Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
09/10/2026, 14:58
General
- Target PO_PRD_0035963 PDF.JS.js
- Size 3.7MB
- Sample261009-sca9gabe79
- SHA256 9541c2a21f0f1e5386309958e2060c3b5df15fd8da3f1d52dcce32f2a012e80b
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
hosting2.ro.hostsailor.com
-
Port
587
-
Username
-
Password
7213575aceACE@@
-
Email to
Signatures
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Executes dropped EXE 1 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 TTPs 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\PO_PRD_0035963 PDF.JS.js"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\ZPGDFBNGMDXGVBAQ.exe"C:\Users\Admin\Documents\ZPGDFBNGMDXGVBAQ.exe" C:\Users\Admin\Documents\QABVGXDMGNBFDGPZ2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
QABVGXDMGNBFDGPZ
ZPGDFBNGMDXGVBAQ.exe
memory/3104-9-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-21-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-29-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-72-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-71-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-70-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-69-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-68-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-67-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-66-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-65-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-64-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-63-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-62-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-61-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-60-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-59-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-58-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-57-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-56-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-55-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-54-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-53-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-52-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-51-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-50-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-49-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-47-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-46-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-45-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-44-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-43-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-42-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-41-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-40-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-39-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-36-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-35-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-34-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-33-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-32-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-31-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-30-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-28-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-27-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-26-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-25-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-24-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-23-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-22-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-20-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-18-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-17-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-16-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-14-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-12-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-48-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-38-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-37-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-19-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-15-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-13-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-11-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-10-0x000000007FE90000-0x000000007FEA0000-memory.dmp
memory/3104-1317-0x0000000074862000-0x0000000074863000-memory.dmp
memory/3104-1318-0x0000000004280000-0x00000000042C8000-memory.dmp
memory/3104-1319-0x0000000074850000-0x000000007500C000-memory.dmp
memory/3104-1320-0x000000002A460000-0x000000002AA1A000-memory.dmp
memory/3104-1321-0x0000000004330000-0x00000000043CC000-memory.dmp
memory/3104-1322-0x0000000074850000-0x000000007500C000-memory.dmp
memory/3104-1323-0x0000000074850000-0x000000007500C000-memory.dmp
memory/3104-1324-0x0000000074850000-0x000000007500C000-memory.dmp
memory/3104-1326-0x0000000074862000-0x0000000074863000-memory.dmp
memory/3104-1327-0x0000000074850000-0x000000007500C000-memory.dmp
memory/3104-1328-0x0000000074850000-0x000000007500C000-memory.dmp
memory/3104-1329-0x000000002B7A0000-0x000000002B962000-memory.dmp
memory/3104-1330-0x000000002B9B0000-0x000000002BA00000-memory.dmp
memory/3104-1334-0x000000002BA80000-0x000000002BB12000-memory.dmp
memory/3104-1335-0x000000002BBA0000-0x000000002BBAA000-memory.dmp