vipkeylogger | c00740d627a2a21bc95b8f544259604e725f2eeb8aae75ed8be1d569b422cb8a

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18082026 SİPARİŞ ONAYI_xlsx.js
Size 521KB
Sample260818-mpmkdagf68
SHA256 c00740d627a2a21bc95b8f544259604e725f2eeb8aae75ed8be1d569b422cb8a
MD5 32f1ba909ce5c88145293b4c82ecb6f9
SHA1 4260a91fef0bb79ebcf3daa419a191b44b6a21a5
SHA512 468615b61f11ac88c15006b49da980646fc9765265629c335faa6ea4d88f64996502dd6bec65feb674bc779436c420f16f651768014fc3ef55921a6977d5bd2e
SSDEEP 6144:j6kGPAFxcxtYKdryDL516vmGVbo8l2H/iL9G:euxc7NgGuGb3YH/j
TLSH
T110B4411D1E4E2AC8B065A912D7C6CAF5936EED5BAB9F0D25119BC1DC03A3904DC0BDE3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery execution vipkeylogger keylogger persistence stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
hosting2.ro.hostsailor.com
Port
587
Username
[email protected]
Password
7213575aceACE@@
Email to
[email protected]

Signatures

Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4120	powershell.exe
3	4120	powershell.exe
4	4120	powershell.exe
5	4120	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4120	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe
Key opened	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	checkip.dyndns.org
1	reallyfreegeoip.org
4	reallyfreegeoip.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4120	powershell.exe
4120	powershell.exe
4120	powershell.exe
4120	powershell.exe
4120	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4120	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1948	conhost.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 5192	1948	conhost.exe	92
PID 2856 wrote to memory of 4120	2856	conhost.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\18082026 SİPARİŞ ONAYI_xlsx.js"
1⤵
PID:2720

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe
  2⤵
  PID:5192

C:\Windows\system32\wscript.exe
wscript.exe
1⤵
PID:2520

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" --headless "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File "C:\Users\Admin\AppData\Local\Temp\9t6msyj549f\9t6msyj549f.ps1"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoP -EP Bypass -NonInteractive -File C:\Users\Admin\AppData\Local\Temp\9t6msyj549f\9t6msyj549f.ps1
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:4120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9t6msyj549f.ps1

Path C:\Users\Admin\AppData\Local\Temp\9t6msyj549f\9t6msyj549f.ps1
Size 1KB
SHA256 c6608457fcd3c75c446f98aaed615648bb426dd572860c4fb447a14ee47718dd
MD5 1fed3dbbcea95039b7377a6b72c00b86
SHA1 8ad025e665fb6ffd72d33168176fa627d3f11e76
SHA512 daa4986554c9dc869210407e658747fc769e30d49b760fc9cba16d7dc21680a8534adece5b07db335687278850c889ea910e70983dfa14561792ea12b0a6e9c6
TLSH
T1C531F15007E2DFB8018F817BAA636A84D37A0A0F63886F10F78FC4056B4F502B9E535E
MD5 SHA1 SHA512 TLSH

Submit Download

9t6msyj549fa

Path C:\Users\Admin\AppData\Local\Temp\9t6msyj549f\9t6msyj549fa
Size 66KB
SHA256 e831de7a912eb2a1d01e2741b68cbf7c8fc883fcb778d626dc8830810a80daf4
MD5 f93a2bfdd5087525f0a85c90d58f14f7
SHA1 c67366cba8ff00155cb85b6a35ddd314e055d205
SHA512 887268344f608e537424185678f480dac369d085ef151180b2b12a79e2e2c50947640e399d017d9134448ebc9d397d2146c416dd206ba1ce6ff03e583d9c7390
SSDEEP 1536:ZN19I4aGFVbjsyCR6hS/+l07zdfE0akPrCV3gvFBLg94WPlHfC1PNqMpTN:ZRw+VboP6hSW4zJWT3gvFq9nozfp
TLSH
T1CB6302D2C907AEDB26444B120837CF0BA3077C1E9FD912DA6CBE69174CBE8470A77642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9t6msyj549fb

Path C:\Users\Admin\AppData\Local\Temp\9t6msyj549f\9t6msyj549fb
Size 66KB
SHA256 089e3b572583b26b5662072035c883bde71665c8f223589cd292c209205dcc78
MD5 bc3b69c6fa747fef34abbe822e26660b
SHA1 193f5de6757c2b6ddebefea277bc8f9ce46125b7
SHA512 5a5f3cac836b78fd5267d92305cbd1a5405c5d66d7abe302a69b6967bacfa3580d5673f12682dc11f79d4d7cbf1d45137e3bda7ac7ae7d706cd39b14a9ebde19
SSDEEP 1536:TDfpO/2hGZMXjhSJg9e8gUed9AijaOdC36898gYUVIwV6+mor0fe:TDfpO/2UZMXlw88aOdSwRUSWBke
TLSH
T1E3630290EEF62E93E0344896C96E25904EF080B3B5598D475369FC3C64ABAAFF45F1D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4120-5-0x000001C7CBF00000-0x000001C7CBF22000-memory.dmp

Download

memory/4120-9-0x000001C7CBF30000-0x000001C7CBF80000-memory.dmp

Download

memory/4120-10-0x000001C7CBEF0000-0x000001C7CBF02000-memory.dmp

Download

memory/4120-11-0x000001C7CBFC0000-0x000001C7CC008000-memory.dmp

Download

memory/4120-13-0x000001C7CCC30000-0x000001C7CCDF2000-memory.dmp

Download

memory/4120-14-0x000001C7CCAB0000-0x000001C7CCB00000-memory.dmp

Download