vipkeylogger | 42cc73e1e7e21b1b745661933a89f5386988725cd9361799fb2d1a2806c1f25c

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 10:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
POLY MEDICURE LIMITED 25354322 (1).js
Size 1.6MB
Sample260714-l7vs2aax2n
SHA256 42cc73e1e7e21b1b745661933a89f5386988725cd9361799fb2d1a2806c1f25c
MD5 84fdec73b1259073bf7c9d48e1526a1b
SHA1 ef1f3238eb371b38787387e8659d5b1b485151a5
SHA512 3b1764094e51efb3fd06249f32d0f839c218e6b66ed78814e8c35aa1d21a6bcb2da1a241975d826757b3aa2ef62b65cf379724396dd07dc97fb8ebb8521f8006
SSDEEP 24576:asFZVE7jtwafR8Cc67ktfIo5ZEvQjIU1m8np7/yDelU+Sq2s8:7Zq14IyQonS
TLSH
T17485F1104F846FAE8BAC1A19D07E262EF3E14AC95067BCCAEF63BD456FB670051171B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection defense_evasion discovery execution vipkeylogger keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
hosting2.ro.hostsailor.com
Port
587
Username
[email protected]
Password
7213575aceACE@@#
Email to
[email protected]

https://api.telegram.org/bot8099843793:AAGeYKMLti1IpyT9o6bz7OtgdXF9md25uXA/sendMessage?chat_id=6337180137

Signatures

Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2368	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	reallyfreegeoip.org
1	checkip.dyndns.org
1	reallyfreegeoip.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2368 set thread context of 5484	2368	powershell.exe	94

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aspnet_compiler.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3888	taskkill.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
5484	aspnet_compiler.exe
5484	aspnet_compiler.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe
2368	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	5484	aspnet_compiler.exe
Token: SeDebugPrivilege	3888	taskkill.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2368	2076	wscript.exe	87
PID 2368 wrote to memory of 4064	2368	powershell.exe	89
PID 2368 wrote to memory of 252	2368	powershell.exe	90
PID 2368 wrote to memory of 1512	2368	powershell.exe	91
PID 2368 wrote to memory of 260	2368	powershell.exe	92
PID 2368 wrote to memory of 236	2368	powershell.exe	93
PID 2368 wrote to memory of 5484	2368	powershell.exe	94
PID 2368 wrote to memory of 5484	2368	powershell.exe	94
PID 2368 wrote to memory of 5484	2368	powershell.exe	94
PID 2368 wrote to memory of 5484	2368	powershell.exe	94
PID 2368 wrote to memory of 5484	2368	powershell.exe	94
PID 2076 wrote to memory of 3888	2076	wscript.exe	97

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	aspnet_compiler.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\POLY MEDICURE LIMITED 25354322 (1).js"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_UID5xld5OFuj_1784023859859.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4064
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:252
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1512
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:260
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:236
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:5484
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_UID5xld5OFuj_1784023859859.ps1

Path C:\Temp\ps_UID5xld5OFuj_1784023859859.ps1
Size 1.2MB
SHA256 8c3cfde11fd634a9833d6c222b23df30a0544682f7b4c9c2ca50b276dc7e3ff0
MD5 153a36e3a09936793df5698c72b35868
SHA1 d1951a9e300a28c17094e63773c00ea337bd1d2c
SHA512 402a7640271627ecffba69dd7c829e4bc6f0412fbe6eacd183fa6d0537e944de4a91e11329785f57cae9932f0a0225c4a7bdfc890f9453237d441b16cbf572f8
SSDEEP 24576:feQ5nJLkfw/wtkoKycnEe40T1rUN0ybtr6gDJH0N57Hsj:bha0w7wbRa0eJU2
TLSH
T1FB45233CEA2B50D9860333EF751FB959A9FED3C74C424B12E26D867471F8668AB03452
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2368-19-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-20-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-7-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-8-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-4-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-10-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-5-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-11-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-12-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-13-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-14-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-15-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-16-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-17-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-6-0x0000029747220000-0x0000029747242000-memory.dmp

Download

memory/2368-18-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-35-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-21-0x0000029747280000-0x0000029747298000-memory.dmp

Download

memory/2368-1-0x00007FFB0BAEF000-0x00007FFB0BAF0000-memory.dmp

Download

memory/2368-31-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-28-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/2368-27-0x00007FFB0B960000-0x00007FFB0C304000-memory.dmp

Download

memory/5484-25-0x0000000005580000-0x000000000561C000-memory.dmp

Download

memory/5484-24-0x0000000005B40000-0x00000000060FA000-memory.dmp

Download

memory/5484-29-0x00000000068D0000-0x0000000006A92000-memory.dmp

Download

memory/5484-30-0x0000000006770000-0x00000000067C0000-memory.dmp

Download

memory/5484-23-0x00000000751E2000-0x00000000751E3000-memory.dmp

Download

memory/5484-32-0x00000000751E2000-0x00000000751E3000-memory.dmp

Download

memory/5484-33-0x0000000006AA0000-0x0000000006B32000-memory.dmp

Download

memory/5484-34-0x0000000006870000-0x000000000687A000-memory.dmp

Download

memory/5484-22-0x0000000000400000-0x0000000000448000-memory.dmp

Download