Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
05/11/2026, 00:27
General
- Target RFQ-BAZK-A-PR-121611.js
- Size 3.7MB
- Sample261105-ar54aa116n
- SHA256 53a91582b441830289f2fecb415dafd0c749650f9da21362f71ab7b4d2c5289a
Malware Config
Extracted
-
vipkeylogger
-
Protocol
smtp
-
Host
mail.trimnt.com
-
Port
587
-
Username
-
Password
^R_{p(V_[a9=UuY)
-
Email to
Signatures
- Family: VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 4 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Looks up external IP address via web service 1 TTPs 20 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 3 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\RFQ-BAZK-A-PR-121611.js1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo. > "C:\Users\Admin\AppData\Local\Temp\RFQ-BAZK-A-PR-121611.js:Zone.Identifier"2⤵
- Executes a command shell one-liner
- NTFS ADS
-
-
C:\Users\Admin\Documents\CUSFSYWNZNBTAVKY.exe"C:\Users\Admin\Documents\CUSFSYWNZNBTAVKY.exe" C:\Users\Admin\Documents\YKVATBNZNWYSFSUC2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Documents\YKVATBNZNWYSFSUC.vbs"1⤵
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\CUSFSYWNZNBTAVKY.exe"C:\Users\Admin\Documents\CUSFSYWNZNBTAVKY.exe" "C:\Users\Admin\Documents\YKVATBNZNWYSFSUC"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe3⤵
- Accesses Microsoft Outlook profiles
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1Visual Basic
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
CUSFSYWNZNBTAVKY.exe
CUSFSYWNZNBTAVKY.mui
VCRUNTIME140.dll
YKVATBNZNWYSFSUC
YKVATBNZNWYSFSUC.vbs
libluajit.dll
memory/1100-24-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-30-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-26-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-25-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-20-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-19-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-31-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-21-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-29-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-28-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-27-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-33-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-34-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-32-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-35-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/1100-18-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5308-39-0x0000000005090000-0x000000000512C000-memory.dmp
memory/5308-38-0x00000000055B0000-0x0000000005B6A000-memory.dmp
memory/5308-37-0x0000000074222000-0x0000000074223000-memory.dmp
memory/5308-36-0x0000000000400000-0x0000000000440000-memory.dmp
memory/5308-41-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/5308-67-0x00000000063C0000-0x00000000063CA000-memory.dmp
memory/5308-66-0x0000000006640000-0x00000000066D2000-memory.dmp
memory/5308-65-0x0000000006260000-0x00000000062B0000-memory.dmp
memory/5308-64-0x00000000063D0000-0x0000000006592000-memory.dmp
memory/5308-63-0x0000000074210000-0x00000000749CC000-memory.dmp
memory/5308-62-0x0000000074222000-0x0000000074223000-memory.dmp
memory/5844-59-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-50-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-53-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-57-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-55-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-52-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-51-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-58-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-49-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-60-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-56-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-54-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-48-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-47-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-45-0x00007FFD88880000-0x00007FFD88890000-memory.dmp
memory/5844-46-0x00007FFD88880000-0x00007FFD88890000-memory.dmp