4599f5d504c127f7e2ee391f06725461b9b761492c72ac2eb98f2429f04ef5c1

Analysis

max time kernel
1s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11-02-2023 02:29

Target

vlc-3.0.16-win32.exe
Size

39.5MB
MD5

1bed0a495133dd4d6c9efaf7e71f8ef3
SHA1

a51a1d258b5cbcc93916b5eeb0d530f4b3bd94df
SHA256

4599f5d504c127f7e2ee391f06725461b9b761492c72ac2eb98f2429f04ef5c1
SHA512

837b68de2f66e91fba29c394e4c2e4b91d735e5f9433178e95d6dda50d6f49b5d9dae43832f331e8db40b3e24b876daa8a0303d8d9cd9a6d55e758fa644b3b05
SSDEEP

786432:6/nK0CES7y1AT0JtGJSe1mSxFiOAlUrkku2ekYycaUbAV72Fb6XOSNpeeWZfKOSb:6fK0U8TA0SXFiyrkku2BYyX378b6FNEs

Score

7^/10

Loads dropped DLL 2 IoCs

pid	Process
840	vlc-3.0.16-win32.exe
840	vlc-3.0.16-win32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\vlc-3.0.16-win32.exe
"C:\Users\Admin\AppData\Local\Temp\vlc-3.0.16-win32.exe"
1⤵
- Loads dropped DLL
PID:840

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nst2E25.tmp\LangDLL.dll

Filesize
7KB

MD5
20850d4d5416fbfd6a02e8a120f360fc

SHA1
ac34f3a34aaa4a21efd6a32bc93102639170e219

SHA256
860b409b065b747aab2a9937f02d08b6fd7309993b50d8e4b53983c8c2b56b61

SHA512
c8048b9ae0ced72a384c5ab781083a76b96ae08d5c8a5c7797f75a7e54e9cd9192349f185ee88c9cf0514fc8d59e37e01d88b9c8106321c0581659ebe1d1c276

Download Submit
\Users\Admin\AppData\Local\Temp\nst2E25.tmp\System.dll

Filesize
26KB

MD5
4f25d99bf1375fe5e61b037b2616695d

SHA1
958fad0e54df0736ddab28ff6cb93e6ed580c862

SHA256
803931797d95777248dee4f2a563aed51fe931d2dd28faec507c69ed0f26f647

SHA512
96a8446f322cd62377a93d2088c0ce06087da27ef95a391e02c505fb4eb1d00419143d67d89494c2ef6f57ae2fd7f049c86e00858d1b193ec6dde4d0fe0e3130

Download Submit
memory/840-54-0x0000000076561000-0x0000000076563000-memory.dmp

Filesize
8KB

Download