Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
-
submitted
14/04/2025, 13:13
General
-
Target
315176345_2025-04-13-5522441.exe
-
Size
645KB
-
MD5
619e2fa8cf181dcce7df16e5fee4065a
-
SHA1
7c72e48804fbd2bd8b4f28e69f916d910afd5cc7
-
SHA256
8e6c5f4651741758b6b141da89e4c27fa244eccce3d9beaf4b1ae0e48f13d5a0
-
SHA512
9840537924bf3858b21771945798f49b2e907b8efee4fe4e7ae5a0762c5ff451543b95d9750e31d0203ec485da45535c03d8cfbeba88ca70533ddb19ac4ad303
-
SSDEEP
12288:u+q6+b0201LM+OryHE3WrRMnSUO8nmCeud3f2KHTlt1A:u+qlA20WyGEyltnmCe8fJ31A
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7940557245:AAGEVNBuuGDhlbTi3PPq7irUInwmQ9JgMqQ/sendMessage?chat_id=7590946867
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\315176345_2025-04-13-5522441.exe"C:\Users\Admin\AppData\Local\Temp\315176345_2025-04-13-5522441.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\315176345_2025-04-13-5522441.exe"C:\Users\Admin\AppData\Local\Temp\315176345_2025-04-13-5522441.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53B
MD593fd586436224a1cd46a25e4ad32cc60
SHA1e30ac7e4410c9b86a612c1bb2f170c597d3bd584
SHA2567a07cba8f7a78cef7dd6a9e9e9c0bc66dbbd1b1975ddccc9f2d2e532c6417f2b
SHA512f1e4c694918da15fe80171d29f5d1b03b0d04491728354e68c4a4cffd7d809f6b4883811f115806d8e3f90827a371b7e18946d252a5c04914ec57c111a81bcf3
-
Filesize
60B
MD56003c892b3f3e6857b44804bb171e32b
SHA1e5388e8d8163b149dcc9c496a3bf2a4a23a0ad77
SHA2566aca13da7c0fef80812c437ed6ebfc24e9ab6dc53f36b8f42c6b7071f84e3ca8
SHA512e935627de21df33244c6aed2fdd8e2d8750bdff40574c1063c02334e2059649b7338e1ff2732efb8b0b0110e53e0a67c25390ee8de314b601aa13e37095cf4c7
-
Filesize
8B
MD5c3cb69218b85c3260387fb582cb518dd
SHA1961c892ded09a4cbb5392097bb845ccba65902ad
SHA2561c329924865741e0222d3ead23072cfbed14f96e2b0432573068eb0640513101
SHA5122402fffeb89c531db742bf6f5466eee8fe13edf97b8ecfc2cace3522806b322924d1ca81dda25e59b4047b8f40ad11ae9216e0a0d5c7fc6beef4368eb9551422
-
Filesize
19B
MD5a82a5da452642ddab3a7ee07f7c408df
SHA1cf937f2e7e57c21beaf57a2b7e0c4b77f37c63f7
SHA25684911471a6124a186d240b3b67eed83ba5a0a7cb911eefc790712d936c83d568
SHA51273ed822f62f762e6e8902b4a5c31ea9a0501926d2dd512f5e5285d39fa8b31e82e61294c99c341e0f2046d0cb0351396e8d97afc0ddc71d37c9b680cf757f5a0
-
Filesize
73B
MD5b80ef50d0f02b0e60035ddab237b744e
SHA1addac470421ca09efee0c0718d805e1312246086
SHA256d26183d8122f1a8b4a98c5716a0520bdf9b28b95fa3baac4af25c49d39bd1da9
SHA512ccf91989bb62dfd85144b5b85528921f2a134515797fbe6be348852bca34e6e7bc27a7d6a17e7ba28b62a8c644581a092a892957c84853cbb29eea8cb6792820
-
Filesize
12KB
MD59b38a1b07a0ebc5c7e59e63346ecc2db
SHA197332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA2568b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
SHA51226e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
-
Filesize
5B
MD592877af70a45fd6a2ed7fe81e1236b78
SHA10b7f849446d3383546d15a480966084442cd2193
