MD5

      efa36559459d8a95d5d29596030bb9cb

      SHA1

      dd4292faa0dc9430ab8a56ebaa29e3de2169e20d

      SHA256

      cf2cd6d65a7e9be25f5fcdbbb17d69142fe1af0295a9b43328db77e91a94067c

      SHA512

      cef22a7688400302f337d27f27697da7c7f4bbac78b7c7c0b302b69fe9113399b12a8f0fb94639209442c530a5e24fba5c939af4f5ac1e0c7c0a91a355c47ec0

    • C:\Users\Admin\AppData\Local\Temp\saccule

      Filesize

      242KB

      MD5

      ecccfccb8eed72dfef546a9a0369cb4d

      SHA1

      4e63476c67d038f5714742fa203a5d07edf00779

      SHA256

      83ad02f507b9b4e0e025017eaba581a869c7dadaa3370c441da280235deb8b56

      SHA512

      736dd0e323a9dd0f6b073bee5816775bc0e9b6713d3ac4c4d4adf2b0f2c767d6d5ae134aed050cd2d2afc143923559cc0b915155115a287496595392e9a949a2

    • C:\Users\Admin\AppData\Local\Temp\saccule

      Filesize

      242KB

      MD5

      b10252caed8752b40a23d52d5ef8dd81

      SHA1

      f477f0eb1288d703f3118842819f8160ec156600

      SHA256

      579636708a1e25eabb7ef55fe0026a56cc71c6ad7ecb6af45d7d5a7497e3be1d

      SHA512

      5ebd9ff7fea2d9ea7b7a0e5aedfeb3c2818f242dd0dc5a28bf47791d9cce26fe84e1174223dfcf8ff989973f6064ed0dc4e05cddc0ddee0705778f4996170e15

    • C:\Users\Admin\AppData\Local\Temp\scroll

      Filesize

      58KB

      MD5

      2533f891e58ed20a758e7d7694e14cce

      SHA1

      89058b25ad725522939f4d1a66cd53d706ae124b

      SHA256

      bd1f6f108b7d53e1274736692946d1fa28e51cafa3320912edced0258ec90f6c

      SHA512

      f35ced1276857655c358f6e7f5600cd2f9c89c20d9ac6ab3b0c4bed45c816c730ecee0f0012268c846faf7236e3e245327c7f2405cff69f8660a812a2b940747

    • \Users\Admin\AppData\Local\parachronism\savagenesses.exe

      Filesize

      1.1MB

      MD5

      909a37e97faff915cd4906fe7684ec63

      SHA1

      5ae37a8ae70e36e9cf4f9e8895045f77eca11c51

      SHA256

      a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f

      SHA512

      58bb45c2d55b4602852c0921f9aa39f3a09645689beea49b7408ce44da75eb9f9701effc765f3808e8d79eaefa9fc49531719e3d334d1d21e54ca35f78cac25d

    • memory/880-72-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-84-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-1156-0x0000000073ED0000-0x00000000745BE000-memory.dmp

      Filesize

      6.9MB

    • memory/880-51-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

    • memory/880-53-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

    • memory/880-54-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

    • memory/880-55-0x0000000073EDE000-0x0000000073EDF000-memory.dmp

      Filesize

      4KB

    • memory/880-56-0x0000000000380000-0x00000000003DE000-memory.dmp

      Filesize

      376KB

    • memory/880-57-0x0000000073ED0000-0x00000000745BE000-memory.dmp

      Filesize

      6.9MB

    • memory/880-59-0x0000000073ED0000-0x00000000745BE000-memory.dmp

      Filesize

      6.9MB

    • memory/880-58-0x0000000073ED0000-0x00000000745BE000-memory.dmp

      Filesize

      6.9MB

    • memory/880-60-0x00000000005D0000-0x000000000062C000-memory.dmp

      Filesize

      368KB

    • memory/880-61-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-62-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-102-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-64-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-116-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-66-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-68-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-70-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-1155-0x0000000073ED0000-0x00000000745BE000-memory.dmp

      Filesize

      6.9MB

    • memory/880-74-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-76-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-78-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-80-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-1154-0x0000000073ED0000-0x00000000745BE000-memory.dmp

      Filesize

      6.9MB

    • memory/880-90-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-120-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-118-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-114-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-112-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-110-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-108-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-106-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-104-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-100-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-98-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-96-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-94-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-92-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-88-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-86-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-82-0x00000000005D0000-0x0000000000627000-memory.dmp

      Filesize

      348KB

    • memory/880-1151-0x0000000073ED0000-0x00000000745BE000-memory.dmp

      Filesize

      6.9MB

    • memory/880-1152-0x0000000000400000-0x0000000000441000-memory.dmp

      Filesize

      260KB

    • memory/880-1153-0x0000000073EDE000-0x0000000073EDF000-memory.dmp

      Filesize

      4KB

    • memory/2036-12-0x00000000005F0000-0x00000000009F0000-memory.dmp

      Filesize

      4.0MB

    • memory/2196-33-0x0000000000910000-0x0000000000D10000-memory.dmp

      Filesize

      4.0MB

    • memory/2668-50-0x00000000008B0000-0x0000000000CB0000-memory.dmp

      Filesize

      4.0MB