Analysis
-
max time kernel
144s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
-
submitted
14/04/2025, 08:07
General
-
Target
Factura Honorarios 2025-04-13.exe
-
Size
679KB
-
MD5
f9d5459e950a2b3f401b9b4b4e5c8501
-
SHA1
931d7959fa3ed26a0a196d6229d04a9250932feb
-
SHA256
77b87775f59ad5a2564185b6565a5035d14298c3853ac8a70adbb8f10ff3bc8c
-
SHA512
0cfd3a7e7a041f9fe814804e2c78ee6c19d8abb63ce5523bd3e66f83970c30ad7924d0087a9e579933f38f3429f657aa4271f0ab25b6ac17bb5eaab50894e297
-
SSDEEP
12288:x+qbdKtjXR/tkhMizqpKPj2xOvp2Y0dWDop0b8i8nqBYmCeuU96ofXt1A7:x+qbdyRlkhdes2xgp2Y0ysYBYmCeyc1+
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7670096613:AAEY0JFb0a1CzByXhvZqUC9W4CQmo9fAmZM/sendMessage?chat_id=7911627152
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura Honorarios 2025-04-13.exe"C:\Users\Admin\AppData\Local\Temp\Factura Honorarios 2025-04-13.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Factura Honorarios 2025-04-13.exe"C:\Users\Admin\AppData\Local\Temp\Factura Honorarios 2025-04-13.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD5e2fecc970546c3418917879fe354826c
SHA163f1c1dd01b87704a6b6c99fd9f141e0a3064f16
SHA256ff91566d755f5d038ae698a2cc0a7d4d14e5273afafc37b6f03afda163768fa0
SHA5123c4a68cbaee94f986515f43305a0e7620c14c30213d4a17db4a3e8a1b996764eb688bf733f472fc52073c2c80bb5229bb29411d7601aefe1c4370e230c341a0a
-
Filesize
13B
MD57a02f5fcc4fa926f656690c64b909ab6
SHA1b92430a7da87fac12ae7ba0aea3cc4373a91b2ce
SHA2564c9cf56a764d54f52d17f4d6a99962dee20b5fe54888357ea9532bb8c54869c9
SHA5121f95dbfdda145dd50b2c9013fb165cb84eb87879442c30b92106923aaffd755358efb602640f461d81a300a06a905ba38a14eb10fa854105c577c0ce0239e70f
-
Filesize
47B
MD5a44e5b9b8830beb622f716549767927d
SHA178160ea5ffaa4c2e170780a8c18fd36a47724cf7
SHA256f90559b15f9f45cefd05f0e7b0ec4b7b254a22a2f2cc65eabd6a40ed0c889137
SHA512ce3a50dc422773b2543260285c7e62617c104c797e4bb4cb16a3d1fc80d18fb6285120e71ba28522061e04c7b89954f5154a490d323ba695493d48a6fd0e43af
-
Filesize
52B
MD55d04a35d3950677049c7a0cf17e37125
SHA1cafdd49a953864f83d387774b39b2657a253470f
SHA256a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
SHA512c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
-
Filesize
25B
MD50064e905a25d25e9da3e091fec6128b4
SHA10916142d8dbc95b1603767e67e28d3abcca8f89f
SHA256dbb07eb4882c53ce57bb0aa8a0707ee7e4be2a12fee11e1d17e843ec4edeba9f
SHA512b94e4dfea2f088a2838174b1650ca9d3fe4e4cb75bb67e3770fbcfb277e09daaa05bbc2686744852e56db010a81a1f48da0da3b5be05470a297a58142c8bbc49
-
Filesize
35B
MD51fb1355e0c0db83ebe4d28d604ad3ec1
SHA1ccb6a77e6191c13b9704622890fcefa0c7d8414d
SHA2569ec17471e47b0f87fcf688ddb61d0e97c62346761ca528b6ee84e5ca698bce54
SHA512ae4e5e0eba6f5f3d57edfc2a1e8433c1cc7406972d5fd9fbdbbd0521a40971690a7d968287623be0a9c2328f62d25d8a5b7d47286b9779abb74ec7423ec4e44b
