Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
10-02-2025 11:48
General
-
Target
SecuriteInfo.com.FileRepMalware.23885.29286.exe
-
Size
1019KB
-
MD5
48b03eaf0daf01e7e607c9ef2d4605e6
-
SHA1
197c883e8f662c4f432f9b433cab6fbae45cb7cc
-
SHA256
dde1528c732c07d5f7153dc871342bd4657836a7ccfe185e15af90c87dbf95a7
-
SHA512
db4900abfad46fae0518ac34d38a16eb74033d4262a0f46da05106ab46811a9a9b23078cc32278b3dad4d521dc68d6e29b0ad8a577968f47b6fc1393c39caf0f
-
SSDEEP
24576:NtLj+hI8nM8/LitBKEvjqVdYpD0rDpCKOIRNFlBsaKo:NtLihpnV/LSqVdI0rNbNF7sxo
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
mail.muriana.com - Port:
587 - Username:
[email protected] - Password:
Provisional123*** - Email To:
[email protected]
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.23885.29286.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.23885.29286.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.23885.29286.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.23885.29286.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14B
MD54916cd6b7dda05c7a23b1d31d796ed7b
SHA1a999776c87fb3bc6fc6390469c79ec302ee2410f
SHA256fbd1ae27c78de7d1be52844bfb664657c23dc7a39dc32126f422e26ef472b954
SHA512db2e17ed849245ab83db878e80b743fd1967f8609793be2736e300d683f9484e61c83fdab089fdf39aca4d196513d7afe65ec7d37964a162852a3f372e39d051
-
Filesize
52B
MD55d04a35d3950677049c7a0cf17e37125
SHA1cafdd49a953864f83d387774b39b2657a253470f
SHA256a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
SHA512c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
-
Filesize
1B
MD58ce4b16b22b58894aa86c421e8759df3
SHA113fbd79c3d390e5d6585a21e11ff5ec1970cff0c
SHA2568254c329a92850f6d539dd376f4816ee2764517da5e0235514af433164480d7a
SHA5122af8a9104b3f64ed640d8c7e298d2d480f03a3610cbc2b33474321ec59024a48592ea8545e41e09d5d1108759df48ede0054f225df39d4f0f312450e0aa9dd25
-
Filesize
5B
MD5e2fecc970546c3418917879fe354826c
SHA163f1c1dd01b87704a6b6c99fd9f141e0a3064f16
SHA256ff91566d755f5d038ae698a2cc0a7d4d14e5273afafc37b6f03afda163768fa0
SHA5123c4a68cbaee94f986515f43305a0e7620c14c30213d4a17db4a3e8a1b996764eb688bf733f472fc52073c2c80bb5229bb29411d7601aefe1c4370e230c341a0a
-
Filesize
8B
MD5c3cb69218b85c3260387fb582cb518dd
SHA1961c892ded09a4cbb5392097bb845ccba65902ad
SHA2561c329924865741e0222d3ead23072cfbed14f96e2b0432573068eb0640513101
SHA5122402fffeb89c531db742bf6f5466eee8fe13edf97b8ecfc2cace3522806b322924d1ca81dda25e59b4047b8f40ad11ae9216e0a0d5c7fc6beef4368eb9551422
-
Filesize
16B
MD51a069d3d8cca839a3c2f44a0e833d67c
SHA12bdc93e3d3aac0914cd4d3d43210bc2b2c7f09cf
SHA2560c09cbcf0803dc2c44739757d37fe7f33fa193d747df71db3172e68aa0ddb309
SHA512970ed67a84e4132b0336cd8f7c07c4ab6dc56ce97993b64e4e94a80e76ee7bd4ca04349cd0113df5e04053fbfde9d27c3cb5ab61a9492d584b7febfcaddf53e2
-
Filesize
25B
MD50064e905a25d25e9da3e091fec6128b4
SHA10916142d8dbc95b1603767e67e28d3abcca8f89f
SHA256dbb07eb4882c53ce57bb0aa8a0707ee7e4be2a12fee11e1d17e843ec4edeba9f
