4599f5d504c127f7e2ee391f06725461b9b761492c72ac2eb98f2429f04ef5c1

Resubmissions

12-02-2023 21:59

230212-1wfx3agh39 7

Analysis

max time kernel
210s
max time network
219s
platform
windows10-2004_x64
resource
win10v2004-20221111-es
resource tags

arch:x64arch:x86image:win10v2004-20221111-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
12-02-2023 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vlc-3.0.16-win32.exe
Size

39.5MB
MD5

1bed0a495133dd4d6c9efaf7e71f8ef3
SHA1

a51a1d258b5cbcc93916b5eeb0d530f4b3bd94df
SHA256

4599f5d504c127f7e2ee391f06725461b9b761492c72ac2eb98f2429f04ef5c1
SHA512

837b68de2f66e91fba29c394e4c2e4b91d735e5f9433178e95d6dda50d6f49b5d9dae43832f331e8db40b3e24b876daa8a0303d8d9cd9a6d55e758fa644b3b05
SSDEEP

786432:6/nK0CES7y1AT0JtGJSe1mSxFiOAlUrkku2ekYycaUbAV72Fb6XOSNpeeWZfKOSb:6fK0U8TA0SXFiyrkku2BYyX378b6FNEs

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3572	vlc-3.0.16-win32.exe
3572	vlc-3.0.16-win32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\vlc-3.0.16-win32.exe
"C:\Users\Admin\AppData\Local\Temp\vlc-3.0.16-win32.exe"
1⤵
- Loads dropped DLL
PID:3572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsvA22D.tmp\LangDLL.dll

Filesize
7KB

MD5
20850d4d5416fbfd6a02e8a120f360fc

SHA1
ac34f3a34aaa4a21efd6a32bc93102639170e219

SHA256
860b409b065b747aab2a9937f02d08b6fd7309993b50d8e4b53983c8c2b56b61

SHA512
c8048b9ae0ced72a384c5ab781083a76b96ae08d5c8a5c7797f75a7e54e9cd9192349f185ee88c9cf0514fc8d59e37e01d88b9c8106321c0581659ebe1d1c276

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsvA22D.tmp\System.dll

Filesize
26KB

MD5
4f25d99bf1375fe5e61b037b2616695d

SHA1
958fad0e54df0736ddab28ff6cb93e6ed580c862

SHA256
803931797d95777248dee4f2a563aed51fe931d2dd28faec507c69ed0f26f647

SHA512
96a8446f322cd62377a93d2088c0ce06087da27ef95a391e02c505fb4eb1d00419143d67d89494c2ef6f57ae2fd7f049c86e00858d1b193ec6dde4d0fe0e3130

Download Submit