Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
10-02-2025 11:44
General
-
Target
SecuriteInfo.com.FileRepMalware.23885.29286.exe
-
Size
1019KB
-
MD5
48b03eaf0daf01e7e607c9ef2d4605e6
-
SHA1
197c883e8f662c4f432f9b433cab6fbae45cb7cc
-
SHA256
dde1528c732c07d5f7153dc871342bd4657836a7ccfe185e15af90c87dbf95a7
-
SHA512
db4900abfad46fae0518ac34d38a16eb74033d4262a0f46da05106ab46811a9a9b23078cc32278b3dad4d521dc68d6e29b0ad8a577968f47b6fc1393c39caf0f
-
SSDEEP
24576:NtLj+hI8nM8/LitBKEvjqVdYpD0rDpCKOIRNFlBsaKo:NtLihpnV/LSqVdI0rNbNF7sxo
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.muriana.com - Port:
587 - Username:
[email protected] - Password:
Provisional123*** - Email To:
[email protected]
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.23885.29286.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.23885.29286.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.23885.29286.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.23885.29286.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
30B
MD5f15bfdebb2df02d02c8491bde1b4e9bd
SHA193bd46f57c3316c27cad2605ddf81d6c0bde9301
SHA256c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043
SHA5121757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1
-
Filesize
66B
MD53a055708070979e7bf5088d9471320ba
SHA1cb4e803ae05765ee43787cbd3abb91166bbf8fd7
SHA256cc1c32ae1abcb46fd4871832a8b7a51a440905d97709c53e66d16a0cd33276ee
SHA5123f3b5c9c1fdca9e76fda76ff601d11320b4866ee0b0358b014699e33be79252cb94390fb589fa5099b68d00491a207f3fe6223b955a5a4be6f1df1b389fd613e
-
Filesize
74B
MD516d513397f3c1f8334e8f3e4fc49828f
SHA14ee15afca81ca6a13af4e38240099b730d6931f0
SHA256d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
SHA5124a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
-
Filesize
56B
MD5d4de0eab933eaea20fcc7a0fbc8f259a
SHA1776f886cf63358662064f49513924aa1f8d32596
SHA25658a06909bc19369daa6be9cfb1ceeb7d39547f7dde6d51fa53295c9cb59d13e0
SHA512f33f19ae60203255638b5699737737ca342d48b62da9b462b086e284773bf9cb4ba475b8a625edc0d519761f15866a424caccedd6632e2fbc08a1855b8d1a7f9
-
Filesize
60B
MD59329796376ced0ea599f21e2a7daefbf
SHA1562de8a0825baf273adbf239338bafeb21109120
SHA256f516f4188b5490fb2f3c57f4dd5d6c90a65bed6ac7aac7f701bfc553c06f872d
SHA512d1116c7db0363ea7969366aecdb9c4d4b5ccacb6314775d9fc8baf8eb1de9d4fed3630db9952e6bafe796dec035a68ea92471b6fe3dd6680240ec11750a0682f
-
Filesize
11KB
MD57399323923e3946fe9140132ac388132
SHA1728257d06c452449b1241769b459f091aabcffc5
SHA2565a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
SHA512d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
-
Filesize
52B
MD55d04a35d3950677049c7a0cf17e37125
SHA1cafdd49a953864f83d387774b39b2657a253470f
SHA256a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
SHA512c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
-
Filesize
33B
MD5340ad700cf73b73ea2313c044d40ea9a
SHA19b90cc3147d140fa936e308c2c320bdc385da93a
SHA25655a2b8f5ef1d17023fd8245e69830cc961c0ce629eddc7ac1043c288cb3915b5
SHA5124b31d10b80ae71197ac367c868569949224a4cd542bf0e9c188b816348ec8958f952525f939c827bddc8610f268dd12e310d6d2fc99071c741b3a38e062542b4
-
Filesize
41.1MB
-
Filesize
1.1MB
-
Filesize
41.1MB
-
Filesize
4KB
-
Filesize
41.1MB
-
Filesize
41.1MB
-
Filesize
18.3MB
-
Filesize
41.1MB
-
Filesize
18.3MB
-
Filesize
41.1MB
-
Filesize
288KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
40KB