vipkeylogger | 6c54e6c85843578982b95ac6b4d33b5f71b3fc2aa775581b46c1f711feeb61ed

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Request for Quote PR No 164.js
Size 1.4MB
Sample260907-kppcvsfh45
SHA256 6c54e6c85843578982b95ac6b4d33b5f71b3fc2aa775581b46c1f711feeb61ed
MD5 3176c2768cfd9bb998184526528a31c7
SHA1 79b355b8df0ef69906d21791aa3a1f23786eea60
SHA512 6db6234de241edb7408ee2bf2a0c1ac5aed404f0657be3bf6081f518e7228d7a9824f3cb585e28524db00136eca3edf1479c91090e25ec5dca6f99c95f6302c0
SSDEEP 24576:OJ6RRuYRM/siotExGAYjJNHSnPrL0xlaJO2/at+qb:OJ6RRuYRM/siotExGAYjJNkrYqs
TLSH
T1CE65194F063C233B9FAE03711469C24553E88AD8E8B69F5C252CE1B49D74E1F26A56FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution vipkeylogger keylogger persistence stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
cphost17.qhoster.net
Port
587
Username
[email protected]
Password
Qwerty!@#
Email to
[email protected]

Signatures

Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4216	powershell.exe
13	4216	powershell.exe
36	4216	powershell.exe
42	4216	powershell.exe
48	4216	powershell.exe
56	4216	powershell.exe
67	4216	powershell.exe
74	4216	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4216	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	wscript.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
5	checkip.dyndns.org

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1068	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4216	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 1068	4792	wscript.exe	86
PID 1068 wrote to memory of 1080	1068	cmd.exe	88
PID 4792 wrote to memory of 4216	4792	wscript.exe	89
PID 4216 wrote to memory of 3316	4216	powershell.exe	91
PID 3316 wrote to memory of 1536	3316	csc.exe	92

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Request for Quote PR No 164.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 15 /tn Request for Quote PR No 164.js /tr C:\Users\Admin\Pictures\Request for Quote PR No 164.js /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc minute /mo 15 /tn Request for Quote PR No 164.js /tr C:\Users\Admin\Pictures\Request for Quote PR No 164.js /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command -
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wxet5eso\wxet5eso.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3EAA.tmp" "c:\Users\Admin\AppData\Local\Temp\wxet5eso\CSC1E28AC2DB21041E1844351DF1E9D69A3.TMP"
      4⤵
      PID:1536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3EAA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3EAA.tmp
Size 1KB
SHA256 ce06802ec0cc89bbdf3d5d2d2a3951c3214286c7e3f85d0e470cd43b0eb83f48
MD5 eaa1895be22937af3e068185a8b912f7
SHA1 cda0328a8cfd0ede6762e6617eac2e9abcb83241
SHA512 e76c6d1d39fd1c97badb7f2467eab7b6f9113c53e8c87f15376ad5879aba36a146de2c3caaf891ec0cacaa5330bdb1e8aa20711f4bf278f826f26c1f16a88fb6
TLSH
T1B321890587E9471EF0730732A9FA132FA238FD54EFA2979A8540522C1C91604EEB0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_o2vtgfju.yfb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o2vtgfju.yfb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

detachEvent.ini

Path C:\Users\Admin\AppData\Local\Temp\detachEvent.ini
Size 269KB
SHA256 be7f143272b80367bd2544784b0d8c532ce761b4ead658b406ba362d7777e2ed
MD5 e68a2d2ab7f1d682e666bdb8da6dad63
SHA1 9ef25712abd6d6c05751644c498c69bb007c34fe
SHA512 b803c9e6f311c8194d60cc1fe9ccf395a71fea13bc2920694bdf4428f0b70c7e86260eaf4b8077f93627b9930d31572a20afc0a8f8c661fa93a8047d60c24a50
SSDEEP 6144:TFIZmOawkFZZqruYM1sdEALPwfzsziyHrGo9VLvVaWoWbbKJp6S0cS3+EJ2eH2Ia:yZmOawkPsdM1sdEALPwfzsziyHrGo9Vy
TLSH
T1F0440A4917B6B8079B44438B41786F6A9EE5DABCE8B98F3A78C7F0004113BDD2E351E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wxet5eso.dll

