Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
23/03/2026, 16:19
General
- Target MV ZENKEN MARU.exe
- Size 989KB
- Sample260323-tsk92sfz9z
- SHA256 2804023cb811e89cd1fc6bec5614a689929a3c23f68939142176c7b2fbdd4b9f
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.ardiabetes.org
-
Port
25
-
Username
-
Password
Storage@901$
-
Email to
Signatures
- VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Vipkeylogger family
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- SmartAssembly .NET packer 1 IoCs
Detects SmartAssembly .NET packer.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MV ZENKEN MARU.exe"C:\Users\Admin\AppData\Local\Temp\MV ZENKEN MARU.exe"1⤵
- Checks computer location settings
- Drops startup file
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\MV ZENKEN MARU.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_rz3je3q3.t1d.ps1
memory/4552-73-0x000001883B7D0000-0x000001883B7DC000-memory.dmp
memory/4552-42-0x0000018854500000-0x0000018854576000-memory.dmp
memory/4552-41-0x0000018854430000-0x0000018854474000-memory.dmp
memory/4552-33-0x0000018853F60000-0x0000018853F82000-memory.dmp
memory/4576-16-0x00000000048B0000-0x00000000048E6000-memory.dmp
memory/4576-43-0x0000000006B30000-0x0000000006B62000-memory.dmp
memory/4576-65-0x0000000005670000-0x0000000005C78000-memory.dmp
memory/4576-66-0x0000000004E60000-0x0000000004E84000-memory.dmp
memory/4576-67-0x0000000006380000-0x0000000006398000-memory.dmp
memory/4576-62-0x0000000007BB0000-0x0000000007BB8000-memory.dmp
memory/4576-61-0x0000000007BD0000-0x0000000007BEA000-memory.dmp
memory/4576-18-0x0000000004A00000-0x0000000004A10000-memory.dmp
memory/4576-17-0x0000000004A00000-0x0000000004A10000-memory.dmp
memory/4576-19-0x0000000005040000-0x0000000005668000-memory.dmp
memory/4576-20-0x0000000005C80000-0x0000000005CA2000-memory.dmp
memory/4576-22-0x0000000005D70000-0x0000000005DD6000-memory.dmp
memory/4576-21-0x0000000005DE0000-0x0000000005E46000-memory.dmp
memory/4576-60-0x0000000007AD0000-0x0000000007AE4000-memory.dmp
memory/4576-30-0x0000000005F00000-0x0000000006254000-memory.dmp
memory/4576-32-0x00000000065B0000-0x00000000065FC000-memory.dmp
memory/4576-31-0x0000000006560000-0x000000000657E000-memory.dmp
memory/4576-59-0x0000000007AC0000-0x0000000007ACE000-memory.dmp
memory/4576-58-0x0000000007A90000-0x0000000007AA1000-memory.dmp
memory/4576-57-0x0000000007B10000-0x0000000007BA6000-memory.dmp
memory/4576-44-0x000000006F1A0000-0x000000006F1EC000-memory.dmp
memory/4576-56-0x0000000007900000-0x000000000790A000-memory.dmp
memory/4576-52-0x0000000006B70000-0x0000000006B8E000-memory.dmp
memory/4576-53-0x0000000007750000-0x00000000077F3000-memory.dmp
memory/4576-54-0x0000000007ED0000-0x000000000854A000-memory.dmp
memory/4576-55-0x0000000007890000-0x00000000078AA000-memory.dmp
memory/5640-15-0x0000000006630000-0x0000000006678000-memory.dmp
memory/5640-69-0x000000000AFD0000-0x000000000B00B000-memory.dmp
memory/5640-3-0x00000000053D0000-0x00000000053E0000-memory.dmp
memory/5640-4-0x00000000052A0000-0x00000000052AA000-memory.dmp
memory/5640-5-0x00000000054D0000-0x000000000556C000-memory.dmp
memory/5640-0-0x0000000000700000-0x00000000007FE000-memory.dmp
memory/5640-2-0x00000000051D0000-0x0000000005262000-memory.dmp
memory/5640-8-0x00000000053D0000-0x00000000053E0000-memory.dmp
memory/5640-6-0x00000000084D0000-0x00000000084E4000-memory.dmp
memory/5640-7-0x0000000005E50000-0x0000000005F23000-memory.dmp
memory/5640-10-0x0000000008520000-0x00000000085FA000-memory.dmp
memory/5640-70-0x0000000002A90000-0x0000000002A96000-memory.dmp
memory/5640-71-0x000000000B970000-0x000000000BB32000-memory.dmp
memory/5640-72-0x00000000098F0000-0x0000000009940000-memory.dmp
memory/5640-1-0x00000000058A0000-0x0000000005E44000-memory.dmp