vipkeylogger | e809e1d8165c6bcf6a828badb965825f431399cc92957bcdbbb20e78dcc5f3db

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SDS0987654678.js
Size 1.4MB
Sample260910-t8px6sej9v
SHA256 e809e1d8165c6bcf6a828badb965825f431399cc92957bcdbbb20e78dcc5f3db
MD5 0a685e976e4f0aa73bf5a441e7193c75
SHA1 192ff86ce6182166fe956ad10de942541d386a4d
SHA512 d7b5dcfed25f3845871397f5232cbda6187fbf9aec78247c3ca88b5e288168209e2591daa3c284519f9ca422571991b0d704e008af6de1fd8017fea9a3d62c7e
SSDEEP 24576:2J6RRuYRM/siotExGAYjJNHU1L4ti4ar7AwtMqE:2J6RRuYRM/siotExGAYjJNTUW
TLSH
T15965322DBA3DB0588C8D3526A22567B1C44A5EBF23775BCB2C10FF91A642C719CB2717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution vipkeylogger keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
mail.algmimari.com
Port
587
Username
[email protected]
Password
Alg214721.
Email to
[email protected]

Signatures

Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4412	powershell.exe
21	4412	powershell.exe
42	4412	powershell.exe
58	4412	powershell.exe
64	4412	powershell.exe
71	4412	powershell.exe
76	4412	powershell.exe
81	4412	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4412	powershell.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
3	checkip.dyndns.org
70	checkip.dyndns.org

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4412	powershell.exe
4412	powershell.exe
4412	powershell.exe
4412	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4412	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4412	3552	wscript.exe	85
PID 4412 wrote to memory of 4040	4412	powershell.exe	87
PID 4040 wrote to memory of 4100	4040	csc.exe	88

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\SDS0987654678.js
1⤵
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command -
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wkrwbgpj\wkrwbgpj.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES171D.tmp" "c:\Users\Admin\AppData\Local\Temp\wkrwbgpj\CSC6E26CDEE610B460E906EFD6AEA53CD67.TMP"
      4⤵
      PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES171D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES171D.tmp
Size 1KB
SHA256 a9f7c5c062bf54510d7f99f8fde908645002d3610f5b8c8cd48f44c1fae42f37
MD5 a6fb5904854c6fe9efacf69d99e4916a
SHA1 0e3718126eec474b4c3cc32489f5ac201aedbf7a
SHA512 f80d4f9d44652a3a895608a628918c5b5345eedf6d77def5134e04e2891935cf946b0aa9d7788441a3fe7cb43c5619c9bf55a69b38048ae535b820da664febf6
TLSH
T1EE218C0593E8471EF0775731A9FA176FA224FD64AF61979B9540462C1C51104EEE0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_s3z4bqps.ycy.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s3z4bqps.ycy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

detachEvent.ini

Path C:\Users\Admin\AppData\Local\Temp\detachEvent.ini
Size 267KB
SHA256 bfd2a46009b553886c2889fb89979257b130bc9f378a3418f8bfc56af10d3feb
MD5 2e3f079803f1ff38b60d895ea2836ace
SHA1 1d0731b98a24a37c478a0a536bd5b7fa68339ff4
SHA512 551a20189f2bffe778f6d21fc227df190d8c6620d9042b76c290e2a61db816cdb229f646a85a7ba88da2cc5b43d26376660043b05b244c6c11d7c7239099732f
SSDEEP 6144:MfnO+dNuYE2SIhyrwiJ6R89nz4R7hivk+nhl1kioys0lLODZXhL9/ff4taBkVvdJ:MfnddNuYrSIhyrwiJ6R89nz4R7hivk+X
TLSH
T132440888A7A974069B41430B427C6F795EA69CBDF2794FB73CCBF1008213BD92E78195
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wkrwbgpj.dll

Path C:\Users\Admin\AppData\Local\Temp\wkrwbgpj\wkrwbgpj.dll
Size 3KB
SHA256 17ca9600fa4ef044773b8aab069011d09794829b81914f522cd457b329b11ee3
MD5 858a3f5deb772c74c273ad44ae01c57d
SHA1 a645541282c05d19073bfec538ddb2e76b02922e
SHA512 b4326a673e63d47b54d1cc8b27d8d2f602d10eb7e5849a52b23c8722ae701595077ae4720d8ada4aabce6a71d2668625f7e6f1449da8732dd5b3edf7b58fe5eb
TLSH
T10751FD0753E8466BE07747306EF3076A37B8F8609B73675E29804218ACA43545E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6E26CDEE610B460E906EFD6AEA53CD67.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wkrwbgpj\CSC6E26CDEE610B460E906EFD6AEA53CD67.TMP
Size 652B
SHA256 8b672b830ece925dbb2079cf81caec519a4fc0d8467bbd3e226c10d59f42bf13
MD5 792ccfe71c6af7b412bee37d96952891
SHA1 765e006e7fcd14bdef6de23b23cbdb3f0340f3f9
SHA512 db3a2407cbc140d12d867973c14602b7cb00a4327f9348e7df4cb46099d7d1b38186dbeeae0f70c4e5f3eebf15030dc276abf6bd4ef5cda876321c11867ca41e
TLSH
T19FF05E0A63F8020EF0F38B31BEF653A795A8BC64DE3293ED2440471968645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

wkrwbgpj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wkrwbgpj\wkrwbgpj.0.cs
Size 289B
SHA256 7ee9d28157a75f52944339ae6f9c7a6bab7e384c5a036943ca274114d3173619
MD5 63cbdf00d92216d02730ebff7e7d81ef
SHA1 46ab537107ea231124c8e48ab851c93d6c2312ea
SHA512 29474df6888f6b774117f07df4ab348feaffa8edd3151ab5fb63ddb75394089d5db97517d1501a3493d6f43109d606d35bbc107b4b7ef514a734f90eeee33f9e
TLSH
T1C3D0CD146AF2FAB0402384164C87D1BDB7079037266A150077B50310EF4B0094135656
MD5 SHA1 SHA512 TLSH

Submit Download

wkrwbgpj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wkrwbgpj\wkrwbgpj.cmdline
Size 369B
SHA256 92bedcbdb543e3b4b7ee490b96dd4999afad050e3de241fbcf5b81bed6796a3d
MD5 97ad8125967b51c7b287a656aba7e34b
SHA1 c430dca2573d33f5f5f07111187ef0a67b57bbec
SHA512 9c63026df8138606d771b8538977621eefac9324f0ab0eed1067cec40ea5aba8573544b52500b8fea508514e7b92e3cf52c46b189b830d13cb82ede07514498e
TLSH
T112E0686A8246C2BD11E91007316ED8FCC67246432A40BF847161485ED01F1023BD1742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4412-2-0x000001DDC09E0000-0x000001DDC09F0000-memory.dmp

Download

memory/4412-3-0x000001DDD95A0000-0x000001DDD95C2000-memory.dmp

Download

memory/4412-23-0x000001DDD95F0000-0x000001DDD95F8000-memory.dmp

Download

memory/4412-1-0x000001DDC09E0000-0x000001DDC09F0000-memory.dmp

Download

memory/4412-25-0x000001DDD9CD0000-0x000001DDD9D18000-memory.dmp

Download

memory/4412-27-0x000001DDC09E0000-0x000001DDC09F0000-memory.dmp

Download

memory/4412-26-0x000001DDC09E0000-0x000001DDC09F0000-memory.dmp

Download