Overview
overview
7Static
static
7Changed.v0...21.rar
windows7-x64
3Changed.v0...21.rar
windows10-2004-x64
3Changed Sp...er.ini
windows7-x64
1Changed Sp...er.ini
windows10-2004-x64
1Changed Sp...ve.txt
windows7-x64
1Changed Sp...ve.txt
windows10-2004-x64
1Changed Sp...me.txt
windows7-x64
1Changed Sp...me.txt
windows10-2004-x64
1Changed Sp...ge.txt
windows7-x64
1Changed Sp...ge.txt
windows10-2004-x64
1Changed Sp...rt.txt
windows7-x64
1Changed Sp...rt.txt
windows10-2004-x64
1Changed Sp...id.txt
windows7-x64
1Changed Sp...id.txt
windows10-2004-x64
1Changed Sp...id.txt
windows7-x64
1Changed Sp...id.txt
windows10-2004-x64
1Changed Sp.../1.wav
windows7-x64
1Changed Sp.../1.wav
windows10-2004-x64
6Changed Sp...10.wav
windows7-x64
1Changed Sp...10.wav
windows10-2004-x64
6Changed Sp...11.wav
windows7-x64
1Changed Sp...11.wav
windows10-2004-x64
6Changed Sp...12.wav
windows7-x64
1Changed Sp...12.wav
windows10-2004-x64
6Changed Sp...13.wav
windows7-x64
1Changed Sp...13.wav
windows10-2004-x64
6Changed Sp...14.wav
windows7-x64
1Changed Sp...14.wav
windows10-2004-x64
6Changed Sp...15.wav
windows7-x64
1Changed Sp...15.wav
windows10-2004-x64
6Changed Sp...16.wav
windows7-x64
1Changed Sp...16.wav
windows10-2004-x64
6Analysis
-
max time kernel
144s -
max time network
36s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
10-06-2023 13:46
Behavioral task
behavioral1
Sample
Changed.v01.02.2021.rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Changed.v01.02.2021.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Changed Special/coldclientloader.ini
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Changed Special/coldclientloader.ini
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
Changed Special/local_save.txt
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Changed Special/local_save.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Changed Special/steam_settings/settings/account_name.txt
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Changed Special/steam_settings/settings/account_name.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
Changed Special/steam_settings/settings/language.txt
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
Changed Special/steam_settings/settings/language.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
Changed Special/steam_settings/settings/listen_port.txt
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
Changed Special/steam_settings/settings/listen_port.txt
Resource
win10v2004-20230221-en
Behavioral task
behavioral13
Sample
Changed Special/steam_settings/settings/user_steam_id.txt
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Changed Special/steam_settings/settings/user_steam_id.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
Changed Special/steam_settings/steam_appid.txt
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
Changed Special/steam_settings/steam_appid.txt
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/1.wav
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/1.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/10.wav
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/10.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/11.wav
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/11.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/12.wav
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/12.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/13.wav
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/13.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/14.wav
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/14.wav
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/15.wav
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/15.wav
Resource
win10v2004-20230221-en
Behavioral task
behavioral31
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/16.wav
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
Changed Special/steamapps/common/Changed Special/Audio/BGM/16.wav
Resource
win10v2004-20230220-en
General
-
Target
Changed Special/steamapps/common/Changed Special/Audio/BGM/15.wav
-
Size
1.4MB
-
MD5
ac10ce269ea98653c1c1a9e136d52d22
-
SHA1
52776799f3ccd9414113d8051e6e0edd2be3a12d
-
SHA256
d8129ba0819290d122b2b028723c3a742701709ee431545a74c3825a659b9677
-
SHA512
37112a2d3d988cb3f01d3d2b87e1f200c2bf06065a6b9cfbde9ecf7d74acfb155da5906f70bfa0ee37f520c19f2c8b14d0e6d51620d05644e3ad1b87742b3dbb
-
SSDEEP
24576:gc/WiIpksTLj7EkQGBcpehegggo0biyUiSkcV+mJSE2Az0eEZKINbG8ya8b:gz1TnwrGGpehege0biyHSkuJl2q0exU6
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 868 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 868 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