-
Filesize
56B
MD546afbdbeaa75354cac7bb848076da26b
SHA14c737d3a1b4d52123877e1eff5c10204ea3e958e
SHA2569dd741c9e0dbac1414a9c6ff7fb56344118eccd00b982882dd3f7db27c5c5a4d
SHA51256ee260b4338da6ab0ff461cf053fc1a9473eb2a9b75ae7bc91e7fb4c796d74a8a7f6ee3d463b7b2d8b758a195282b6f6a134ccb98f9144a465eca811cee6f6b
-
Filesize
30B
MD5f15bfdebb2df02d02c8491bde1b4e9bd
SHA193bd46f57c3316c27cad2605ddf81d6c0bde9301
SHA256c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043
SHA5121757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1
-
Filesize
12KB
MD59b38a1b07a0ebc5c7e59e63346ecc2db
SHA197332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA2568b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
SHA51226e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
-
Filesize
24B
MD5c7b1e0162df5441fbc3308af5a364ba2
SHA1f86b61c5ee11de018cd6e0683fea7b6384c11e9c
SHA256c04969dc8e4f8f577e3313979fc89804ac3dc5f2108bb0ec712535ca27fd2ea5
SHA5120422467fdb5258a307f8ab426fad92f580f1edfd97e97bdfc61fb40cbf17e9d262a5df6edd2296ff4cd72ab947cf166839688a1fd1aa0d389f919d4f05900904
-
Filesize
60B
MD596cb2bcf9f67b71516753305f6a047af
SHA14287c4403d3f62935c02d3d748212a3a54e03b12
SHA256be8a1df4efd21b4cabb5b1ef06fff3d42def2d0b0975b0e5bf280c2f25392544
SHA512da4cd6010ccda5fc592ca5e14a4b62577b9551f28ad409b931d5df31c63892ca9bae98f57fd856031f636fe39f78b92310c12cc5606609fd065e90a12db10acf
-
Filesize
74B
MD516d513397f3c1f8334e8f3e4fc49828f
SHA14ee15afca81ca6a13af4e38240099b730d6931f0
SHA256d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
SHA5124a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
-
Filesize
29B
MD57bcf80ed4b7586485d227a08e4b7686b
SHA175f83d3b2fd6fc16fe54abf43839bc0512ca0046
SHA2563f1b5b4bbb2d866c8c62ef732346f0dd6843cbdb2aed403f041509d0657c8b77
SHA5121bc1e78b73c49ffb095dbcced9b53a1403b253a22517441ab9db1aa720ffab2a2d36222c83c1773934157324201e769fa3b109fa620c3992a6488e9a79486bb2
-
Filesize
23B
MD515869c1caed4a9a2871344cb7dbc4d71
SHA123a9038b70128e16c49f56d0adc433f5b69fd227
SHA2562696fe3f766a4a7724a3ed600da211862279c9c888592de75efbeffd06a6195c
SHA5127ba62e6095dca0015eac6e034ed9afcc38a04665a08813c7567acad1f3c2058e6db3023d3ebc1433938d9d7f139e143d856acbc7f98b51d19f1f10054f596455
-
Filesize
45B
MD55bc80a3e025e6d7c0ff9536d7af1c8b1
SHA1c7dca5ef716161e30829bcfe28b59ec430fdbec0
SHA2568d563467c54bb057b01f2366722a14e9416510bf4955afa746cbeb2f221312fc
SHA512cca0649c6cc7a92de2c46bf64084bce5e0ce44ef5acbdcb7527231d5372d74b0a1b3d0856ecfa0d32a5a0fbf5219df8117b14bec29d513fb55da0d1f25a6ad8b
-
Filesize
82.1MB
-
Filesize
82.1MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
296KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
5.2MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB