Overview
overview
7Static
static
1Betflix-4....m).apk
android-9-x86
7Betflix-4....m).apk
android-11-x64
7CaviarDreams.ttf
windows7-x64
3CaviarDreams.ttf
windows10-2004-x64
7Pacifico.ttf
windows7-x64
3Pacifico.ttf
windows10-2004-x64
7Sansation-Regular.ttf
windows7-x64
3Sansation-Regular.ttf
windows10-2004-x64
7Walkway_Bold.ttf
windows7-x64
3Walkway_Bold.ttf
windows10-2004-x64
7audience_network.dex
windows7-x64
3audience_network.dex
windows10-2004-x64
3crear_tran...n.html
windows7-x64
1crear_tran...n.html
windows10-2004-x64
1sound2.wav
windows7-x64
1sound2.wav
windows10-2004-x64
6sound3.wav
windows7-x64
1sound3.wav
windows10-2004-x64
6sound4.wav
windows7-x64
1sound4.wav
windows10-2004-x64
6sound5.wav
windows7-x64
1sound5.wav
windows10-2004-x64
6sound_out2.wav
windows7-x64
1sound_out2.wav
windows10-2004-x64
6sound_out3.wav
windows7-x64
1sound_out3.wav
windows10-2004-x64
6sound_out4.wav
windows7-x64
1sound_out4.wav
windows10-2004-x64
6sound_out5.wav
windows7-x64
1sound_out5.wav
windows10-2004-x64
6Analysis
-
max time kernel
141s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
09-06-2023 18:41
Static task
static1
Behavioral task
behavioral1
Sample
Betflix-4.2(betflixapk.com).apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
Betflix-4.2(betflixapk.com).apk
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral3
Sample
CaviarDreams.ttf
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
CaviarDreams.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Pacifico.ttf
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Pacifico.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Sansation-Regular.ttf
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Sansation-Regular.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Walkway_Bold.ttf
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Walkway_Bold.ttf
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
audience_network.dex
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
audience_network.dex
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
crear_transaction.html
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
crear_transaction.html
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
sound2.wav
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
sound2.wav
Resource
win10v2004-20230221-en
Behavioral task
behavioral17
Sample
sound3.wav
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
sound3.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
sound4.wav
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
sound4.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
sound5.wav
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
sound5.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
sound_out2.wav
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
sound_out2.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
sound_out3.wav
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
sound_out3.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
sound_out4.wav
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
sound_out4.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
sound_out5.wav
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
sound_out5.wav
Resource
win10v2004-20230221-en
General
-
Target
sound_out3.wav
-
Size
8KB
-
MD5
8f3443508cef3459923d37ebbd2baf9e
-
SHA1
7d531c599ca500c4593db0be8b92abd5585fba36
-
SHA256
7b0b31c55a3f9daae0edc299895c43907b7d118b3ea9565835151abf7d58e482
-
SHA512
c89db18aedc46b6ebaf1e08cc492bef3393a8b8469b9c13c4ea1296d75d6110e4bfb5343c234861ce5bae834eed2e9998e5c405d8290659a769db76e6b1e9f9f
-
SSDEEP
192:PBrw8knTlV1dzRmTFE+olwtg+0sdok7gr5h:PBrw8knpVFmbmwtgC77g5h
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 932 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 932 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
AUDIODG.EXEvlc.exedescription pid process Token: 33 792 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 792 AUDIODG.EXE Token: 33 792 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 792 AUDIODG.EXE Token: 33 932 vlc.exe Token: SeIncBasePriorityPrivilege 932 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
vlc.exepid process 932 vlc.exe 932 vlc.exe 932 vlc.exe 932 vlc.exe 932 vlc.exe 932 vlc.exe 932 vlc.exe 932 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
