Analysis
-
max time kernel
134s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2025, 02:25
Static task
static1
Behavioral task
behavioral1
Sample
K25004 Chin Bee Road Piling Layout.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
K25004 Chin Bee Road Piling Layout.exe
Resource
win10v2004-20250314-en
General
-
Target
K25004 Chin Bee Road Piling Layout.exe
-
Size
1.1MB
-
MD5
c1523e38552e62abe928da077238703b
-
SHA1
09f2fa809b337d4f189f192f44d5ac82d607fcab
-
SHA256
4b3fb4c8594eec8feffeb0955e3103e6211086450e5fa202b4188de5c9179960
-
SHA512
bb77daf580f45b8b46ad004fa4e495b31eee770e1615af0d9d0c86c1b641aece87ad2db95ca776536e03b1879341a9d3c2d8d179644f63ee463523f9cc6d6548
-
SSDEEP
24576:vu6J33O0c+JY5UZ+XC0kGso6FaLJER/9UOJsWY:Zu0c++OCvkGs9FaLJw9U2Y
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7341655920:AAEZHIUvwdNfcPot5ywEeoVPxGPDy0dAzVs/sendMessage?chat_id=7128988401
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe Key opened \REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe Key opened \REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 checkip.dyndns.org 26 reallyfreegeoip.org 27 reallyfreegeoip.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5512 set thread context of 5352 5512 K25004 Chin Bee Road Piling Layout.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language K25004 Chin Bee Road Piling Layout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5352 svchost.exe 5352 svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5512 K25004 Chin Bee Road Piling Layout.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5352 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5512 K25004 Chin Bee Road Piling Layout.exe 5512 K25004 Chin Bee Road Piling Layout.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 5512 K25004 Chin Bee Road Piling Layout.exe 5512 K25004 Chin Bee Road Piling Layout.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5512 wrote to memory of 5352 5512 K25004 Chin Bee Road Piling Layout.exe 89 PID 5512 wrote to memory of 5352 5512 K25004 Chin Bee Road Piling Layout.exe 89 PID 5512 wrote to memory of 5352 5512 K25004 Chin Bee Road Piling Layout.exe 89 PID 5512 wrote to memory of 5352 5512 K25004 Chin Bee Road Piling Layout.exe 89 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\K25004 Chin Bee Road Piling Layout.exe"C:\Users\Admin\AppData\Local\Temp\K25004 Chin Bee Road Piling Layout.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\K25004 Chin Bee Road Piling Layout.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:5352
-