Analysis
- max time kernel
149s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
23/06/2026, 12:18
General
- Target DIPS.ps1
- Size 1.1MB
- Sample260623-pgm72scx4k
- SHA256 44aa2dc52db5502d98c5beecec7a224992cdceda3b867d490ce09682f2f441ce
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
hosting2.ro.hostsailor.com
-
Port
587
-
Username
-
Password
7213575aceACE@@
-
Email to
Signatures
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 41 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\DIPS.ps11⤵
- Suspicious use of SetThreadContext
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1236-22-0x0000000000400000-0x0000000000448000-memory.dmp
memory/1236-47-0x0000000006CF0000-0x0000000006CFA000-memory.dmp
memory/1236-46-0x0000000006F30000-0x0000000006FC2000-memory.dmp
memory/1236-45-0x0000000074DB0000-0x000000007556C000-memory.dmp
memory/1236-44-0x0000000074DC2000-0x0000000074DC3000-memory.dmp
memory/1236-43-0x0000000006BF0000-0x0000000006C40000-memory.dmp
memory/1236-42-0x0000000006D60000-0x0000000006F22000-memory.dmp
memory/1236-41-0x0000000074DB0000-0x000000007556C000-memory.dmp
memory/1236-39-0x0000000074DC2000-0x0000000074DC3000-memory.dmp
memory/1236-27-0x00000000059D0000-0x0000000005A6C000-memory.dmp
memory/1236-26-0x0000000005F90000-0x000000000654A000-memory.dmp
memory/4088-24-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-30-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-15-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-16-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-17-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-18-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-19-0x00000191FDB30000-0x00000191FDB44000-memory.dmp
memory/4088-20-0x00000191FDB70000-0x00000191FDB84000-memory.dmp
memory/4088-21-0x00000191FE030000-0x00000191FE036000-memory.dmp
memory/4088-13-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-23-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-0-0x00007FFC911BF000-0x00007FFC911C0000-memory.dmp
memory/4088-25-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-12-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-11-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-28-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-29-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-14-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-31-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-32-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-33-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-34-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-36-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-37-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-38-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-10-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-40-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-9-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-8-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-7-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-6-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-5-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp
memory/4088-3-0x00000191FDB40000-0x00000191FDB62000-memory.dmp
memory/4088-4-0x00007FFC91030000-0x00007FFC919D4000-memory.dmp