Analysis
- max time kernel
149s - max time network
139s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
20/05/2026, 17:43
General
- Target TEKLİF_İSTEĞİ_Tübitak_SAGE_RFQ_xlsx.exe
- Size 866KB
- Sample260520-wasbrae15p
- SHA256 5b03e56fa88be176ff444e542aef663ee12bdcf8d8b6e5799a9ff78b9c4a20ab
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.htcp.homes
-
Port
587
-
Username
-
Password
7213575aceACE@@
-
Email to
Signatures
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TEKLİF_İSTEĞİ_Tübitak_SAGE_RFQ_xlsx.exe"C:\Users\Admin\AppData\Local\Temp\TEKLİF_İSTEĞİ_Tübitak_SAGE_RFQ_xlsx.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\TEKLİF_İSTEĞİ_Tübitak_SAGE_RFQ_xlsx.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hEPzte.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hEPzte" /XML "C:\Users\Admin\AppData\Local\Temp\tmp659B.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 17922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4580 -ip 45801⤵
-
C:\Users\Admin\AppData\Roaming\hEPzte.exeC:\Users\Admin\AppData\Roaming\hEPzte.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hEPzte.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hEPzte.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hEPzte" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA812.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\hEPzte.exe"C:\Users\Admin\AppData\Roaming\hEPzte.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_mpbpzcb4.zv0.ps1
tmp659B.tmp
hEPzte.exe
memory/1264-106-0x0000000007130000-0x00000000071D4000-memory.dmp
memory/1264-92-0x0000000070E70000-0x0000000070EBC000-memory.dmp
memory/1264-107-0x0000000007430000-0x0000000007441000-memory.dmp
memory/1264-108-0x0000000007470000-0x0000000007485000-memory.dmp
memory/1928-53-0x000000006F6E0000-0x000000006F72C000-memory.dmp
memory/1928-16-0x00000000026C0000-0x00000000026F6000-memory.dmp
memory/1928-17-0x0000000002710000-0x0000000002720000-memory.dmp
memory/1928-19-0x0000000005310000-0x000000000593A000-memory.dmp
memory/4224-91-0x0000000006200000-0x000000000624C000-memory.dmp
memory/4224-93-0x0000000070E70000-0x0000000070EBC000-memory.dmp
memory/4332-41-0x000000006F6E0000-0x000000006F72C000-memory.dmp
memory/4332-61-0x0000000007720000-0x0000000007731000-memory.dmp
memory/4332-23-0x0000000005520000-0x0000000005586000-memory.dmp
memory/4332-22-0x00000000054B0000-0x0000000005516000-memory.dmp
memory/4332-18-0x0000000005020000-0x0000000005030000-memory.dmp
memory/4332-36-0x00000000061C0000-0x00000000061DE000-memory.dmp
memory/4332-65-0x0000000007850000-0x0000000007858000-memory.dmp
memory/4332-37-0x00000000061E0000-0x000000000622C000-memory.dmp
memory/4332-64-0x0000000007860000-0x000000000787A000-memory.dmp
memory/4332-40-0x0000000007180000-0x00000000071B4000-memory.dmp
memory/4332-48-0x00000000067A0000-0x00000000067BE000-memory.dmp
memory/4332-49-0x00000000073C0000-0x0000000007464000-memory.dmp
memory/4332-50-0x0000000007B50000-0x00000000081CA000-memory.dmp
memory/4332-51-0x0000000007510000-0x000000000752A000-memory.dmp
memory/4332-52-0x0000000007590000-0x000000000759A000-memory.dmp
memory/4332-63-0x0000000007760000-0x0000000007775000-memory.dmp
memory/4332-60-0x00000000077A0000-0x0000000007836000-memory.dmp
memory/4332-20-0x0000000005020000-0x0000000005030000-memory.dmp
memory/4332-62-0x0000000007750000-0x000000000775E000-memory.dmp
memory/4580-7-0x0000000005140000-0x0000000005162000-memory.dmp
memory/4580-3-0x0000000005100000-0x0000000005110000-memory.dmp
memory/4580-11-0x000000000C8E0000-0x000000000C97C000-memory.dmp
memory/4580-9-0x0000000005100000-0x0000000005110000-memory.dmp
memory/4580-8-0x0000000005CC0000-0x0000000005CDE000-memory.dmp
memory/4580-1-0x00000000053B0000-0x0000000005956000-memory.dmp
memory/4580-0-0x0000000000330000-0x000000000040E000-memory.dmp
memory/4580-5-0x0000000005960000-0x0000000005CB7000-memory.dmp
memory/4580-10-0x00000000048A0000-0x000000000492E000-memory.dmp
memory/4580-4-0x0000000005050000-0x000000000505A000-memory.dmp
memory/4580-6-0x00000000050E0000-0x00000000050F2000-memory.dmp
memory/4580-2-0x0000000004EB0000-0x0000000004F42000-memory.dmp
memory/5060-87-0x0000000000400000-0x0000000000448000-memory.dmp
memory/5060-112-0x0000000006FD0000-0x0000000007192000-memory.dmp
memory/5060-113-0x0000000006E70000-0x0000000006EC0000-memory.dmp