Analysis
-
max time kernel
299s -
max time network
212s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
-
submitted
14/04/2025, 08:04
General
-
Target
315176345_2025-04-13-5522441.exe
-
Size
645KB
-
MD5
619e2fa8cf181dcce7df16e5fee4065a
-
SHA1
7c72e48804fbd2bd8b4f28e69f916d910afd5cc7
-
SHA256
8e6c5f4651741758b6b141da89e4c27fa244eccce3d9beaf4b1ae0e48f13d5a0
-
SHA512
9840537924bf3858b21771945798f49b2e907b8efee4fe4e7ae5a0762c5ff451543b95d9750e31d0203ec485da45535c03d8cfbeba88ca70533ddb19ac4ad303
-
SSDEEP
12288:u+q6+b0201LM+OryHE3WrRMnSUO8nmCeud3f2KHTlt1A:u+qlA20WyGEyltnmCe8fJ31A
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7940557245:AAGEVNBuuGDhlbTi3PPq7irUInwmQ9JgMqQ/sendMessage?chat_id=7590946867
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\315176345_2025-04-13-5522441.exe"C:\Users\Admin\AppData\Local\Temp\315176345_2025-04-13-5522441.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\315176345_2025-04-13-5522441.exe"C:\Users\Admin\AppData\Local\Temp\315176345_2025-04-13-5522441.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD59b38a1b07a0ebc5c7e59e63346ecc2db
SHA197332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA2568b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
SHA51226e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
-
Filesize
56B
MD529a28ce2b1e65d140f33352d68603e6f
SHA16c018cc95d5c6145b253dc0ecf7788ba60a186e8
SHA256703e34699df3afe05877ed93aa2f8d37e2868411d55397a921fb45a0509816a2
SHA5124285dd432573efdabf9e11d787a75db6eea018c7c427237012e3e0b89a589c1f79c5fb2f437f5d8f5d4af404f8dd72f7d14cc6012b877550f3291f325a0fe1d3
-
Filesize
60B
MD56003c892b3f3e6857b44804bb171e32b
SHA1e5388e8d8163b149dcc9c496a3bf2a4a23a0ad77
SHA2566aca13da7c0fef80812c437ed6ebfc24e9ab6dc53f36b8f42c6b7071f84e3ca8
SHA512e935627de21df33244c6aed2fdd8e2d8750bdff40574c1063c02334e2059649b7338e1ff2732efb8b0b0110e53e0a67c25390ee8de314b601aa13e37095cf4c7
-
Filesize
10B
MD5fa5eb52a9735c883abcf72a7f9cf2254
SHA1a043e3d3df1605300a2f5629ad7a302082814956
SHA25640ccdff1a037de0fb10d03ea9fe79c2c96e7f18c3c7dffd92b42c2f0ed749116
SHA512983e3f605f34f74e95db170da28f2584a74bf4d0047ea76c905c409e624d9db2a439e70beb07d8f879fb25549da52bb9cac6304281e2582d6e5b1b4f12ac21f2
-
Filesize
30B
MD5f15bfdebb2df02d02c8491bde1b4e9bd
SHA193bd46f57c3316c27cad2605ddf81d6c0bde9301
SHA256c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043
SHA5121757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1
-
Filesize
74B
MD516d513397f3c1f8334e8f3e4fc49828f
SHA14ee15afca81ca6a13af4e38240099b730d6931f0
SHA256d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
SHA5124a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
-
Filesize
18B
MD51a42166fa1e8a360271d4fb25c78fbda
SHA1f4d1ad6ecdc1202a2c08c03514ec814072b818d2
SHA256b271abd85535886a3753ee0a5e8957a1bf2e502c4a275d1d8f7f5ddf3b7de292
SHA512ee3342a9a407bfe56e7c65c1f1c0b15624fbffc60c88ff9e404a1dbebcfd606f42de8cb61624f992f57fca2e05d75a64611a78e508c7772ffaeb9c5924c87c0c
-
Filesize
27B
MD5b93641813851b1ad166b8163e5aeddc9
SHA1642d989ceea62bcfd70fb74f3c62ade0c1c41d78
