Analysis
- max time kernel
149s - max time network
137s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 09:22
General
- Target IL SHIN_PAYMENT_APR2026.pdf,IL SHIN_MAY0126.pdf.exe
- Size 1.1MB
- Sample260506-lcavdaev9v
- SHA256 ce49754955c7bd3656beea94b2197119ddb00ba1aa3420d05b98c744006c40c9
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
hosting2.ro.hostsailor.com
-
Port
587
-
Username
-
Password
7213575aceACE@@#
-
Email to
-
https://api.telegram.org/bot8071660627:AAFb60NRq4wg_o7DhXUr5cIhpwAsiUS1IlI/sendMessage?chat_id=5630866666
Signatures
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IL SHIN_PAYMENT_APR2026.pdf,IL SHIN_MAY0126.pdf.exe"C:\Users\Admin\AppData\Local\Temp\IL SHIN_PAYMENT_APR2026.pdf,IL SHIN_MAY0126.pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\IL SHIN_PAYMENT_APR2026.pdf,IL SHIN_MAY0126.pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IL SHIN_PAYMENT_APR2026.pdf,IL SHIN_MAY0126.pdf.exe"C:\Users\Admin\AppData\Local\Temp\IL SHIN_PAYMENT_APR2026.pdf,IL SHIN_MAY0126.pdf.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IL SHIN_PAYMENT_APR2026.pdf,IL SHIN_MAY0126.pdf.exe"C:\Users\Admin\AppData\Local\Temp\IL SHIN_PAYMENT_APR2026.pdf,IL SHIN_MAY0126.pdf.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 16043⤵
- Program crash
-
-
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\0yfq1m5r0bk.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\moXvbmoh.exe"C:\Users\Admin\AppData\Roaming\moXvbmoh.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\moXvbmoh.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\moXvbmoh.exe"C:\Users\Admin\AppData\Roaming\moXvbmoh.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3688 -ip 36881⤵
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
0yfq1m5r0bk.ps1
__PSScriptPolicyTest_lmoiuhf1.lfr.ps1
moXvbmoh.exe
memory/1372-127-0x00000000055B0000-0x000000000564C000-memory.dmp
memory/1372-140-0x0000000005810000-0x000000000581E000-memory.dmp
memory/1372-129-0x00000000057A0000-0x00000000057F0000-memory.dmp
memory/1372-130-0x00000000057F0000-0x00000000057F6000-memory.dmp
memory/1372-128-0x0000000005780000-0x0000000005792000-memory.dmp
memory/1372-139-0x0000000005800000-0x000000000580A000-memory.dmp
memory/1372-151-0x0000000006E50000-0x0000000007012000-memory.dmp
memory/1372-152-0x0000000006CF0000-0x0000000006D40000-memory.dmp
memory/2192-97-0x0000000006360000-0x0000000006375000-memory.dmp
memory/2192-87-0x0000000006360000-0x0000000006375000-memory.dmp
memory/2192-96-0x0000000004FE0000-0x000000000507C000-memory.dmp
memory/2192-86-0x0000000004FE0000-0x000000000507C000-memory.dmp
memory/3632-117-0x00000000077F0000-0x0000000007805000-memory.dmp
memory/3632-116-0x00000000077B0000-0x00000000077C1000-memory.dmp
memory/3632-115-0x0000000007290000-0x0000000007334000-memory.dmp
memory/3632-108-0x0000000070710000-0x000000007075C000-memory.dmp
memory/3632-122-0x0000000004AE0000-0x0000000004AF5000-memory.dmp
memory/3632-100-0x0000000005CD0000-0x0000000006027000-memory.dmp
memory/3632-120-0x0000000002180000-0x0000000002199000-memory.dmp
memory/3632-121-0x0000000004960000-0x0000000004966000-memory.dmp
memory/3632-119-0x0000000000640000-0x0000000000665000-memory.dmp
memory/3688-15-0x0000000000400000-0x0000000000448000-memory.dmp
memory/3688-81-0x00000000051C0000-0x000000000525C000-memory.dmp
memory/3688-27-0x00000000054E0000-0x00000000054F0000-memory.dmp
memory/3688-199-0x00000000054F0000-0x0000000005540000-memory.dmp
memory/3688-83-0x00000000054F0000-0x0000000005540000-memory.dmp
memory/3688-84-0x00000000054C0000-0x00000000054C6000-memory.dmp
memory/3688-85-0x00000000054E0000-0x00000000054F0000-memory.dmp
memory/3688-82-0x00000000052B0000-0x00000000052C2000-memory.dmp
memory/3748-17-0x0000000004B20000-0x0000000004B56000-memory.dmp
memory/3748-79-0x0000000004F70000-0x0000000004F76000-memory.dmp
memory/3748-64-0x0000000007990000-0x0000000007A34000-memory.dmp
memory/3748-65-0x0000000008100000-0x000000000877A000-memory.dmp
memory/3748-66-0x0000000007AC0000-0x0000000007ADA000-memory.dmp
memory/3748-67-0x0000000007B40000-0x0000000007B4A000-memory.dmp
memory/3748-68-0x0000000007D50000-0x0000000007DE6000-memory.dmp
memory/3748-69-0x0000000007CD0000-0x0000000007CE1000-memory.dmp
memory/3748-70-0x0000000007D00000-0x0000000007D0E000-memory.dmp
memory/3748-71-0x0000000007D10000-0x0000000007D25000-memory.dmp
memory/3748-72-0x0000000007E10000-0x0000000007E2A000-memory.dmp
memory/3748-73-0x0000000007E00000-0x0000000007E08000-memory.dmp
memory/3748-63-0x0000000006D60000-0x0000000006D7E000-memory.dmp
memory/3748-28-0x0000000005140000-0x0000000005162000-memory.dmp
memory/3748-80-0x0000000004FA0000-0x0000000004FB5000-memory.dmp
memory/3748-78-0x0000000002760000-0x0000000002779000-memory.dmp
memory/3748-77-0x0000000000D70000-0x0000000000D95000-memory.dmp
memory/3748-56-0x0000000070710000-0x000000007075C000-memory.dmp
memory/3748-22-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/3748-26-0x0000000005220000-0x000000000584A000-memory.dmp
memory/3748-21-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/3748-46-0x00000000067B0000-0x00000000067FC000-memory.dmp
memory/3748-45-0x0000000006760000-0x000000000677E000-memory.dmp
memory/3748-55-0x0000000007950000-0x0000000007984000-memory.dmp
memory/3748-37-0x00000000062A0000-0x00000000065F7000-memory.dmp
memory/3748-29-0x00000000061C0000-0x0000000006226000-memory.dmp
memory/3748-30-0x0000000006230000-0x0000000006296000-memory.dmp
memory/3936-40-0x0000022BFF460000-0x0000022BFF482000-memory.dmp
memory/3936-53-0x0000022BE7020000-0x0000022BE70CF000-memory.dmp
memory/3936-52-0x0000022BE6C70000-0x0000022BE6C7C000-memory.dmp
memory/3936-54-0x0000022BE70D0000-0x0000022BE70E2000-memory.dmp
memory/4964-8-0x0000000005D00000-0x0000000005DDA000-memory.dmp
memory/4964-7-0x0000000005100000-0x000000000519C000-memory.dmp
memory/4964-20-0x00000000066C0000-0x00000000066C6000-memory.dmp
memory/4964-19-0x0000000005D00000-0x0000000005DDA000-memory.dmp
memory/4964-10-0x0000000008150000-0x000000000822E000-memory.dmp
memory/4964-0-0x0000000000560000-0x0000000000676000-memory.dmp
memory/4964-9-0x0000000005400000-0x0000000005410000-memory.dmp
memory/4964-18-0x0000000005100000-0x000000000519C000-memory.dmp
memory/4964-6-0x00000000056C0000-0x00000000056DE000-memory.dmp
memory/4964-5-0x00000000054B0000-0x000000000554C000-memory.dmp
memory/4964-4-0x00000000051C0000-0x00000000051CA000-memory.dmp
memory/4964-3-0x0000000005400000-0x0000000005410000-memory.dmp
memory/4964-2-0x0000000005240000-0x00000000052D2000-memory.dmp
memory/4964-1-0x0000000005750000-0x0000000005CF6000-memory.dmp