vipkeylogger | 9f0f9d81aebe0635e801279c32936387dcce71a3791fe9c4e2c8e4e7083309dc

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 08:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ekstre_2310.vbs
Size 179KB
Sample261024-kp29qaax5m
SHA256 9f0f9d81aebe0635e801279c32936387dcce71a3791fe9c4e2c8e4e7083309dc
MD5 c2df14a9c35503854fcaa142c8bf5158
SHA1 73a31db9cb54ee7b5be04f608d85e329e122a6ab
SHA512 44dedb9a4f87d09061c2b4922ea2f483f9aec885196d707fbaced83d4b34da0e44943b22e05887b410f5c3feebde6a10615ae4f4f0fb11ba2dcd64354446467e
SSDEEP 3072:K4THeifMqHmlDihAEm8PfoxZedQAtnrna0TbujUTBq3B00CjIqfC1+NyXgOaJF:/fMrV4Ap4gruaWuYdq3BwkeC14tb
TLSH
T1C40402F465443D93AEBF5A6ACD5AE41F47702222571AF9843C6F16860773BB3CF89808
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution vipkeylogger keylogger stealer

Malware Config

Extracted

Family

vipkeylogger

Credentials

Protocol
smtp
Host
mail.merchantinvestnetwork.com
Port
587
Username
[email protected]
Password
2)D?sbbRb+m_{l8%
Email to
[email protected]

Signatures

Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
stealer keylogger vipkeylogger

Executes dropped EXE 1 IoCs

pid	Process
4000	engine.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4376	certutil.exe
3512	certutil.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs

execution

Visual Basic

T1059.005

pid	Process
5068	WScript.exe
2152	wscript.exe
1836	wscript.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4000 set thread context of 3432	4000	engine.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2152	5068	WScript.exe	90
PID 2152 wrote to memory of 1836	2152	wscript.exe	91
PID 1836 wrote to memory of 4376	1836	wscript.exe	92
PID 1836 wrote to memory of 3512	1836	wscript.exe	94
PID 1836 wrote to memory of 4000	1836	wscript.exe	96
PID 4000 wrote to memory of 3432	4000	engine.exe	97
PID 4000 wrote to memory of 3432	4000	engine.exe	97
PID 4000 wrote to memory of 3432	4000	engine.exe	97
PID 4000 wrote to memory of 3432	4000	engine.exe	97

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Ekstre_2310.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //nologo //e:vbscript "C:\Users\Admin\AppData\Local\Temp\zyeh93dk.dat" "C:\Users\Admin\AppData\Local\Temp\Ekstre_2310.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:2152
- - C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" //e:jscript "C:\Users\Admin\AppData\Local\Temp\cfg_19175.tmp" "C:\Users\Admin\AppData\Local\Temp\Ekstre_2310.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Windows\System32\certutil.exe
      "C:\Windows\System32\certutil.exe" -f -decode "C:\Users\Admin\AppData\Local\Temp\radC96DB.tmp\engine.exe.b64" "C:\Users\Admin\AppData\Local\Temp\radC96DB.tmp\engine.exe"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:4376
  - - C:\Windows\System32\certutil.exe
      "C:\Windows\System32\certutil.exe" -f -decode "C:\Users\Admin\AppData\Local\Temp\radC96DB.tmp\config.bin.b64" "C:\Users\Admin\AppData\Local\Temp\radC96DB.tmp\config.bin"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\radC96DB.tmp\engine.exe
      "C:\Users\Admin\AppData\Local\Temp\radC96DB.tmp\engine.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4000
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
        5⤵
        
        PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cfg_19175.tmp

Path C:\Users\Admin\AppData\Local\Temp\cfg_19175.tmp
Size 9KB
SHA256 5aff1cb9941be00f44dd74a001f099ab435c79eed4b9c4bc41a97b3cef8be444
MD5 972ed7332c8ebd0755a4096ab31050a9
SHA1 e8917d5c36a8b40f1842644494da4ab67e63fb1c
SHA512 90ece721d27c0d63d56b96d4d53b3b35c33b60b55ea4a75e7dc416ce2dd2dff15015c054e9f7055804200616193d9a6e0770fac6892c36b449e373b2b198d304
SSDEEP 192:SxmE/cVSQRBlYCcLQtESzZuxLUa00iQWQ1+U6ruxb2OQVNiPNCQPijCQlQrkUp:8muiSklYw2t402f0CQECQUp
TLSH
T106227444DFD313A9662A487C0F1F4054B4F58557296CC5C8B8ADE9926F23F2622FCAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.bin