AUDIODG.EXEvlc.exedescription pid process Token: 33 1332 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1332 AUDIODG.EXE Token: 33 1332 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1332 AUDIODG.EXE Token: 33 868 vlc.exe Token: SeIncBasePriorityPrivilege 868 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
vlc.exepid process 868 vlc.exe 868 vlc.exe 868 vlc.exe 868 vlc.exe 868 vlc.exe 868 vlc.exe 868 vlc.exe 868 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
vlc.exepid process 868 vlc.exe 868 vlc.exe 868 vlc.exe 868 vlc.exe 868 vlc.exe 868 vlc.exe 868 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 868 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Changed Special\steamapps\common\Changed Special\Audio\BGM\15.wav"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1801⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/868-59-0x000000013F7C0000-0x000000013F8B8000-memory.dmpFilesize
992KB
-
memory/868-60-0x000007FEFAC80000-0x000007FEFACB4000-memory.dmpFilesize
208KB
-
memory/868-61-0x000007FEF62B0000-0x000007FEF6564000-memory.dmpFilesize
2.7MB
-
memory/868-63-0x000007FEFAC60000-0x000007FEFAC77000-memory.dmpFilesize
92KB
-
memory/868-62-0x000007FEFB290000-0x000007FEFB2A8000-memory.dmpFilesize
96KB
-
memory/868-64-0x000007FEFABF0000-0x000007FEFAC01000-memory.dmpFilesize
68KB
-
memory/868-65-0x000007FEFABD0000-0x000007FEFABE7000-memory.dmpFilesize
92KB
-
memory/868-66-0x000007FEFAA00000-0x000007FEFAA11000-memory.dmpFilesize
68KB
-
memory/868-67-0x000007FEFA9E0000-0x000007FEFA9FD000-memory.dmpFilesize
116KB
-
memory/868-68-0x000007FEFA9C0000-0x000007FEFA9D1000-memory.dmpFilesize
68KB
-
memory/868-69-0x000007FEF6030000-0x000007FEF6230000-memory.dmpFilesize
2.0MB
-
memory/868-70-0x000007FEF4F80000-0x000007FEF602B000-memory.dmpFilesize
16.7MB
-
memory/868-71-0x000007FEFA980000-0x000007FEFA9BF000-memory.dmpFilesize
252KB
-
memory/868-72-0x000007FEFA950000-0x000007FEFA971000-memory.dmpFilesize
132KB
-
memory/868-73-0x000007FEFA930000-0x000007FEFA948000-memory.dmpFilesize
96KB
-
memory/868-74-0x000007FEF6670000-0x000007FEF6681000-memory.dmpFilesize
68KB
-
memory/868-75-0x000007FEF6650000-0x000007FEF6661000-memory.dmpFilesize
68KB
-
memory/868-76-0x000007FEF6630000-0x000007FEF6641000-memory.dmpFilesize
68KB
-
memory/868-77-0x000007FEF6610000-0x000007FEF662B000-memory.dmpFilesize
108KB
-
memory/868-78-0x000007FEF6290000-0x000007FEF62A1000-memory.dmpFilesize
68KB
-
memory/868-79-0x000007FEF6270000-0x000007FEF6288000-memory.dmpFilesize
96KB
-
memory/868-80-0x000007FEF4F50000-0x000007FEF4F80000-memory.dmpFilesize
192KB
-
memory/868-81-0x000007FEF4EE0000-0x000007FEF4F47000-memory.dmpFilesize
412KB
-
memory/868-82-0x000007FEF4E70000-0x000007FEF4EDF000-memory.dmpFilesize
444KB
-
memory/868-83-0x000007FEF4E50000-0x000007FEF4E61000-memory.dmpFilesize
68KB
-
memory/868-84-0x000007FEF4DF0000-0x000007FEF4E46000-memory.dmpFilesize
344KB
-
memory/868-85-0x000007FEF4DC0000-0x000007FEF4DE8000-memory.dmpFilesize
160KB
-
memory/868-86-0x000007FEF4D90000-0x000007FEF4DB4000-memory.dmpFilesize
144KB
-
memory/868-87-0x000007FEF4D70000-0x000007FEF4D87000-memory.dmpFilesize
92KB
-
memory/868-88-0x000007FEF4D40000-0x000007FEF4D63000-memory.dmpFilesize
140KB
-
memory/868-89-0x000007FEF4D20000-0x000007FEF4D31000-memory.dmpFilesize
68KB
-
memory/868-90-0x000007FEF4D00000-0x000007FEF4D12000-memory.dmpFilesize
72KB
-
memory/868-91-0x000007FEF4CD0000-0x000007FEF4CF1000-memory.dmpFilesize
132KB
-
memory/868-92-0x000007FEF4CB0000-0x000007FEF4CC3000-memory.dmpFilesize
76KB
-
memory/868-93-0x000007FEF4B30000-0x000007FEF4CA8000-memory.dmpFilesize
1.5MB
-
memory/868-94-0x000007FEF4B10000-0x000007FEF4B27000-memory.dmpFilesize
92KB
-
memory/868-96-0x000007FEF4AE0000-0x000007FEF4B0F000-memory.dmpFilesize
188KB
-
memory/868-95-0x000007FEFAC50000-0x000007FEFAC60000-memory.dmpFilesize
64KB
-
memory/868-97-0x000007FEF4AC0000-0x000007FEF4AD1000-memory.dmpFilesize
68KB
-
memory/868-98-0x000007FEF4AA0000-0x000007FEF4AB6000-memory.dmpFilesize
88KB
-
memory/868-99-0x000007FEF4A80000-0x000007FEF4A95000-memory.dmpFilesize
84KB
-
memory/868-100-0x000007FEF4740000-0x000007FEF4751000-memory.dmpFilesize
68KB
-
memory/868-101-0x000007FEF4720000-0x000007FEF4732000-memory.dmpFilesize
72KB
-
memory/868-102-0x000007FEF45A0000-0x000007FEF471A000-memory.dmpFilesize
1.5MB
-
memory/868-103-0x000007FEF4580000-0x000007FEF4593000-memory.dmpFilesize
76KB
-
memory/868-104-0x000007FEF4560000-0x000007FEF4574000-memory.dmpFilesize
80KB
-
memory/868-105-0x000007FEF4540000-0x000007FEF4551000-memory.dmpFilesize
68KB
-
memory/868-106-0x000007FEF4520000-0x000007FEF4531000-memory.dmpFilesize
68KB
-
memory/868-107-0x000007FEF4500000-0x000007FEF4511000-memory.dmpFilesize
68KB
-
memory/868-108-0x000007FEF44E0000-0x000007FEF44F6000-memory.dmpFilesize
88KB
-
memory/868-111-0x000007FEF62B0000-0x000007FEF6564000-memory.dmpFilesize
2.7MB
-
memory/868-120-0x000007FEF4F80000-0x000007FEF602B000-memory.dmpFilesize
16.7MB