Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/01/2025, 06:32

General

  • Target

    a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f.exe

  • Size

    1.1MB

  • MD5

    909a37e97faff915cd4906fe7684ec63

  • SHA1

    5ae37a8ae70e36e9cf4f9e8895045f77eca11c51

  • SHA256

    a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f

  • SHA512

    58bb45c2d55b4602852c0921f9aa39f3a09645689beea49b7408ce44da75eb9f9701effc765f3808e8d79eaefa9fc49531719e3d334d1d21e54ca35f78cac25d

  • SSDEEP

    24576:bAHnh+eWsN3skA4RV1Hom2KXFmIaQtS2rEDjuKsV5U5j5:2h+ZkldoPK1XaQtvEDqTV5UL

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot8043603189:AAFpR2ormgQgQpP5aDirNgZd72aHXUsGdlI/sendMessage?chat_id=2135869667

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

  • Vipkeylogger family
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f.exe
    "C:\Users\Admin\AppData\Local\Temp\a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:840
    • C:\Users\Admin\AppData\Local\parachronism\savagenesses.exe
      "C:\Users\Admin\AppData\Local\Temp\a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3968
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Users\Admin\AppData\Local\Temp\a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\autB3B1.tmp

    Filesize

    242KB

    MD5

    efa36559459d8a95d5d29596030bb9cb

    SHA1

    dd4292faa0dc9430ab8a56ebaa29e3de2169e20d

    SHA256

    cf2cd6d65a7e9be25f5fcdbbb17d69142fe1af0295a9b43328db77e91a94067c

    SHA512

    cef22a7688400302f337d27f27697da7c7f4bbac78b7c7c0b302b69fe9113399b12a8f0fb94639209442c530a5e24fba5c939af4f5ac1e0c7c0a91a355c47ec0

  • C:\Users\Admin\AppData\Local\Temp\scroll

    Filesize

    58KB

    MD5

    2533f891e58ed20a758e7d7694e14cce

    SHA1

    89058b25ad725522939f4d1a66cd53d706ae124b

    SHA256

    bd1f6f108b7d53e1274736692946d1fa28e51cafa3320912edced0258ec90f6c

    SHA512

    f35ced1276857655c358f6e7f5600cd2f9c89c20d9ac6ab3b0c4bed45c816c730ecee0f0012268c846faf7236e3e245327c7f2405cff69f8660a812a2b940747

  • C:\Users\Admin\AppData\Local\parachronism\savagenesses.exe

    Filesize

    1.1MB

    MD5

    909a37e97faff915cd4906fe7684ec63

    SHA1

    5ae37a8ae70e36e9cf4f9e8895045f77eca11c51

    SHA256

    a15eb8020f01e743035823a05c7417a4ef31eaf02dee24af25cd03326561c17f

    SHA512

    58bb45c2d55b4602852c0921f9aa39f3a09645689beea49b7408ce44da75eb9f9701effc765f3808e8d79eaefa9fc49531719e3d334d1d21e54ca35f78cac25d

  • memory/840-13-0x00000000011D0000-0x00000000015D0000-memory.dmp

    Filesize

    4.0MB

  • memory/3968-33-0x00000000011E0000-0x00000000015E0000-memory.dmp

    Filesize

    4.0MB

  • memory/4548-35-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/4548-36-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/4548-37-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/4548-38-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/4548-39-0x0000000074D7E000-0x0000000074D7F000-memory.dmp

    Filesize

    4KB

  • memory/4548-40-0x0000000005470000-0x00000000054CE000-memory.dmp

    Filesize

    376KB

  • memory/4548-41-0x0000000074D70000-0x0000000075520000-memory.dmp

    Filesize

    7.7MB

  • memory/4548-43-0x0000000005510000-0x000000000556C000-memory.dmp

    Filesize

    368KB

  • memory/4548-42-0x0000000005B30000-0x00000000060D4000-memory.dmp

    Filesize

    5.6MB

  • memory/4548-44-0x0000000074D70000-0x0000000075520000-memory.dmp

    Filesize

    7.7MB

  • memory/4548-102-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-104-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-100-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-287-0x0000000074D70000-0x0000000075520000-memory.dmp

    Filesize

    7.7MB

  • memory/4548-98-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-96-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-94-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-92-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-90-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-88-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-86-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-84-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-82-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-80-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-78-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-76-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-74-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-70-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-69-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-66-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-64-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-62-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-60-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-58-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-56-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-54-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-52-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-50-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-48-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-46-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-72-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-45-0x0000000005510000-0x0000000005567000-memory.dmp

    Filesize

    348KB

  • memory/4548-1136-0x0000000005650000-0x00000000056EC000-memory.dmp

    Filesize

    624KB

  • memory/4548-1137-0x0000000074D70000-0x0000000075520000-memory.dmp

    Filesize

    7.7MB

  • memory/4548-1138-0x0000000006580000-0x0000000006612000-memory.dmp

    Filesize

    584KB

  • memory/4548-1140-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/4548-1141-0x0000000074D70000-0x0000000075520000-memory.dmp

    Filesize

    7.7MB