Path C:\Users\Admin\AppData\Local\Temp\radC96DB.tmp\config.bin
Size 72KB
SHA256 7d7cfd704e7b397e58605f31a11af81ffd74d39df2cf9519abcc8e67b87dae24
MD5 be94b3d28ef0cdeb0042aa89fe0731ae
SHA1 bbddc33a024b9d9580af578290dece48185ab56d
SHA512 e3cdd454db5e01010f5363fc2ac390ce13090e425bc6b9c936749170625c1eb592e43841470834d74052645e9bd0870022b59e7b1099a04dd90c19264776bf99
SSDEEP 1536:fFRR7AxG66GvuFDE5Q+6r3CXIui2whOK0ef/Gk/PaoCx4oGN98xlg9f:DR7Aj6TDE5T6rCXIui2w/vd6HajNylAf
TLSH
T14A7302343D772AAF1D6CBFDD0275B45695DA24A80A3000E2A1756AEB8C1B79A1C2A437
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.bin.b64

Path C:\Users\Admin\AppData\Local\Temp\radC96DB.tmp\config.bin.b64
Size 97KB
SHA256 99909be6cc31b8c4c5c7da8b2797749ce9426af40d17c87767f326395e0e3be7
MD5 407a3aef4c21c3a84d41204712a77857
SHA1 23c834185ec4c364763059154c98e29ff0ac66bf
SHA512 cbb7477128d9d26a7e3d970f373cf09bbfffa08d742a7a9b6cb1b8aad366286dd554ee7db85e23ff327d719b839a76d3fb40f72c7fa68f36f0e6cb873348d435
SSDEEP 1536:pzkDyTKVuuT2UU/CQHX8wEzw8EIlQNNSMzpi5rDWQGUKiLhhu0qmMl+LwR:drT672haQHXGVENNrlArDH/19KkwR
TLSH
T117A312F768987721977C9807E0A69DF80486EECDEE6A11400A60F87E255D6F3D83F54C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

engine.exe

Path C:\Users\Admin\AppData\Local\Temp\radC96DB.tmp\engine.exe
Size 19KB
SHA256 86f8ae56689597abb8d8b4e239e6543c0d1d53f442db7c35bb1b9a0ded333852
MD5 9537414221ac00d465f1a867d6b15d24
SHA1 d7dc2f3a94080a5abffef3e68b0ed747c62804ba
SHA512 49c214a47360d9d42665b0b0266d77ec6344e9bbcf7d9355e01a1b7f51b08ceb96e485f85f0843dfc043e24ec646951a4957731d29e49c26dd972f287818823d
SSDEEP 192:aQlCCCChE/V9CWBzNoZibViw3eVhgYmK7hReOuk024drC1IAVARNN2ZC+:aOCCCChcPPvZd3eLTm22ljAVAn0
TLSH
T1F492867583CE8279C2EFA4F52FF695EA3475B0B950A0710611B09FB52E369F0E82435D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

engine.exe.b64

Path C:\Users\Admin\AppData\Local\Temp\radC96DB.tmp\engine.exe.b64
Size 26KB
SHA256 768678706b48eebfdbb7b9ffdbbba6c0282ac96fdad7a0b1ff5e0b65881db8d9
MD5 a08fe4f7c191a8965fd6ba79b86625c9
SHA1 1e37d1a10d7ca4ae6780d210681ecb29f6efd46b
SHA512 f8998a9e25de6a3ff5ffb3986570b4a5e86570862bfe72fb08008fce812147b752b73571dc109ec259b66085513138a2a99dd4cbb1c8507da8ee38fdd70e200c
SSDEEP 384:pR8djPWo+7pmgyulR8DLrybYSPlw2bRbjpBueksu/CZCTLwwvSeaRwqeYt:X8PWokxRHcSPlw2bRbjp0t/82Q5
TLSH
T13BC20AFA41563CC11E645FA8D8642C600F78DF932D2A8315EBC486AD93B27B4CE58DA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zyeh93dk.dat

Path C:\Users\Admin\AppData\Local\Temp\zyeh93dk.dat
Size 25KB
SHA256 8f1cb35077ccac883d6fdf936d121e54a7382581cc14be629cda579cd95c736e
MD5 e1b5fe67df85fc928c8ccfdd7cd4ca07
SHA1 511e54bd81d233eebeaf4e56c55e5554302dc4af
SHA512 aa8774d6ee20537c7cc9782fc5cbfcd118815693e037205cb11299b8adcaa14b522c649cd13bd0db4efb35aa8b1391b8ccba16d5d4fca8e5da4be118c8a2a142
SSDEEP 384:RAtPv3uWrjvNfZtPnF7MUPc/b9dBSc90BkdsavKI+Ve8i4EtQG8KWI1Jfl6U+:M33uWrjTO9dB22dsckEtL8Kj1E
TLSH
T15CC229121A0923759CBAD3AA58DF080FEC647887ED2B18D0760C47DC2F3D095F799AB1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3432-19-0x0000000140000000-0x000000014003C000-memory.dmp

Download

memory/4000-18-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/4000-20-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/4000-13-0x0000000000570000-0x0000000000571000-memory.dmp

Download

memory/4000-16-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/4000-15-0x0000000000590000-0x0000000000591000-memory.dmp

Download

memory/4000-14-0x0000000000580000-0x0000000000581000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads