Analysis
- max time kernel
143s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
19/02/2025, 19:10
General
- Target Skery.exe
- Size 673KB
- Sample250219-xvfdcsynw4
- SHA256 380487150b51a339c3d8c34526c0109d9b5a904aee3e41abc62c04a63ec18dfb
Malware Config
Extracted
-
vipkeylogger
-
https://api.telegram.org/bot7888169387:AAFhsoUaeWK9XqbrEJl452LFnH_AAaGbsWI/sendMessage?chat_id=6838630391
Signatures
- Guloader family
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Loads dropped DLL 2 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Skery.exe"C:\Users\Admin\AppData\Local\Temp\Skery.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Skery.exe"C:\Users\Admin\AppData\Local\Temp\Skery.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
System.dll
timelanges.lnk
memory/2992-307-0x0000000077281000-0x00000000773A1000-memory.dmp
memory/2992-308-0x0000000077281000-0x00000000773A1000-memory.dmp
memory/2992-309-0x0000000074725000-0x0000000074726000-memory.dmp
memory/4324-328-0x00000000016F0000-0x000000000554F000-memory.dmp
memory/4324-331-0x00000000383A0000-0x0000000038944000-memory.dmp
memory/4324-312-0x0000000077325000-0x0000000077326000-memory.dmp
memory/4324-316-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4324-317-0x0000000077281000-0x00000000773A1000-memory.dmp
memory/4324-327-0x0000000000490000-0x00000000016E4000-memory.dmp
memory/4324-329-0x000000007217E000-0x000000007217F000-memory.dmp
memory/4324-310-0x00000000016F0000-0x000000000554F000-memory.dmp
memory/4324-330-0x0000000000490000-0x00000000004DA000-memory.dmp
memory/4324-311-0x0000000077308000-0x0000000077309000-memory.dmp
memory/4324-332-0x0000000038950000-0x00000000389EC000-memory.dmp
memory/4324-333-0x0000000072170000-0x0000000072920000-memory.dmp
memory/4324-335-0x000000007217E000-0x000000007217F000-memory.dmp
memory/4324-336-0x0000000072170000-0x0000000072920000-memory.dmp
memory/4324-339-0x0000000038F00000-0x00000000390C2000-memory.dmp
memory/4324-340-0x0000000035BE0000-0x0000000035C30000-memory.dmp
memory/4324-341-0x00000000390D0000-0x00000000395FC000-memory.dmp
memory/4324-343-0x0000000039600000-0x0000000039692000-memory.dmp
memory/4324-344-0x00000000396A0000-0x00000000396AA000-memory.dmp