Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20250211-en -
resource tags
arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system -
submitted
11/02/2025, 16:58
Static task
static1
Behavioral task
behavioral1
Sample
Dryppets.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Dryppets.exe
Resource
win10v2004-20250211-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250207-en
General
-
Target
Dryppets.exe
-
Size
1.1MB
-
MD5
411efb6f23470867166f3990dbec6dad
-
SHA1
e9bb0868d4507c7b55dd048ee9662884cf7657b6
-
SHA256
68570e404a256774e77174fefe7dbec3fe0d49f38bb912ab9263ee579d259082
-
SHA512
7be032a3c1e0c85e57ae30d5ee856fb428dd6ed52f74ec21b1dc311068e09747ca8de02209f2393f1e73f4ec0bf700beb179f8424ec5b9853b9e37eab88f6fc3
-
SSDEEP
24576:iV8oSs6OQjptmgUy/QEw6wbfqiPACOedfHYNXNHA6w:iV8Nsm3XQEw3/ACOdHAj
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot8172976107:AAH5CXqEBGFF-CK18VpImdWAW7U_9296FqY/sendMessage?chat_id=6885960134
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL 2 IoCs
pid Process 3188 Dryppets.exe 3188 Dryppets.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Dryppets.exe Key opened \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Dryppets.exe Key opened \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Dryppets.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 7 drive.google.com 8 drive.google.com -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 checkip.dyndns.org 23 reallyfreegeoip.org 24 reallyfreegeoip.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4952 Dryppets.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3188 Dryppets.exe 4952 Dryppets.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Peppercorns241\septobasidium.ini Dryppets.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dryppets.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Dryppets.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4952 Dryppets.exe 4952 Dryppets.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3188 Dryppets.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4952 Dryppets.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3188 wrote to memory of 4952 3188 Dryppets.exe 88 PID 3188 wrote to memory of 4952 3188 Dryppets.exe 88 PID 3188 wrote to memory of 4952 3188 Dryppets.exe 88 PID 3188 wrote to memory of 4952 3188 Dryppets.exe 88 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Dryppets.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2508704002-2325818048-3575902788-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Dryppets.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dryppets.exe"C:\Users\Admin\AppData\Local\Temp\Dryppets.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\Dryppets.exe"C:\Users\Admin\AppData\Local\Temp\Dryppets.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4952
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD534442e1e0c2870341df55e1b7b3cccdc
SHA199b2fa21aead4b6ccd8ff2f6d3d3453a51d9c70c
SHA256269d232712c86983336badb40b9e55e80052d8389ed095ebf9214964d43b6bb1
SHA5124a8c57fb12997438b488b862f3fc9dc0f236e07bb47b2bce6053dcb03ac7ad171842f02ac749f02dda4719c681d186330524cd2953d33cb50854844e74b33d51