ba575f153d357eaf3fdbf446b9b93a12ced87c35887cdd83ad4281733eb86602

Resubmissions

14-02-2023 03:29

230214-d2alxaad55 7

14-02-2023 03:28

230214-d1frjaad49 7

Analysis

max time kernel
34s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14-02-2023 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vlc-3.0.18-win64.exe
Size

42.2MB
MD5

7fddbac28a9c85c79fe08e2d6506e535
SHA1

b2def381b57b9a7643a91790f5537e74fab729dc
SHA256

ba575f153d357eaf3fdbf446b9b93a12ced87c35887cdd83ad4281733eb86602
SHA512

bfbda8c590dc53d565cc2d26a59c97834663e871c6c7233523a2dd48027e78b93c75ae8af6d56c8542c9102aadbee8aa3b5c7f83a7600b377cf0af2cc92433b9
SSDEEP

786432:5+vk5XxMOrNfNWNG7JNzwCR3xmgpa3qdxrXcAPXCIfJ546BZTg2QrXoRHq:5+vyTnJFwL3qrJvCIxi6By2QrXoE

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

vlc-3.0.18-win64.exe

pid process

3856 vlc-3.0.18-win64.exe
3856 vlc-3.0.18-win64.exe
3856 vlc-3.0.18-win64.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
3856	vlc-3.0.18-win64.exe
3856	vlc-3.0.18-win64.exe
3856	vlc-3.0.18-win64.exe

C:\Users\Admin\AppData\Local\Temp\vlc-3.0.18-win64.exe
"C:\Users\Admin\AppData\Local\Temp\vlc-3.0.18-win64.exe"
1⤵
- Loads dropped DLL
PID:3856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3608

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsiA87C.tmp\LangDLL.dll
Filesize
7KB

MD5
20850d4d5416fbfd6a02e8a120f360fc

SHA1
ac34f3a34aaa4a21efd6a32bc93102639170e219

SHA256
860b409b065b747aab2a9937f02d08b6fd7309993b50d8e4b53983c8c2b56b61

SHA512
c8048b9ae0ced72a384c5ab781083a76b96ae08d5c8a5c7797f75a7e54e9cd9192349f185ee88c9cf0514fc8d59e37e01d88b9c8106321c0581659ebe1d1c276

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA87C.tmp\System.dll
Filesize
26KB

MD5
4f25d99bf1375fe5e61b037b2616695d

SHA1
958fad0e54df0736ddab28ff6cb93e6ed580c862

SHA256
803931797d95777248dee4f2a563aed51fe931d2dd28faec507c69ed0f26f647

SHA512
96a8446f322cd62377a93d2088c0ce06087da27ef95a391e02c505fb4eb1d00419143d67d89494c2ef6f57ae2fd7f049c86e00858d1b193ec6dde4d0fe0e3130

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsiA87C.tmp\nsDialogs.dll
Filesize
12KB

MD5
2029c44871670eec937d1a8c1e9faa21

SHA1
e8d53b9e8bc475cc274d80d3836b526d8dd2747a

SHA256
a4ae6d33f940a80e8fe34537c5cc1f8b8679c979607969320cfb750c15809ac2

SHA512
6f151c9818ac2f3aef6d4cabd8122c7e22ccf0b84fa5d4bcc951f8c3d00e8c270127eac1e9d93c5f4594ac90de8aff87dc6e96562f532a3d19c0da63a28654b7

Download Submit