Analysis
- max time kernel
122s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20250314-en - resource tags
- submitted
20/03/2025, 08:43
General
- Target DO2IO4411BWDPDF.exe
- Size 620KB
- Sample250320-kmrefayvbz
- SHA256 1c3857b716fc65dbd1ffdc7e06b1d2b0420537ac4f113d7ece283b64fee8c976
Malware Config
Extracted
-
vipkeylogger
-
https://api.telegram.org/bot7210869128:AAGc04ZCMPLfzv0warXn0rHygWnOYwhUN-w/sendMessage?chat_id=5019476480
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Uses the VBS compiler for execution 1 TTPs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DO2IO4411BWDPDF.exe"C:\Users\Admin\AppData\Local\Temp\DO2IO4411BWDPDF.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\DO2IO4411BWDPDF.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ceNjsakBzwrLn.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ceNjsakBzwrLn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7494.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_r2hhzbnv.43c.ps1
tmp7494.tmp
memory/2752-6-0x0000000005C30000-0x0000000005C40000-memory.dmp
memory/2752-3-0x0000000005930000-0x00000000059C2000-memory.dmp
memory/2752-5-0x0000000074450000-0x0000000074C00000-memory.dmp
memory/2752-4-0x0000000005AF0000-0x0000000005AFA000-memory.dmp
memory/2752-50-0x0000000074450000-0x0000000074C00000-memory.dmp
memory/2752-7-0x000000007445E000-0x000000007445F000-memory.dmp
memory/2752-8-0x0000000074450000-0x0000000074C00000-memory.dmp
memory/2752-9-0x0000000006C30000-0x0000000006CAE000-memory.dmp
memory/2752-10-0x0000000006E90000-0x0000000006F2C000-memory.dmp
memory/2752-0-0x000000007445E000-0x000000007445F000-memory.dmp
memory/2752-2-0x0000000005E00000-0x00000000063A4000-memory.dmp
memory/2752-1-0x0000000000EA0000-0x0000000000F42000-memory.dmp
memory/4724-78-0x00000000079F0000-0x0000000007A0A000-memory.dmp
memory/4724-53-0x0000000006740000-0x000000000678C000-memory.dmp
memory/4724-22-0x0000000006050000-0x00000000060B6000-memory.dmp
memory/4724-20-0x0000000005700000-0x0000000005722000-memory.dmp
memory/4724-35-0x0000000074450000-0x0000000074C00000-memory.dmp
memory/4724-34-0x00000000060C0000-0x0000000006414000-memory.dmp
memory/4724-88-0x0000000074450000-0x0000000074C00000-memory.dmp
memory/4724-85-0x0000000007D10000-0x0000000007D18000-memory.dmp
memory/4724-84-0x0000000007D30000-0x0000000007D4A000-memory.dmp
memory/4724-18-0x0000000074450000-0x0000000074C00000-memory.dmp
memory/4724-83-0x0000000007C30000-0x0000000007C44000-memory.dmp
memory/4724-81-0x0000000007BF0000-0x0000000007C01000-memory.dmp
memory/4724-16-0x0000000074450000-0x0000000074C00000-memory.dmp
memory/4724-17-0x00000000057C0000-0x0000000005DE8000-memory.dmp
memory/4724-80-0x0000000007C70000-0x0000000007D06000-memory.dmp
memory/4724-52-0x00000000066B0000-0x00000000066CE000-memory.dmp
memory/4724-21-0x0000000005EE0000-0x0000000005F46000-memory.dmp
memory/4724-79-0x0000000007A60000-0x0000000007A6A000-memory.dmp
memory/4724-56-0x0000000070940000-0x000000007098C000-memory.dmp
memory/4724-15-0x0000000005150000-0x0000000005186000-memory.dmp
memory/4724-76-0x00000000078C0000-0x0000000007963000-memory.dmp
memory/4724-74-0x00000000078A0000-0x00000000078BE000-memory.dmp
memory/4872-82-0x0000000007D70000-0x0000000007D7E000-memory.dmp
memory/4872-89-0x0000000074450000-0x0000000074C00000-memory.dmp
memory/4872-77-0x0000000008180000-0x00000000087FA000-memory.dmp
memory/4872-19-0x0000000074450000-0x0000000074C00000-memory.dmp
memory/4872-23-0x0000000074450000-0x0000000074C00000-memory.dmp
memory/4872-36-0x0000000074450000-0x0000000074C00000-memory.dmp
memory/4872-55-0x0000000070940000-0x000000007098C000-memory.dmp
memory/4872-54-0x0000000007A00000-0x0000000007A32000-memory.dmp
memory/5032-90-0x0000000006B50000-0x0000000006D12000-memory.dmp
memory/5032-37-0x0000000000400000-0x0000000000437000-memory.dmp
memory/5032-49-0x0000000003080000-0x00000000030CE000-memory.dmp
memory/5032-38-0x0000000000400000-0x0000000000437000-memory.dmp
memory/5032-51-0x00000000055D0000-0x000000000561E000-memory.dmp
memory/5032-91-0x00000000069F0000-0x0000000006A40000-memory.dmp