SHA2565860faf02b6bc6222ba5aca523560f0e364ccd8b67bee486fe8bf7c01d492ccb
SHA5128ac4145c8e388ddfe3cd94886f026260d917cab07903c533f3a26945019bc4a50e6f23f266acbb0cbae89130fa3242c9a5145e4218c3ef1deebccb58d1a64a43
-
Filesize
9B
MD5bc86ffa91686a2ee2ac3cc3d50c4389e
SHA16d81aa156225f8df56a7711519ac3ff87abec24f
SHA2569e56c757510a69c7ee47407dbda53e8d8b983755854362df4dbcad941696dceb
SHA5125c54242e478199a95f615af1ac74fda63f4a1a1e22ef5799dc552ed432320adb20df54f9083cee1ee7c2d8ef2792f0f12e579229b7c64ffb74952e3044f4b7ff
-
Filesize
21B
MD52dc5ae451f6175ae513bed5c4714d5ee
SHA14f47723723e7643a5b4c67f5f9d68cd834f80a4f
SHA256180f6fc17f1d6e7d0878868f1643dc8c340f457eac0d6fc3680a95f1f9e7e54e
SHA5129140fa690eca23bdf03d3058e6527c56cd51089b394ef681979f8e63cdc183fa942aecfd2d1061f50966fb998a5c0999b97b5b3a9af6aff1ce1d4826cfd42887
-
Filesize
30B
MD5f15bfdebb2df02d02c8491bde1b4e9bd
SHA193bd46f57c3316c27cad2605ddf81d6c0bde9301
SHA256c87f2ff45bb530577fb8856df1760edaf1060ae4ee2934b17fdd21b7d116f043
SHA5121757ed4ae4d47d0c839511c18be5d75796224d4a3049e2d8853650ace2c5057c42040de6450bf90dd4969862e9ebb420cd8a34f8dd9c970779ed2e5459e8f2f1
-
Filesize
16B
MD5299751a30a50b5a6b62371c27fc4e478
SHA12a016fdba9876a7aade76bff3c4780633d5e6ef4
SHA2560d4b1effa5ab30d5f6d9e6b1bd6de429d4a25075dbdf2f28d67beab72f6bff0e
SHA5126917664885b34990ded6171ea01bfb2e1ff67e38455bee9d75e80d3905db7e7199679ae3761e290062e679ccf2555804b0ec1a59a5fd74c5069857c3326264e5
-
Filesize
52B
MD55d04a35d3950677049c7a0cf17e37125
SHA1cafdd49a953864f83d387774b39b2657a253470f
SHA256a9493973dd293917f3ebb932ab255f8cac40121707548de100d5969956bb1266
SHA512c7b1afd95299c0712bdbc67f9d2714926d6ec9f71909af615affc400d8d2216ab76f6ac35057088836435de36e919507e1b25be87b07c911083f964eb67e003b
-
Filesize
33B
MD53ad35e1651d29fa2f6dcd7722f5ca36f
SHA1fb94d43c8fec12db5ea14f5af04c1c4e657202d9
SHA256ba19c5bc80f1f84e8bddbae4185dfd07c997855b22f9ecffe37f96e4bf0d7517
SHA51284bf1fc1454252d9fcbf350ddfa041f8656b1d91bb4975b04ba8f2c36294f51e597dedfdd689bca711ea338df4b60826c3339aac3ae611dcb591c3d4e71fcd58
-
Filesize
36B
MD5d8c4f00a7530a3857f15e75e4342ea05
SHA129a3566de2907d8ce09e23ca70570798e77c6c8b
SHA256723cfc58789dfd395bc685d77c4011c9eb4265d1f5481b616139561beec28f94
SHA51263a6f6ceea34d7fa425bdcc30d2193fd6bd3ac3c987ea01e6109c72c81b31e9a7f3f57726fa414715f12180de73c6a7652f0cf2c0d823cb26901d705a724f7e1
-
Filesize
56B
MD529a28ce2b1e65d140f33352d68603e6f
SHA16c018cc95d5c6145b253dc0ecf7788ba60a186e8
SHA256703e34699df3afe05877ed93aa2f8d37e2868411d55397a921fb45a0509816a2
SHA5124285dd432573efdabf9e11d787a75db6eea018c7c427237012e3e0b89a589c1f79c5fb2f437f5d8f5d4af404f8dd72f7d14cc6012b877550f3291f325a0fe1d3
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
66.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
66.8MB
-
Filesize
296KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
5.2MB
-
Filesize
584KB
-
Filesize
40KB