Analysis
- max time kernel
2s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
06/10/2026, 08:53
General
- Target secured_stub.ps1
- Size 1.2MB
- Sample261006-ktnbcsvcph
- SHA256 6c75d9c69a97d1bee2c6802c9dd7bb652e76e58a8e01a4fec25120a5c78c2845
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
hosting2.ro.hostsailor.com
-
Port
587
-
Username
-
Password
7213575aceACE@@#
-
Email to
-
https://api.telegram.org/bot8099843793:AAGeYKMLti1IpyT9o6bz7OtgdXF9md25uXA/sendMessage?chat_id=6337180137
Signatures
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\secured_stub.ps11⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4320-20-0x0000000000400000-0x0000000000448000-memory.dmp
memory/4320-34-0x00000000063D0000-0x00000000063DA000-memory.dmp
memory/4320-33-0x0000000006600000-0x0000000006692000-memory.dmp
memory/4320-32-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/4320-31-0x0000000074F82000-0x0000000074F83000-memory.dmp
memory/4320-30-0x00000000062D0000-0x0000000006320000-memory.dmp
memory/4320-29-0x0000000006430000-0x00000000065F2000-memory.dmp
memory/4320-25-0x0000000074F70000-0x000000007572C000-memory.dmp
memory/4320-23-0x00000000050F0000-0x000000000518C000-memory.dmp
memory/4320-22-0x0000000005610000-0x0000000005BCA000-memory.dmp
memory/4320-21-0x0000000074F82000-0x0000000074F83000-memory.dmp
memory/4740-18-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-24-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-15-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-16-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-17-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-0-0x00007FFD5B52F000-0x00007FFD5B530000-memory.dmp
memory/4740-19-0x0000018A25090000-0x0000018A250A8000-memory.dmp
memory/4740-13-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-12-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-11-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-10-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-14-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-9-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-26-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-27-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-8-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-7-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-6-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-5-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-4-0x00007FFD5B3A0000-0x00007FFD5BD44000-memory.dmp
memory/4740-3-0x0000018A25000000-0x0000018A25022000-memory.dmp