Analysis
-
max time kernel
159s -
max time network
289s -
platform
windows10-2004_x64 -
resource
win10v2004-20250619-en -
resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2025, 06:20
Static task
static1
Behavioral task
behavioral1
Sample
JUSTIFICANTE DE PAGO.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral2
Sample
JUSTIFICANTE DE PAGO.exe
Resource
win11-20250619-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win11-20250619-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20250619-en
General
-
Target
JUSTIFICANTE DE PAGO.exe
-
Size
1.6MB
-
MD5
92ea2de8eac32690cc714753005d58dd
-
SHA1
bd24e283b11c6bfc7bf95ed57d74255c84e42091
-
SHA256
4d8ac0b9a416c55db3917d86a2339a99e6945135914e720a1d535188e8fae059
-
SHA512
8294f5678f0f5bb8e25ee46f06b4caff99901b64c6ee935e390228cac9f34c9ae57087edf9c50070a3355cca170b6eb8744ebec555a28b1305299c04a0e09dfc
-
SSDEEP
49152:1R2XPl1XpJutVQSN6rwm4WWfrQsYqZIn7:1R2XPlVpwt6S7WWyq2n7
Malware Config
Extracted
vipkeylogger
Protocol: smtp- Host:
webmail.lagunak.com - Port:
587 - Username:
[email protected] - Password:
rcc2015! - Email To:
[email protected]
Signatures
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Loads dropped DLL 10 IoCs
pid Process 224 JUSTIFICANTE DE PAGO.exe 224 JUSTIFICANTE DE PAGO.exe 224 JUSTIFICANTE DE PAGO.exe 224 JUSTIFICANTE DE PAGO.exe 224 JUSTIFICANTE DE PAGO.exe 224 JUSTIFICANTE DE PAGO.exe 224 JUSTIFICANTE DE PAGO.exe 224 JUSTIFICANTE DE PAGO.exe 224 JUSTIFICANTE DE PAGO.exe 224 JUSTIFICANTE DE PAGO.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 44 drive.google.com 45 drive.google.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 62 checkip.dyndns.org -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\expired\fortjet.ini JUSTIFICANTE DE PAGO.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1568 JUSTIFICANTE DE PAGO.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 224 JUSTIFICANTE DE PAGO.exe 1568 JUSTIFICANTE DE PAGO.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1076 1568 WerFault.exe 97 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUSTIFICANTE DE PAGO.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JUSTIFICANTE DE PAGO.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1568 JUSTIFICANTE DE PAGO.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 224 JUSTIFICANTE DE PAGO.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1568 JUSTIFICANTE DE PAGO.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 224 wrote to memory of 1568 224 JUSTIFICANTE DE PAGO.exe 97 PID 224 wrote to memory of 1568 224 JUSTIFICANTE DE PAGO.exe 97 PID 224 wrote to memory of 1568 224 JUSTIFICANTE DE PAGO.exe 97 PID 224 wrote to memory of 1568 224 JUSTIFICANTE DE PAGO.exe 97 PID 224 wrote to memory of 1568 224 JUSTIFICANTE DE PAGO.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe"C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe"C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1568 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 22723⤵
- Program crash
PID:1076
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1568 -ip 15681⤵PID:448
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD530b091668111ab1d6c19f16586a9eee5
SHA1aea49d81cf9972eaf1604793c04d13ddffe2c475
SHA256331ca4b3a311324b463167ec43851146e57a2d90500ac3fd57a7683f6b777ffb
SHA5126dd592af085b2e28c54d7f525916112dbf5cfe134393b0b97f8f1f64739cf90962273c51f02e8ce2c623cf6aa8355eacda5db0b0256d8f05a77ccf0f99d11648
-
Filesize
11KB
MD59625d5b1754bc4ff29281d415d27a0fd
SHA180e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA256c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
SHA512dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b