vipkeylogger | 62a3ec5ea4d5c9942a989113a3e144426bfa3fa61482ecb2e727f4a788b1043e

General

Target

bEXN0tpyU41jdD0.exe
Size

864KB
MD5

25b7cb7a62555ef3aaa7ecae00c8decd
SHA1

a2421f5e2ae3aa20b8d11fc3076cea2400c68299
SHA256

867af082ab5f5e7468aab5bca97063c60877f44c2d39c0ad02f1a1e721c92260
SHA512

c7c7eeed71df83807cf9d584ee913e4661ccd7d921139a381ce4c17479420683f5ece7aa37b618d4162f39bde11c3bb2bf44fe906e9794f7d3ae0faa6c119f1b
SSDEEP

24576:pg5n6cf13/iyC9LDY9uAKwOy39S741VxsUYI2f:pgB6KRCxDitSiYIU

Score

10^/10

vipkeylogger collection discovery execution keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol: smtp
Host:
mail.steadfastlogistics.in
Port:
587
Username:
[email protected]
Password:
slf@2023
Email To:
[email protected]

Signatures

VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger
Vipkeylogger family
vipkeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2440	powershell.exe
2932	powershell.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	reallyfreegeoip.org
4	checkip.dyndns.org
8	reallyfreegeoip.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 1412	1852	bEXN0tpyU41jdD0.exe	37

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bEXN0tpyU41jdD0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1852	bEXN0tpyU41jdD0.exe
2932	powershell.exe
2440	powershell.exe
1852	bEXN0tpyU41jdD0.exe
1412	vbc.exe
1412	vbc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1852	bEXN0tpyU41jdD0.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	1412	vbc.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2440	1852	bEXN0tpyU41jdD0.exe	31
PID 1852 wrote to memory of 2440	1852	bEXN0tpyU41jdD0.exe	31
PID 1852 wrote to memory of 2440	1852	bEXN0tpyU41jdD0.exe	31
PID 1852 wrote to memory of 2440	1852	bEXN0tpyU41jdD0.exe	31
PID 1852 wrote to memory of 2932	1852	bEXN0tpyU41jdD0.exe	33
PID 1852 wrote to memory of 2932	1852	bEXN0tpyU41jdD0.exe	33
PID 1852 wrote to memory of 2932	1852	bEXN0tpyU41jdD0.exe	33
PID 1852 wrote to memory of 2932	1852	bEXN0tpyU41jdD0.exe	33
PID 1852 wrote to memory of 2828	1852	bEXN0tpyU41jdD0.exe	35
PID 1852 wrote to memory of 2828	1852	bEXN0tpyU41jdD0.exe	35
PID 1852 wrote to memory of 2828	1852	bEXN0tpyU41jdD0.exe	35
PID 1852 wrote to memory of 2828	1852	bEXN0tpyU41jdD0.exe	35
PID 1852 wrote to memory of 1412	1852	bEXN0tpyU41jdD0.exe	37
PID 1852 wrote to memory of 1412	1852	bEXN0tpyU41jdD0.exe	37
PID 1852 wrote to memory of 1412	1852	bEXN0tpyU41jdD0.exe	37
PID 1852 wrote to memory of 1412	1852	bEXN0tpyU41jdD0.exe	37
PID 1852 wrote to memory of 1412	1852	bEXN0tpyU41jdD0.exe	37
PID 1852 wrote to memory of 1412	1852	bEXN0tpyU41jdD0.exe	37
PID 1852 wrote to memory of 1412	1852	bEXN0tpyU41jdD0.exe	37
PID 1852 wrote to memory of 1412	1852	bEXN0tpyU41jdD0.exe	37
PID 1852 wrote to memory of 1412	1852	bEXN0tpyU41jdD0.exe	37

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	vbc.exe

C:\Users\Admin\AppData\Local\Temp\bEXN0tpyU41jdD0.exe
"C:\Users\Admin\AppData\Local\Temp\bEXN0tpyU41jdD0.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\bEXN0tpyU41jdD0.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TwTVLCxys.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2932
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TwTVLCxys" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3A9.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

1

T1217

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Email Collection

1

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3A9.tmp

Filesize
1KB

MD5
a307ab3ce62b0d06fba0e932623b46f1

SHA1
3eea18fb200f47dd84a43c7949842dc698be9e0d

SHA256
703a65b55bb7eea2c1c56eaa8401b77ca3a55fd95f2ad4d2952ab39b5d601066

SHA512
d8f3f828c33cb300275c4bc3cb053af3e31827e6b9bff482443cf4cf919220d46e3fac3ea339591ec372e85a7b30bfc045da5fb5f9cb5acca14749231e942980

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
b4c350531b7a3ead3df6bf13e3fbd58e

SHA1
b332898282e643f762cc96139cf95d91e40dee40

SHA256
65317c13e234d3bffd8c25d42c5902db5b9b08631983d54691a101983e762dcc

SHA512
94777dc6df885324d7d0f5b0fd739fcd62fef1e103a5de7d3b30465b5549431c076c3256c1fb5fe3e369984801dc6daf5b2a0dc7b54c8437e2ef2a46c193005b

Download Submit
memory/1412-30-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1412-26-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1412-24-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1412-22-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1412-28-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1412-29-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1412-31-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1412-20-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1852-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Filesize
4KB

Download
memory/1852-2-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/1852-1-0x0000000000F30000-0x000000000100C000-memory.dmp

Filesize
880KB

Download
memory/1852-7-0x0000000005860000-0x00000000058EE000-memory.dmp

Filesize
568KB

Download
memory/1852-6-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download
memory/1852-3-0x0000000004CF0000-0x0000000004DAC000-memory.dmp

Filesize
752KB

Download
memory/1852-5-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

Filesize
4KB

Download
memory/1852-4-0x00000000006D0000-0x00000000006E8000-memory.dmp

Filesize
96KB

Download
memory/1852-32-0x0000000074A20000-0x000000007510E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads