Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
-
submitted
14/04/2025, 13:10
General
-
Target
Factura Honorarios 2025-04-13.exe
-
Size
679KB
-
MD5
f9d5459e950a2b3f401b9b4b4e5c8501
-
SHA1
931d7959fa3ed26a0a196d6229d04a9250932feb
-
SHA256
77b87775f59ad5a2564185b6565a5035d14298c3853ac8a70adbb8f10ff3bc8c
-
SHA512
0cfd3a7e7a041f9fe814804e2c78ee6c19d8abb63ce5523bd3e66f83970c30ad7924d0087a9e579933f38f3429f657aa4271f0ab25b6ac17bb5eaab50894e297
-
SSDEEP
12288:x+qbdKtjXR/tkhMizqpKPj2xOvp2Y0dWDop0b8i8nqBYmCeuU96ofXt1A7:x+qbdyRlkhdes2xgp2Y0ysYBYmCeyc1+
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7670096613:AAEY0JFb0a1CzByXhvZqUC9W4CQmo9fAmZM/sendMessage?chat_id=7911627152
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura Honorarios 2025-04-13.exe"C:\Users\Admin\AppData\Local\Temp\Factura Honorarios 2025-04-13.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Factura Honorarios 2025-04-13.exe"C:\Users\Admin\AppData\Local\Temp\Factura Honorarios 2025-04-13.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD59b38a1b07a0ebc5c7e59e63346ecc2db
SHA197332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA2568b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
SHA51226e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
-
Filesize
30B
MD5f15bfdebb2df02d02c8491bde1b4e9bd
SHA193bd46f57c3316c27cad2605ddf81d6c0bde9301
SHA256c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043
SHA5121757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1
-
Filesize
60B
MD596cb2bcf9f67b71516753305f6a047af
SHA14287c4403d3f62935c02d3d748212a3a54e03b12
SHA256be8a1df4efd21b4cabb5b1ef06fff3d42def2d0b0975b0e5bf280c2f25392544
SHA512da4cd6010ccda5fc592ca5e14a4b62577b9551f28ad409b931d5df31c63892ca9bae98f57fd856031f636fe39f78b92310c12cc5606609fd065e90a12db10acf
-
Filesize
22B
MD57b381311a78901489326c8a317ddf8cd
SHA137d010f4fb37e77310effc7625dadbbbb36e8fe4
SHA25659813bc6f04b4d5a16bd89d01602f4308759a60a579022a6bd209c1c0e8b463b
SHA512626e1a6b65a7909b365f1b8623d9589889ac92f118f9c56d379af6e66e689075a70a82f76a790512203840506d8400c17f8afbd8a60540c14042c35e622a76e6
-
Filesize
72B
MD5830f634fb44956d70a234c43be9c0b75
SHA11ebe612620e801a4db9256781c95048f7573edc7
SHA2562a404ae066022b1d313fc3fa263e53ba387aa301e650cbca6379847bb1417381
SHA5128aa1eeab0f139af87885916505c5dd56ba66771d2083da8d505878b09eaaff8b8c35d765a0770d4b7deca4414f9ae88070f91e9ba119c4dc9b44875bdd344132
-
Filesize
74B
MD516d513397f3c1f8334e8f3e4fc49828f
SHA14ee15afca81ca6a13af4e38240099b730d6931f0
SHA256d3c781a1855c8a70f5aca88d9e2c92afffa80541334731f62caa9494aa8a0c36
SHA5124a350b790fdd2fe957e9ab48d5969b217ab19fc7f93f3774f1121a5f140ff9a9eaaa8fa30e06a9ef40ad776e698c2e65a05323c3adf84271da1716e75f5183c3
-
Filesize
26B
MD5bc970bd8ec8acf8ac1ada9e444673a39
SHA16c03dfa1c2595129e8e0e2428fceb0f2df7f82a7
SHA2560092de36b51381e4fe5e613bdbae906f0c6e8691fec4a93f82b876f1af826648
SHA512c3fc2d8b396b6753759b532bb9e91d015a039476ec2cf8abcd4c6d4d32b9305146752743692486bd4e3984325a7e9c6db0ff4d902c2879993789573f9cdca3b0
-
Filesize
27B
MD5b93641813851b1ad166b8163e5aeddc9
SHA1642d989ceea62bcfd70fb74f3c62ade0c1c41d78
SHA2561628c6bee5afc85044309f45e34190bc9ce8bd9516e30792460e14362657d42d
SHA512eee31a0d51df3a7ba35ab4025f8d458c4d12b6f46412982ad34aef31d9e83c7070056a07777ed4b62fb3b92b376b618099374901ffe4f988fe0f853a0e57c8ec
-
Filesize
36B
MD5056fd9e747f45f72c12ed185db65ca8f
SHA196b9e5254b0c249a3393008a3fb160b18319532b
SHA256b46a1b647cd0ac5d5ed27381e1559a8ed6244c5bb7a0d27a41ab1784c40bef85
SHA51293f9577f9226d4c090034d81735a61a4505da2068e207d5885452637bfcf87f434278e58db281bce79d49e0d941bf3ead9550541b459fad386a7dd60e24c4446
-
Filesize
39B
MD5763ec4bcf1080106283ac75cc79cfdc5
SHA1e916ad8ee0d278848350e957be6e99f8916c9f0e
SHA256e9f76c3dcf61068c71c8748639c37793963e1929aca11eed3c2caed692bd17ff
SHA51252273017ba7559aee2f73498b1d277517d2c163ab9eb6891a838664dd4b6ce3a576ae05116deecf502e8494522ce31209dffd2ab68462a75fb841592c83381d2
-
Filesize
8B
MD5c3cb69218b85c3260387fb582cb518dd
SHA1961c892ded09a4cbb5392097bb845ccba65902ad
SHA2561c329924865741e0222d3ead23072cfbed14f96e2b0432573068eb0640513101
SHA5122402fffeb89c531db742bf6f5466eee8fe13edf97b8ecfc2cace3522806b322924d1ca81dda25e59b4047b8f40ad11ae9216e0a0d5c7fc6beef4368eb9551422
-
Filesize
50B
MD566232700b45a0cd2fca0b0ab4c15cf1d
SHA15b63ae813636c07f4de62f88425d23c3c75e024b
SHA2566a3fde98ef05ef8b76bb66538de3e3e14b6d9928176532293645b0cb27325c9d
SHA512f97a2e4779c99d335f4118b94dfb004c65efe5342c6fc75632bfa6f96ac14c5c35cd1adc11a7e5472dc22553e6151e109e2cca5694139eea6fa32e620c0c5054
-
Filesize
52B
MD55d04a35d3950677049c7a0cf17e37125
SHA1cafdd49a953864f83d387774b39b2657a253470f
SHA256a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
SHA512c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
-
Filesize
56B
MD546afbdbeaa75354cac7bb848076da26b
SHA14c737d3a1b4d52123877e1eff5c10204ea3e958e
SHA2569dd741c9e0dbac1414a9c6ff7fb56344118eccd00b982882dd3f7db27c5c5a4d
SHA51256ee260b4338da6ab0ff461cf053fc1a9473eb2a9b75ae7bc91e7fb4c796d74a8a7f6ee3d463b7b2d8b758a195282b6f6a134ccb98f9144a465eca811cee6f6b
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
624KB
-
Filesize
82.1MB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
296KB
-
Filesize
5.6MB
-
Filesize
82.1MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
5.2MB
-
Filesize
584KB
-
Filesize
40KB