Analysis
- max time kernel
299s - max time network
225s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/08/2026, 15:28
General
- Target doc15088900020260816.exe
- Size 269KB
- Sample260817-swee8sdn2x
- SHA256 d3407128f581ec8e9e002cdff21b68e5d67517b9f8e9371894cafe108750d38b
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.wtktechnologies.com.my
-
Port
587
-
Username
-
Password
ak475898*
-
Email to
Signatures
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\doc15088900020260816.exe"C:\Users\Admin\AppData\Local\Temp\doc15088900020260816.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4396-0-0x00007FFFEEE1F000-0x00007FFFEEE20000-memory.dmp
memory/4396-1-0x00000000008D0000-0x0000000000916000-memory.dmp
memory/4396-2-0x00007FFFEEC90000-0x00007FFFEF634000-memory.dmp
memory/4396-3-0x00007FFFEEC90000-0x00007FFFEF634000-memory.dmp
memory/4396-4-0x00007FFFEEC90000-0x00007FFFEF634000-memory.dmp
memory/4396-5-0x00007FFFEEC90000-0x00007FFFEF634000-memory.dmp
memory/4396-6-0x00007FFFEEC90000-0x00007FFFEF634000-memory.dmp
memory/4396-7-0x00007FFFEEC90000-0x00007FFFEF634000-memory.dmp
memory/4396-8-0x00007FFFEEC90000-0x00007FFFEF634000-memory.dmp