SHA512b94e4dfea2f088a2838174b1650ca9d3fe4e4cb75bb67e3770fbcfb277e09daaa05bbc2686744852e56db010a81a1f48da0da3b5be05470a297a58142c8bbc49
-
Filesize
56B
MD5d4de0eab933eaea20fcc7a0fbc8f259a
SHA1776f886cf63358662064f49513924aa1f8d32596
SHA25658a06909bc19369daa6be9cfb1ceeb7d39547f7dde6d51fa53295c9cb59d13e0
SHA512f33f19ae60203255638b5699737737ca342d48b62da9b462b086e284773bf9cb4ba475b8a625edc0d519761f15866a424caccedd6632e2fbc08a1855b8d1a7f9
-
Filesize
73B
MD5b80ef50d0f02b0e60035ddab237b744e
SHA1addac470421ca09efee0c0718d805e1312246086
SHA256d26183d8122f1a8b4a98c5716a0520bdf9b28b95fa3baac4af25c49d39bd1da9
SHA512ccf91989bb62dfd85144b5b85528921f2a134515797fbe6be348852bca34e6e7bc27a7d6a17e7ba28b62a8c644581a092a892957c84853cbb29eea8cb6792820
-
Filesize
20B
MD59111ba1d1ceb4b7f775d74730aac363e
SHA1c0af4968c775735be12419b60b257ed4359cb9b2
SHA2560883f5bab7d5dafd9efec59b917070f5d051f50b047951d1ea87dab27fef7b91
SHA512836c5d3941109691f2589e317e10d661978d9fc4af435bde3467159913ff9192d6eab1efe3e50e2048d06ce0c85963efe1ac056e1fd6ff1d33ac05f25beabbbf
-
Filesize
37B
MD5c641bfa28a71f86301ed9e81931da24c
SHA159770ef0e9c2658e6aacd708615767660a2dec66
SHA256df9ef051e1940f576446c4ef6d4ee0f201488c4c0485c26ef2bd3923b3e6a761
SHA512e2e24f388600ca77ea717c8ebf382ff961cf20ae054d807526dddf28e5a328cbacfb57a6d00ad43afca0a4bc00ebb3f42a169de1fa5787265f468fe9056d093e
-
Filesize
9B
MD5bc86ffa91686a2ee2ac3cc3d50c4389e
SHA16d81aa156225f8df56a7711519ac3ff87abec24f
SHA2569e56c757510a69c7ee47407dbda53e8d8b983755854362df4dbcad941696dceb
SHA5125c54242e478199a95f615af1ac74fda63f4a1a1e22ef5799dc552ed432320adb20df54f9083cee1ee7c2d8ef2792f0f12e579229b7c64ffb74952e3044f4b7ff
-
Filesize
4B
MD5cde63b34c142af0a38cbe83791c964f8
SHA1ece2b194b486118b40ad12c1f0e9425dd0672424
SHA25665e2d70166c9a802b7ad2a87129b8945f083e5f268878790a9d1f1c03f47938d
SHA5120559d3d34ad64ccc27e685431c24fc6ead0f645db14fa0e125a64fb67dbd158c15432c1fc5407811aac8a3486090dfbcfcbc3c6bf5aa0ec73f979ef62d14853c
-
Filesize
19B
MD5adfb82dfa0a66bd7e108a83873cbd4cf
SHA1caaf90327bb1e7b6731e154351f351bf3a3bb1c4
SHA2562ba412a038068300e9e4a538ed1d2cfcefa9a1b91f44408785d90a5d838a9228
SHA512103f484f3497eaf8cc231f09a5c565ba524d5af523970272d9a853ede106fc176f524bb6aeb8f7f59992e7a5651abb55b80134d539bb050aaf780624422d982b
-
Filesize
33B
MD5340ad700cf73b73ea2313c044d40ea9a
SHA19b90cc3147d140fa936e308c2c320bdc385da93a
SHA25655a2b8f5ef1d17023fd8245e69830cc961c0ce629eddc7ac1043c288cb3915b5
SHA5124b31d10b80ae71197ac367c868569949224a4cd542bf0e9c188b816348ec8958f952525f939c827bddc8610f268dd12e310d6d2fc99071c741b3a38e062542b4
-
Filesize
11KB
MD57399323923e3946fe9140132ac388132
SHA1728257d06c452449b1241769b459f091aabcffc5
SHA2565a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
SHA512d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
-
Filesize
1.7MB
-
Filesize
41.1MB
-
Filesize
1.0MB
-
Filesize
41.1MB
-
Filesize
1.7MB
-
Filesize
41.1MB
-
Filesize
16.4MB
-
Filesize
16.4MB
-
Filesize
41.1MB
-
Filesize
288KB