Path C:\Users\Admin\AppData\Local\Temp\wxet5eso\wxet5eso.dll
Size 3KB
SHA256 09984ef12f4eb23fd114cd02c5e7746de8cba3003525a7753125488e3c1b4be4
MD5 056411668835cdcedc601f2c397da4d5
SHA1 134ede0f51b94d71b7c79fd07a84ef2e53e323b8
SHA512 41cc888a300492058812beae539147d49d5cb5a0fb60f63584d4d675b558a06ccedcaffe739a07b92d5d290d6989fe6487bdbc65434deb37c35bf0d56098a210
TLSH
T18751DD07A7E9462BE4770B34ADF3471677B8F8549F73575E4880021CACA53645E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1E28AC2DB21041E1844351DF1E9D69A3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wxet5eso\CSC1E28AC2DB21041E1844351DF1E9D69A3.TMP
Size 652B
SHA256 8db7a7472787ee1eb5d2949106da127db4fa45448e43ddc786f8964dacbd7258
MD5 2c2d00205f14117abfd501b6119b8dd2
SHA1 f616923f211239bb565853a09666314a23891cd5
SHA512 cbf8c0d90bc14490acbfd8c3ed33e8217e3080fae575223b4d14f677262378198db315b9e29bb660c99eacf8ff61e4e0935a01dd3b694387962ef447f140f326
TLSH
T1F2F0580A63F8020EF0F34B31BDF643A7A1A9BC64DE3293ED1880031D28645108A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

wxet5eso.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wxet5eso\wxet5eso.0.cs
Size 289B
SHA256 7ee9d28157a75f52944339ae6f9c7a6bab7e384c5a036943ca274114d3173619
MD5 63cbdf00d92216d02730ebff7e7d81ef
SHA1 46ab537107ea231124c8e48ab851c93d6c2312ea
SHA512 29474df6888f6b774117f07df4ab348feaffa8edd3151ab5fb63ddb75394089d5db97517d1501a3493d6f43109d606d35bbc107b4b7ef514a734f90eeee33f9e
TLSH
T1C3D0CD146AF2FAB0402384164C87D1BDB7079037266A150077B50310EF4B0094135656
MD5 SHA1 SHA512 TLSH

Submit Download

wxet5eso.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wxet5eso\wxet5eso.cmdline
Size 369B
SHA256 0d334b92414a3e15179b1f1cf3490f3a6f111d913ba10c8764c4cb5f1f86fab2
MD5 9742eb4cf34c4010f7ff814b932d7b84
SHA1 ade50ced7f6a3409bfcf121d363076e36d6e73bb
SHA512 932f0898e49ba6b18df2208d6cb9550b50291a0ee8c8617458d43aaa44d95e85cbcd1c1e4e6f2c32e19aeaa7a0dc59504a664f34d845573eeec2583990d22228
TLSH
T1B2E0202BEB57C67D15DD20072AF9C6FCD272474729427F94D150445DD02B30867D1795
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4216-3-0x00000173C2630000-0x00000173C2640000-memory.dmp

Download

memory/4216-11-0x00000173DCA00000-0x00000173DCA22000-memory.dmp

Download

memory/4216-24-0x00000173DC9F0000-0x00000173DC9F8000-memory.dmp

Download

memory/4216-2-0x00000173C2630000-0x00000173C2640000-memory.dmp

Download

memory/4216-26-0x00000173DCBE0000-0x00000173DCC28000-memory.dmp

Download

memory/4216-27-0x00000173C2630000-0x00000173C2640000-memory.dmp

Download

memory/4216-28-0x00000173C2630000-0x00000173C2640000-memory.dmp

Download

memory/4216-29-0x00000173DCA30000-0x00000173DCB7E000-memory.dmp

Download

memory/4216-40-0x00000173DCA30000-0x00000173DCB7E000-memory.dmp

Download