Overview

overview

10

Static

static

3

ae0888b96f...50.exe

windows7-x64

10

ae0888b96f...50.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    114s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    24/02/2025, 21:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ae0888b96fb69da0782da5de7858ce2f35aa21a0be372c6d9f5530f77492ae50.exe

  • Size

    760KB

  • MD5

    cf802366b52b0505911b91bd10833cb8

  • SHA1

    20948b33c1fa3ec84d412558ad08c2390e2ea4b7

  • SHA256

    ae0888b96fb69da0782da5de7858ce2f35aa21a0be372c6d9f5530f77492ae50

  • SHA512

    5ad23e9d3c54f6e8bd88ca3c5caa7ae78db318d79fd1eb889417779cd005df2911f076a4c567759aaa7bf74ce630a6ce2dd124d7941f8f8fa860916d1abd34a9

  • SSDEEP

    12288:fxgmsYPwgsmo23bPgGgUIr26awlYdPRGM821ZUuyybblBgMBVn0pX:pSYP3VoVvO6mPc+UuZbnBVn0V

Score
10/10
vipkeyloggercollectiondiscoveryexecutionkeyloggerspywarestealer

Malware Config

Extracted

Family

vipkeylogger

C2

https://api.telegram.org/bot7371892501:AAE6c_q-yLsVj82ZZEmMuRlQtTm95MBjCz0/sendMessage?chat_id=6750192797

Signatures

  • VIPKeylogger

    VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.

    stealerkeyloggervipkeylogger
  • Vipkeylogger family
    vipkeylogger
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae0888b96fb69da0782da5de7858ce2f35aa21a0be372c6d9f5530f77492ae50.exe
    "C:\Users\Admin\AppData\Local\Temp\ae0888b96fb69da0782da5de7858ce2f35aa21a0be372c6d9f5530f77492ae50.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:2816
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OCLBHcG.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2756
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OCLBHcG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA94A.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpA94A.tmp
    Filesize

    1KB

    MD5

    b1e2b1452bec278ab3a3a53d2f7ee596

    SHA1

    5dfd47a86927a6daf0f22fa5cb96fcc72a9bba3a

    SHA256

    bd336ee2149af5ba1d6077d039ef474c017234c1579e2fe57537fc28b14ad89e

    SHA512

    4de2b39046df6d1b8cc13f17b4669623b5ccfe8dae54a7ecb59adb78182694ea5892c63880de54d1baf7cfe2979c92b2b2d9d8b975e775ef64b090ec9ca2d14c

    Download Submit

  • memory/2816-0-0x0000000073C3E000-0x0000000073C3F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2816-1-0x0000000000380000-0x0000000000444000-memory.dmp

    Filesize

    784KB

    Download

  • memory/2816-2-0x0000000073C30000-0x000000007431E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2816-3-0x00000000004C0000-0x00000000004DE000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2816-4-0x0000000073C3E000-0x0000000073C3F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2816-5-0x0000000073C30000-0x000000007431E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2816-6-0x0000000001F20000-0x0000000001FAE000-memory.dmp

    Filesize

    568KB

    Download

  • memory/2816-12-0x0000000004860000-0x00000000048A8000-memory.dmp

    Filesize

    288KB

    Download