Analysis
- max time kernel
148s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
- submitted
10/03/2025, 12:03
General
- Target 8fa0116efbd18a4d7be8be0aae4bdabae5934e86d923f5db6bb8ef3a916b3101.exe
- Size 631KB
- Sample250310-n75dkstnw2
- SHA256 8fa0116efbd18a4d7be8be0aae4bdabae5934e86d923f5db6bb8ef3a916b3101
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.royalwaweltours.com
-
Port
587
-
Username
-
Password
COLL-ARA0324
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Loads dropped DLL 1 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Blocklisted process makes network request 8 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fa0116efbd18a4d7be8be0aae4bdabae5934e86d923f5db6bb8ef3a916b3101.exe"C:\Users\Admin\AppData\Local\Temp\8fa0116efbd18a4d7be8be0aae4bdabae5934e86d923f5db6bb8ef3a916b3101.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle minimized "$Genitivform=gc -Raw 'C:\Users\Admin\AppData\Roaming\Unbeing55\kroer\tingid\Phonetist.rep';$Suppleringsbelbet=$Genitivform.SubString(54163,3);.$Suppleringsbelbet($Genitivform)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_nazilza5.33r.ps1
nsExec.dll
Frigidaire.Smu
Phonetist.rep
memory/3724-56-0x0000000007390000-0x0000000007433000-memory.dmp
memory/3724-39-0x0000000007620000-0x0000000007BC4000-memory.dmp
memory/3724-21-0x0000000004F40000-0x0000000004F62000-memory.dmp
memory/3724-22-0x00000000057E0000-0x0000000005846000-memory.dmp
memory/3724-23-0x0000000005850000-0x00000000058B6000-memory.dmp
memory/3724-19-0x0000000005040000-0x0000000005668000-memory.dmp
memory/3724-33-0x00000000058C0000-0x0000000005C14000-memory.dmp
memory/3724-34-0x0000000005F10000-0x0000000005F2E000-memory.dmp
memory/3724-35-0x0000000005F50000-0x0000000005F9C000-memory.dmp
memory/3724-36-0x0000000006FD0000-0x0000000007066000-memory.dmp
memory/3724-38-0x0000000006480000-0x00000000064A2000-memory.dmp
memory/3724-37-0x0000000006410000-0x000000000642A000-memory.dmp
memory/3724-59-0x00000000075F0000-0x0000000007601000-memory.dmp
memory/3724-18-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3724-41-0x0000000008250000-0x00000000088CA000-memory.dmp
memory/3724-53-0x0000000007360000-0x000000000737E000-memory.dmp
memory/3724-43-0x0000000070740000-0x000000007078C000-memory.dmp
memory/3724-42-0x0000000007320000-0x0000000007352000-memory.dmp
memory/3724-54-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3724-55-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3724-17-0x0000000000DC0000-0x0000000000DF6000-memory.dmp
memory/3724-57-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3724-20-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3724-58-0x0000000007490000-0x000000000749A000-memory.dmp
memory/3724-68-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3724-61-0x0000000007C00000-0x0000000007C14000-memory.dmp
memory/3724-62-0x0000000007C40000-0x0000000007C5A000-memory.dmp
memory/3724-63-0x0000000007C30000-0x0000000007C38000-memory.dmp
memory/3724-64-0x0000000007C40000-0x0000000007C6A000-memory.dmp
memory/3724-65-0x0000000007C70000-0x0000000007C94000-memory.dmp
memory/3724-66-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3724-60-0x0000000007BF0000-0x0000000007BFE000-memory.dmp
memory/3724-16-0x00000000742BE000-0x00000000742BF000-memory.dmp
memory/3724-71-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3724-70-0x00000000742BE000-0x00000000742BF000-memory.dmp
memory/3724-72-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3724-73-0x00000000088D0000-0x000000000C41A000-memory.dmp
memory/3724-74-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3724-75-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3724-77-0x00000000742B0000-0x0000000074A60000-memory.dmp
memory/3792-90-0x0000000001250000-0x00000000024A4000-memory.dmp
memory/3792-91-0x0000000001250000-0x0000000001298000-memory.dmp
memory/3792-93-0x0000000024090000-0x000000002412C000-memory.dmp
memory/3792-94-0x0000000024B50000-0x0000000024D12000-memory.dmp
memory/3792-95-0x0000000024420000-0x0000000024470000-memory.dmp
memory/3792-97-0x0000000024D20000-0x0000000024DB2000-memory.dmp
memory/3792-98-0x0000000024500000-0x000000002450A000-memory.dmp