vlc.exepid process 932 vlc.exe 932 vlc.exe 932 vlc.exe 932 vlc.exe 932 vlc.exe 932 vlc.exe 932 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 932 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\sound_out3.wav"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4801⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/932-59-0x000000013F0A0000-0x000000013F198000-memory.dmpFilesize
992KB
-
memory/932-60-0x000007FEFBA10000-0x000007FEFBA44000-memory.dmpFilesize
208KB
-
memory/932-61-0x000007FEF6E60000-0x000007FEF7114000-memory.dmpFilesize
2.7MB
-
memory/932-62-0x000007FEFC070000-0x000007FEFC088000-memory.dmpFilesize
96KB
-
memory/932-63-0x000007FEFB9F0000-0x000007FEFBA07000-memory.dmpFilesize
92KB
-
memory/932-64-0x000007FEFB9D0000-0x000007FEFB9E1000-memory.dmpFilesize
68KB
-
memory/932-65-0x000007FEFB9B0000-0x000007FEFB9C7000-memory.dmpFilesize
92KB
-
memory/932-66-0x000007FEFB7E0000-0x000007FEFB7F1000-memory.dmpFilesize
68KB
-
memory/932-67-0x000007FEFB7C0000-0x000007FEFB7DD000-memory.dmpFilesize
116KB
-
memory/932-68-0x000007FEFB7A0000-0x000007FEFB7B1000-memory.dmpFilesize
68KB
-
memory/932-69-0x000007FEF5DB0000-0x000007FEF6E5B000-memory.dmpFilesize
16.7MB
-
memory/932-70-0x000007FEF5BB0000-0x000007FEF5DB0000-memory.dmpFilesize
2.0MB
-
memory/932-71-0x000007FEFB760000-0x000007FEFB79F000-memory.dmpFilesize
252KB
-
memory/932-72-0x000007FEF78A0000-0x000007FEF78C1000-memory.dmpFilesize
132KB
-
memory/932-73-0x000007FEF73E0000-0x000007FEF73F8000-memory.dmpFilesize
96KB
-
memory/932-74-0x000007FEF73C0000-0x000007FEF73D1000-memory.dmpFilesize
68KB
-
memory/932-75-0x000007FEF73A0000-0x000007FEF73B1000-memory.dmpFilesize
68KB
-
memory/932-76-0x000007FEF7380000-0x000007FEF7391000-memory.dmpFilesize
68KB
-
memory/932-77-0x000007FEF7360000-0x000007FEF737B000-memory.dmpFilesize
108KB
-
memory/932-78-0x000007FEF7340000-0x000007FEF7351000-memory.dmpFilesize
68KB
-
memory/932-79-0x000007FEF7320000-0x000007FEF7338000-memory.dmpFilesize
96KB
-
memory/932-80-0x000007FEF72F0000-0x000007FEF7320000-memory.dmpFilesize
192KB
-
memory/932-81-0x000007FEF7280000-0x000007FEF72E7000-memory.dmpFilesize
412KB
-
memory/932-82-0x000007FEF5B40000-0x000007FEF5BAF000-memory.dmpFilesize
444KB
-
memory/932-83-0x000007FEF7260000-0x000007FEF7271000-memory.dmpFilesize
68KB
-
memory/932-84-0x000007FEF5AE0000-0x000007FEF5B36000-memory.dmpFilesize
344KB
-
memory/932-85-0x000007FEF5AB0000-0x000007FEF5AD8000-memory.dmpFilesize
160KB
-
memory/932-86-0x000007FEF5A80000-0x000007FEF5AA4000-memory.dmpFilesize
144KB
-
memory/932-87-0x000007FEF7240000-0x000007FEF7257000-memory.dmpFilesize
92KB
-
memory/932-88-0x000007FEF5A50000-0x000007FEF5A73000-memory.dmpFilesize
140KB
-
memory/932-89-0x000007FEF5A30000-0x000007FEF5A41000-memory.dmpFilesize
68KB
-
memory/932-90-0x000007FEF5A10000-0x000007FEF5A22000-memory.dmpFilesize
72KB
-
memory/932-91-0x000007FEF59E0000-0x000007FEF5A01000-memory.dmpFilesize
132KB
-
memory/932-92-0x000007FEF59C0000-0x000007FEF59D3000-memory.dmpFilesize
76KB
-
memory/932-93-0x000007FEF5840000-0x000007FEF59B8000-memory.dmpFilesize
1.5MB
-
memory/932-94-0x000007FEF5820000-0x000007FEF5837000-memory.dmpFilesize
92KB
-
memory/932-95-0x000007FEFB9A0000-0x000007FEFB9B0000-memory.dmpFilesize
64KB
-
memory/932-96-0x000007FEF57F0000-0x000007FEF581F000-memory.dmpFilesize
188KB
-
memory/932-97-0x000007FEF57D0000-0x000007FEF57E1000-memory.dmpFilesize
68KB
-
memory/932-98-0x000007FEF57B0000-0x000007FEF57C6000-memory.dmpFilesize
88KB
-
memory/932-99-0x000007FEF5790000-0x000007FEF57A5000-memory.dmpFilesize
84KB
-
memory/932-100-0x000007FEF5450000-0x000007FEF5461000-memory.dmpFilesize
68KB
-
memory/932-101-0x000007FEF5430000-0x000007FEF5442000-memory.dmpFilesize
72KB
-
memory/932-102-0x000007FEF5410000-0x000007FEF5422000-memory.dmpFilesize
72KB
-
memory/932-103-0x000007FEF5290000-0x000007FEF540A000-memory.dmpFilesize
1.5MB
-
memory/932-104-0x000007FEF5270000-0x000007FEF5283000-memory.dmpFilesize
76KB
-
memory/932-105-0x000007FEF5250000-0x000007FEF5264000-memory.dmpFilesize
80KB
-
memory/932-106-0x000007FEF5230000-0x000007FEF5241000-memory.dmpFilesize
68KB
-
memory/932-107-0x000007FEF5210000-0x000007FEF5221000-memory.dmpFilesize
68KB
-
memory/932-108-0x000007FEF51F0000-0x000007FEF5201000-memory.dmpFilesize
68KB
-
memory/932-109-0x000007FEF51D0000-0x000007FEF51E6000-memory.dmpFilesize
88KB