SHA2561628c6bee5afc85044309f45e34190bc9ce8bd9516e30792460e14362657d42d
SHA512eee31a0d51df3a7ba35ab4025f8d458c4d12b6f46412982ad34aef31d9e83c7070056a07777ed4b62fb3b92b376b618099374901ffe4f988fe0f853a0e57c8ec
-
Filesize
38B
MD5306942073b8a4457561e12735efb9411
SHA1b1cd498c9febaeb7c2aa4e57c30f118f50eaacb6
SHA2562f68a110d1297ef0a5752507719512451b5a9f00bf25e1392ad5ad3be968ea34
SHA51229b4c8dc5a083fde8e809ad3e87b76057116fa9820c15fbddb25913543d93d9475ce07137cd382d6ba9c71741f706bf5be4e13909e231b32164a189fdf95271c
-
Filesize
44B
MD5a11292439456c3877dd223273f88ce2f
SHA1cbde8e81b850762530c0d960a82eda5ca399e538
SHA256d02310dee3ced92a0be280296fb733c94858c06d62a6eb7fe22cdd38f3fe8ae5
SHA512e4cc180decc607ff549be52de094226d8f2080124fe2e3391a371ab5293294373d910a17f8578dce50ab5e8b20061913f6c378b7258f599a6d9d8ff968f61e7d
-
Filesize
57B
MD50b66f70a086797e3c9d810089c376755
SHA1aa9a99dcae2c50513922413999a555bc89af69b1
SHA25680eb66b392cf670bb4afede5a57488fc9e9166f9a8c492f290d150c834e1e6aa
SHA51283461cf2e760708cbdf9a083594c63f55e4b2d90166d5ba3b3f06e1e35e3b9be2c6d1a97da5b7ac04a444d4c6ab04da11adf8a0a1a268597c1e6f3022c8445f1
-
Filesize
24B
MD560f65c2cd21dde8cc4ce815633d832e0
SHA1c1196320458557d8c4f65ba6810953b1037a822b
SHA2567f0f042b1879b1b8f04a5e6051e577a1e691ec322789c4d98d52494cfd906ce7
SHA512301ead9a6620deccb0be51bbe4eb760ca9d48d029cded0c6cdc7115a4353f4d9330f2ca92df2519a78a7d5aa24975ca6fa19c0269cc411026739b3f733f8d8f2
-
Filesize
28B
MD5d5c1c43dcbca7900a2751441b73a1402
SHA12ad884601eb948b72f2e980a05e6c05bfc4f04d7
SHA256334995ac57ad095abcfa5ba0e9216285fc87f9026ea3ef2c67a42d1ed7ddf855
SHA5121627d2cd136c30ba55dd3a336c05f20f90432bb0340ee75d2782328e2edc45e1213f9a315f7b5b61ce5340412f88109d5d13c833116835c3251d1751fce8854c
-
Filesize
31B
MD5bebdffa37358b59c6d03d4e3947c6f6c
SHA1bb3d6a0095f4d6d2dac15bb64ffd4775952bf547
SHA2563e3573216f1f8de74e0c00566b297b31f2c5b0e1015114d370fb84cfcdbe97d3
SHA512651f98e9cf38c74647806c574f807c6a84d3b60c25aa701c00ad0cac409ff99fa490169ee033ba4ab1aa97dd8010c887d21d1dd1219bbfe5ae81ab39991efdbd
-
Filesize
39B
MD53e930ca30f900b15da4ef96902f9b347
SHA192c4cd5b76b9be895152fdb3adcd165192daa552
SHA256688f5bdbcde116a168af5f0ea57296f14181abe8fb92292eaf11febd498e3d42
SHA51240bcbeea8dcf22201d275e68be32deadc953a2383f11788947d10aabf4469d61d8e3b86ded7e7369a9d413974d90e628aa1a4a6e6bc2b60c2de20bbd896fd489
-
Filesize
44B
MD5a34dd33a1fabfd2c2a268ca5dafab94f
SHA14d321237095816d8ad7a3e8c16154286bcb161e9
SHA256dfc902cecc7c8eba5bd0d37e27541823ba74c67ac26cd263568f9b4880ab6f1b
SHA512e22f1a71835ce0fd8add953d182b1999f65db2c8c434beadc7e1db39dda17ddf669c8bd2ba266b17c0b6eac4cf44480b307b17fbc32b1521a505c49bab5af7fe
-
Filesize
52B
MD55d04a35d3950677049c7a0cf17e37125
SHA1cafdd49a953864f83d387774b39b2657a253470f
SHA256a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
SHA512c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
296KB
-
Filesize
5.6MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
4KB
-
Filesize
66.8MB
-
Filesize
66.8MB
-
Filesize
4KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
40KB