Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 21:56
General
- Target gQIEXXQqBL1xisG0ZScug8J7zKz11EAVa-ywmWXRTJI.js
- Size 2.3MB
- Sample260916-1tpgeseg46
- SHA256 8102045d742a04bd718ac1b465272e83c27bccacf5d440156bfcb09965d14c92
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
hosting2.ro.hostsailor.com
-
Port
587
-
Username
-
Password
7213575aceACE@@
-
Email to
Signatures
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
- Suspicious use of SetThreadContext 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 34 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\gQIEXXQqBL1xisG0ZScug8J7zKz11EAVa-ywmWXRTJI.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_seI9HH2BmyA7_1789595813078.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im wscript.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ps_seI9HH2BmyA7_1789595813078.ps1
memory/2412-21-0x000001401AEE0000-0x000001401B2FE000-memory.dmp
memory/2412-50-0x000001401AEE0000-0x000001401B2FE000-memory.dmp
memory/2412-48-0x000001401AEE0000-0x000001401B2FE000-memory.dmp
memory/2412-45-0x000001401AEE0000-0x000001401B2FE000-memory.dmp
memory/2412-44-0x000001401AEE0000-0x000001401B2FE000-memory.dmp
memory/2412-43-0x000001401AEE0000-0x000001401B2FE000-memory.dmp
memory/2412-42-0x000001401AEE0000-0x000001401B2FE000-memory.dmp
memory/2412-41-0x000001401AEE0000-0x000001401B2FE000-memory.dmp
memory/2412-40-0x000001401AEE0000-0x000001401B2FE000-memory.dmp
memory/2412-37-0x000001401AEE0000-0x000001401B2FE000-memory.dmp
memory/2412-33-0x000001401AEE0000-0x000001401B2FE000-memory.dmp
memory/3232-14-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-1-0x00007FF81093F000-0x00007FF810940000-memory.dmp
memory/3232-17-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-18-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-19-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-20-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-15-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-22-0x000001776FC20000-0x000001776FC34000-memory.dmp
memory/3232-23-0x00000177700A0000-0x00000177700A6000-memory.dmp
memory/3232-25-0x00000177700F0000-0x0000017770104000-memory.dmp
memory/3232-4-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-27-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-49-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-5-0x000001776FBB0000-0x000001776FBD2000-memory.dmp
memory/3232-6-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-31-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-32-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-16-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-7-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-9-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-10-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-13-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-11-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/3232-12-0x00007FF8107B0000-0x00007FF811154000-memory.dmp
memory/4040-39-0x0000000006660000-0x000000000666A000-memory.dmp
memory/4040-38-0x00000000068D0000-0x0000000006962000-memory.dmp
memory/4040-36-0x0000000074342000-0x0000000074343000-memory.dmp
memory/4040-35-0x0000000006580000-0x00000000065D0000-memory.dmp
memory/4040-34-0x0000000006700000-0x00000000068C2000-memory.dmp
memory/4040-30-0x00000000053B0000-0x000000000544C000-memory.dmp
memory/4040-29-0x0000000005970000-0x0000000005F2A000-memory.dmp
memory/4040-28-0x0000000074342000-0x0000000074343000-memory.dmp
memory/4040-26-0x0000000000400000-0x0000000000448000-memory.dmp