vipkeylogger | c00740d627a2a21bc95b8f544259604e725f2eeb8aae75ed8be1d569b422cb8a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18082026 SİPARİŞ ONAYI_xlsx.js
Size 521KB
Sample260818-mpmkdagf68
SHA256 c00740d627a2a21bc95b8f544259604e725f2eeb8aae75ed8be1d569b422cb8a
MD5 32f1ba909ce5c88145293b4c82ecb6f9
SHA1 4260a91fef0bb79ebcf3daa419a191b44b6a21a5
SHA512 468615b61f11ac88c15006b49da980646fc9765265629c335faa6ea4d88f64996502dd6bec65feb674bc779436c420f16f651768014fc3ef55921a6977d5bd2e
SSDEEP 6144:j6kGPAFxcxtYKdryDL516vmGVbo8l2H/iL9G:euxc7NgGuGb3YH/j
TLSH
T110B4411D1E4E2AC8B065A912D7C6CAF5936EED5BAB9F0D25119BC1DC03A3904DC0BDE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution vipkeylogger keylogger persistence stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
hosting2.ro.hostsailor.com
Port
587
Username
[email protected]
Password
7213575aceACE@@
Email to
[email protected]

Signatures

Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
11	1760	powershell.exe
15	1760	powershell.exe
17	1760	powershell.exe
19	1760	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1760	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
14	checkip.dyndns.org
16	reallyfreegeoip.org
17	reallyfreegeoip.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1760	powershell.exe
1760	powershell.exe
1760	powershell.exe
1760	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4628	conhost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 1240	4628	conhost.exe	89
PID 2068 wrote to memory of 1760	2068	conhost.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\18082026 SİPARİŞ ONAYI_xlsx.js"
1⤵
PID:1572

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:1240

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:1584

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\1ucemsyj51pm\1ucemsyj51pm.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\1ucemsyj51pm\1ucemsyj51pm.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:1760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1ucemsyj51pm.ps1

Path C:\Users\Admin\AppData\Local\Temp\1ucemsyj51pm\1ucemsyj51pm.ps1
Size 1KB
SHA256 33134b27592f15210aa08f0eccf466f1d3b8365a07cee25dc748427f1c754a22
MD5 4109cd78304d2f59e77bf2758e64a55e
SHA1 104648118283d4ca0a255d0a7f0f860c69096f16
SHA512 f9ca3f7b4b6723fb3426696b830a7a7c767236efc78d7a9e76e32afff048a8e38da481cb11b897abfa48ad0b5830e7beeadc219da6c930eecbd6ea11599a3c81
TLSH
T15031F16007E2DBE402C7D5779A702EA493B80A5E63DCBB00F68FC40697495907EF634A
MD5 SHA1 SHA512 TLSH

Submit Download

1ucemsyj51pma

Path C:\Users\Admin\AppData\Local\Temp\1ucemsyj51pm\1ucemsyj51pma
Size 66KB
SHA256 e831de7a912eb2a1d01e2741b68cbf7c8fc883fcb778d626dc8830810a80daf4
MD5 f93a2bfdd5087525f0a85c90d58f14f7
SHA1 c67366cba8ff00155cb85b6a35ddd314e055d205
SHA512 887268344f608e537424185678f480dac369d085ef151180b2b12a79e2e2c50947640e399d017d9134448ebc9d397d2146c416dd206ba1ce6ff03e583d9c7390
SSDEEP 1536:ZN19I4aGFVbjsyCR6hS/+l07zdfE0akPrCV3gvFBLg94WPlHfC1PNqMpTN:ZRw+VboP6hSW4zJWT3gvFq9nozfp
TLSH
T1CB6302D2C907AEDB26444B120837CF0BA3077C1E9FD912DA6CBE69174CBE8470A77642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ucemsyj51pmb

Path C:\Users\Admin\AppData\Local\Temp\1ucemsyj51pm\1ucemsyj51pmb
Size 66KB
SHA256 089e3b572583b26b5662072035c883bde71665c8f223589cd292c209205dcc78
MD5 bc3b69c6fa747fef34abbe822e26660b
SHA1 193f5de6757c2b6ddebefea277bc8f9ce46125b7
SHA512 5a5f3cac836b78fd5267d92305cbd1a5405c5d66d7abe302a69b6967bacfa3580d5673f12682dc11f79d4d7cbf1d45137e3bda7ac7ae7d706cd39b14a9ebde19
SSDEEP 1536:TDfpO/2hGZMXjhSJg9e8gUed9AijaOdC36898gYUVIwV6+mor0fe:TDfpO/2UZMXlw88aOdSwRUSWBke
TLSH
T1E3630290EEF62E93E0344896C96E25904EF080B3B5598D475369FC3C64ABAAFF45F1D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hirds5yp.ksy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hirds5yp.ksy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1760-11-0x000002793B4B0000-0x000002793B4D2000-memory.dmp

Download

memory/1760-15-0x000002793B770000-0x000002793B7C0000-memory.dmp

Download

memory/1760-16-0x0000027922EA0000-0x0000027922EB2000-memory.dmp

Download

memory/1760-17-0x000002793B800000-0x000002793B848000-memory.dmp

Download

memory/1760-19-0x000002793C040000-0x000002793C202000-memory.dmp

Download

memory/1760-20-0x000002793B8A0000-0x000002793B8F0000-memory.dmp

Download