Analysis
-
max time kernel
293s -
max time network
213s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
14/04/2025, 08:00
General
-
Target
Factura Honorarios 2025-04-13.exe
-
Size
679KB
-
MD5
f9d5459e950a2b3f401b9b4b4e5c8501
-
SHA1
931d7959fa3ed26a0a196d6229d04a9250932feb
-
SHA256
77b87775f59ad5a2564185b6565a5035d14298c3853ac8a70adbb8f10ff3bc8c
-
SHA512
0cfd3a7e7a041f9fe814804e2c78ee6c19d8abb63ce5523bd3e66f83970c30ad7924d0087a9e579933f38f3429f657aa4271f0ab25b6ac17bb5eaab50894e297
-
SSDEEP
12288:x+qbdKtjXR/tkhMizqpKPj2xOvp2Y0dWDop0b8i8nqBYmCeuU96ofXt1A7:x+qbdyRlkhdes2xgp2Y0ysYBYmCeyc1+
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7670096613:AAEY0JFb0a1CzByXhvZqUC9W4CQmo9fAmZM/sendMessage?chat_id=7911627152
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura Honorarios 2025-04-13.exe"C:\Users\Admin\AppData\Local\Temp\Factura Honorarios 2025-04-13.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Factura Honorarios 2025-04-13.exe"C:\Users\Admin\AppData\Local\Temp\Factura Honorarios 2025-04-13.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68B
MD5acc8e2dc8ef177e828af296be96c6a4e
SHA17cc55fd8ac9beeedff4b42acbe7a99d0559f178c
SHA256860e81e337b378b1d03c4f9205ef876d901e44758d7068a43f7d80eaec9c59aa
SHA512ba120dda31785f9ff6d9c4ba55eee99c8c0fffa7cc84afac054387da49dd5085e454996a4acd9018cfb4eea887e7610b6265533b9be8bbb2c5063ed071bb9e33
-
Filesize
46B
MD546bc3b3f30f2703822d77228cf71c47f
SHA1880c185810ea2b075648c9d0aac41487c8383059
SHA2568bf4c616c9a55aafdc1a48ebdb11f8fbea6fb2465aa2f216e4efad6d540a1d99
SHA512b8dd0e24989ee9acf9eb6b86dfb7f87d1d11f96458981170b7557aa1e26bb995a9ff785c8a98a54327ab12a7868d9c404b221e5f09e401d431dbb0120042946d
-
Filesize
69B
MD53f9d86b820955195e9467112480c175c
SHA1c9b53af6ff79125000b5aee2afb33ce6575d4d31
SHA256ab4b36271e68b6e5b546158733c5450e775242021442a40bec4e42838eecca53
SHA512ed78bd4b7b9b953bf73b1156872864b68ba1b46b3c2e5d21c56766217ec8b70e6421796a9d31716a94d62d81cf7a2c9f83735ea7c229881d4845c70364b77a17
-
Filesize
74B
MD516d513397f3c1f8334e8f3e4fc49828f
SHA14ee15afca81ca6a13af4e38240099b730d6931f0
SHA256d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
SHA5124a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
-
Filesize
58B
MD50b29799f668498e44f469590f92136a6
SHA1477022e40d3b1f1f06f5e6c0404450af702db6eb
SHA2569b9b769252e232ac369f61922b79f5656a4f4d744e39114bd389d0a56469ce3f
SHA512d987b05f4085bc9d3640e496f002e068649a2859f0aa6c538de03ffac0f766dc0009a6f532809e579655ad5677a150834447670fb2774d1bdd33b70542ff3ef9
-
Filesize
52B
MD55d04a35d3950677049c7a0cf17e37125
SHA1cafdd49a953864f83d387774b39b2657a253470f
SHA256a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
SHA512c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
-
Filesize
60B
MD596cb2bcf9f67b71516753305f6a047af
SHA14287c4403d3f62935c02d3d748212a3a54e03b12
SHA256be8a1df4efd21b4cabb5b1ef06fff3d42def2d0b0975b0e5bf280c2f25392544
SHA512da4cd6010ccda5fc592ca5e14a4b62577b9551f28ad409b931d5df31c63892ca9bae98f57fd856031f636fe39f78b92310c12cc5606609fd065e90a12db10acf
-
Filesize
12KB
MD59b38a1b07a0ebc5c7e59e63346ecc2db
SHA197332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA2568b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
SHA51226e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
-
Filesize
56B
MD546afbdbeaa75354cac7bb848076da26b
SHA14c737d3a1b4d52123877e1eff5c10204ea3e958e
SHA2569dd741c9e0dbac1414a9c6ff7fb56344118eccd00b982882dd3f7db27c5c5a4d
SHA51256ee260b4338da6ab0ff461cf053fc1a9473eb2a9b75ae7bc91e7fb4c796d74a8a7f6ee3d463b7b2d8b758a195282b6f6a134ccb98f9144a465eca811cee6f6b
-
Filesize
30B
MD5f15bfdebb2df02d02c8491bde1b4e9bd
SHA193bd46f57c3316c27cad2605ddf81d6c0bde9301
SHA256c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043
SHA5121757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1
-
Filesize
4KB
-
Filesize
82.1MB
-
Filesize
40KB
-
Filesize
82.1MB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
296KB
-
Filesize
5.6MB
-
Filesize
5.2MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB