Overview
overview
7Static
static
1Betflix-4....m).apk
android-9-x86
7Betflix-4....m).apk
android-11-x64
7CaviarDreams.ttf
windows7-x64
3CaviarDreams.ttf
windows10-2004-x64
7Pacifico.ttf
windows7-x64
3Pacifico.ttf
windows10-2004-x64
7Sansation-Regular.ttf
windows7-x64
3Sansation-Regular.ttf
windows10-2004-x64
7Walkway_Bold.ttf
windows7-x64
3Walkway_Bold.ttf
windows10-2004-x64
7audience_network.dex
windows7-x64
3audience_network.dex
windows10-2004-x64
3crear_tran...n.html
windows7-x64
1crear_tran...n.html
windows10-2004-x64
1sound2.wav
windows7-x64
1sound2.wav
windows10-2004-x64
6sound3.wav
windows7-x64
1sound3.wav
windows10-2004-x64
6sound4.wav
windows7-x64
1sound4.wav
windows10-2004-x64
6sound5.wav
windows7-x64
1sound5.wav
windows10-2004-x64
6sound_out2.wav
windows7-x64
1sound_out2.wav
windows10-2004-x64
6sound_out3.wav
windows7-x64
1sound_out3.wav
windows10-2004-x64
6sound_out4.wav
windows7-x64
1sound_out4.wav
windows10-2004-x64
6sound_out5.wav
windows7-x64
1sound_out5.wav
windows10-2004-x64
6Analysis
-
max time kernel
141s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
09-06-2023 18:41
Static task
static1
Behavioral task
behavioral1
Sample
Betflix-4.2(betflixapk.com).apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
Betflix-4.2(betflixapk.com).apk
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral3
Sample
CaviarDreams.ttf
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
CaviarDreams.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Pacifico.ttf
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Pacifico.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Sansation-Regular.ttf
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Sansation-Regular.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Walkway_Bold.ttf
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Walkway_Bold.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
audience_network.dex
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
audience_network.dex
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
crear_transaction.html
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
crear_transaction.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
sound2.wav
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
sound2.wav
Resource
win10v2004-20230221-en
Behavioral task
behavioral17
Sample
sound3.wav
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
sound3.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
sound4.wav
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
sound4.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
sound5.wav
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
sound5.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
sound_out2.wav
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
sound_out2.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
sound_out3.wav
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
sound_out3.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
sound_out4.wav
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
sound_out4.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
sound_out5.wav
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
sound_out5.wav
Resource
win10v2004-20230221-en
General
-
Target
sound5.wav
-
Size
21KB
-
MD5
5366c619d04e7661479450c2e8ce2601
-
SHA1
45ab4a5754e3ee59ca79ce6f3105e0cc4a4b4da3
-
SHA256
554ea70fab38bbcda2a77a7e9b58739ab0749fdd1b88071a0beae7d4e698bff8
-
SHA512
9fa779ea7755107ab4489e81f0563f631bf16359ffe8d396672988d993ac6747923dc5898e0ea927d05d977870a97a841d1c92506fb4a28a779d5c138fd4cbf7
-
SSDEEP
384:O2UuM22wXGXg+dIXKWlir4TG3tF+2pV4zh/a/fm97ubWCCIo+WNEIVvQA:0UIIXZw3m2P4zpa/OluqltxVvQA
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 920 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 920 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
AUDIODG.EXEvlc.exedescription pid process Token: 33 1916 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1916 AUDIODG.EXE Token: 33 1916 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1916 AUDIODG.EXE Token: 33 920 vlc.exe Token: SeIncBasePriorityPrivilege 920 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
vlc.exepid process 920 vlc.exe 920 vlc.exe 920 vlc.exe 920 vlc.exe 920 vlc.exe 920 vlc.exe 920 vlc.exe 920 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
vlc.exepid process 920 vlc.exe 920 vlc.exe 920 vlc.exe 920 vlc.exe 920 vlc.exe 920 vlc.exe 920 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 920 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\sound5.wav"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1441⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/920-59-0x000000013F550000-0x000000013F648000-memory.dmpFilesize
992KB
-
memory/920-60-0x000007FEF6710000-0x000007FEF6744000-memory.dmpFilesize
208KB
-
memory/920-61-0x000007FEF61B0000-0x000007FEF6464000-memory.dmpFilesize
2.7MB
-
memory/920-62-0x000007FEFB080000-0x000007FEFB098000-memory.dmpFilesize
96KB
-
memory/920-63-0x000007FEF65C0000-0x000007FEF65D7000-memory.dmpFilesize
92KB
-
memory/920-64-0x000007FEF65A0000-0x000007FEF65B1000-memory.dmpFilesize
68KB
-
memory/920-65-0x000007FEF6190000-0x000007FEF61A7000-memory.dmpFilesize
92KB
-
memory/920-66-0x000007FEF6170000-0x000007FEF6181000-memory.dmpFilesize
68KB
-
memory/920-67-0x000007FEF6150000-0x000007FEF616D000-memory.dmpFilesize
116KB
-
memory/920-68-0x000007FEF6130000-0x000007FEF6141000-memory.dmpFilesize
68KB
-
memory/920-69-0x000007FEF5EC0000-0x000007FEF60C0000-memory.dmpFilesize
2.0MB
-
memory/920-70-0x000007FEF4E10000-0x000007FEF5EBB000-memory.dmpFilesize
16.7MB
-
memory/920-71-0x000007FEF4DD0000-0x000007FEF4E0F000-memory.dmpFilesize
252KB
-
memory/920-72-0x000007FEF6100000-0x000007FEF6121000-memory.dmpFilesize
132KB
-
memory/920-73-0x000007FEF4DB0000-0x000007FEF4DC8000-memory.dmpFilesize
96KB
-
memory/920-74-0x000007FEF4D90000-0x000007FEF4DA1000-memory.dmpFilesize
68KB
-
memory/920-75-0x000007FEF4D70000-0x000007FEF4D81000-memory.dmpFilesize
68KB
-
memory/920-76-0x000007FEF4D50000-0x000007FEF4D61000-memory.dmpFilesize
68KB
-
memory/920-77-0x000007FEF4D30000-0x000007FEF4D4B000-memory.dmpFilesize
108KB
-
memory/920-78-0x000007FEF4D10000-0x000007FEF4D21000-memory.dmpFilesize
68KB
-
memory/920-79-0x000007FEF4CF0000-0x000007FEF4D08000-memory.dmpFilesize
96KB
-
memory/920-80-0x000007FEF4CC0000-0x000007FEF4CF0000-memory.dmpFilesize
192KB
-
memory/920-81-0x000007FEF4C50000-0x000007FEF4CB7000-memory.dmpFilesize
412KB
-
memory/920-82-0x000007FEF4BE0000-0x000007FEF4C4F000-memory.dmpFilesize
444KB
-
memory/920-83-0x000007FEF4BC0000-0x000007FEF4BD1000-memory.dmpFilesize
68KB
-
memory/920-84-0x000007FEF4B60000-0x000007FEF4BB6000-memory.dmpFilesize
344KB
-
memory/920-85-0x000007FEF4B30000-0x000007FEF4B58000-memory.dmpFilesize
160KB
-
memory/920-86-0x000007FEF4B00000-0x000007FEF4B24000-memory.dmpFilesize
144KB
-
memory/920-87-0x000007FEF4AE0000-0x000007FEF4AF7000-memory.dmpFilesize
92KB
-
memory/920-88-0x000007FEF4AB0000-0x000007FEF4AD3000-memory.dmpFilesize
140KB
-
memory/920-89-0x000007FEF4A90000-0x000007FEF4AA1000-memory.dmpFilesize
68KB
-
memory/920-90-0x000007FEF4A70000-0x000007FEF4A82000-memory.dmpFilesize
72KB
-
memory/920-91-0x000007FEF4A40000-0x000007FEF4A61000-memory.dmpFilesize
132KB
-
memory/920-92-0x000007FEF4A20000-0x000007FEF4A33000-memory.dmpFilesize
76KB
-
memory/920-93-0x000007FEF48A0000-0x000007FEF4A18000-memory.dmpFilesize
1.5MB
-
memory/920-94-0x000007FEF4880000-0x000007FEF4897000-memory.dmpFilesize
92KB
-
memory/920-95-0x000007FEF7120000-0x000007FEF7130000-memory.dmpFilesize
64KB
-
memory/920-96-0x000007FEF4850000-0x000007FEF487F000-memory.dmpFilesize
188KB
-
memory/920-97-0x000007FEF4830000-0x000007FEF4841000-memory.dmpFilesize
68KB
-
memory/920-98-0x000007FEF4810000-0x000007FEF4826000-memory.dmpFilesize
88KB
-
memory/920-99-0x000007FEF47F0000-0x000007FEF4805000-memory.dmpFilesize
84KB
-
memory/920-100-0x000007FEF44B0000-0x000007FEF44C1000-memory.dmpFilesize
68KB
-
memory/920-101-0x000007FEF4490000-0x000007FEF44A2000-memory.dmpFilesize
72KB
-
memory/920-102-0x000007FEF4470000-0x000007FEF4482000-memory.dmpFilesize
72KB
-
memory/920-103-0x000007FEF42F0000-0x000007FEF446A000-memory.dmpFilesize
1.5MB
-
memory/920-106-0x000007FEF4290000-0x000007FEF42A1000-memory.dmpFilesize
68KB
-
memory/920-105-0x000007FEF42B0000-0x000007FEF42C4000-memory.dmpFilesize
80KB
-
memory/920-104-0x000007FEF42D0000-0x000007FEF42E3000-memory.dmpFilesize
76KB
-
memory/920-107-0x000007FEF4270000-0x000007FEF4281000-memory.dmpFilesize
68KB
-
memory/920-108-0x000007FEF4250000-0x000007FEF4261000-memory.dmpFilesize
68KB
-
memory/920-109-0x000007FEF4230000-0x000007FEF4246000-memory.dmpFilesize
88KB