ba575f153d357eaf3fdbf446b9b93a12ced87c35887cdd83ad4281733eb86602

Analysis

max time kernel
33s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2023 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vlc-3.0.18-win64.exe
Size

42.2MB
MD5

7fddbac28a9c85c79fe08e2d6506e535
SHA1

b2def381b57b9a7643a91790f5537e74fab729dc
SHA256

ba575f153d357eaf3fdbf446b9b93a12ced87c35887cdd83ad4281733eb86602
SHA512

bfbda8c590dc53d565cc2d26a59c97834663e871c6c7233523a2dd48027e78b93c75ae8af6d56c8542c9102aadbee8aa3b5c7f83a7600b377cf0af2cc92433b9
SSDEEP

786432:5+vk5XxMOrNfNWNG7JNzwCR3xmgpa3qdxrXcAPXCIfJ546BZTg2QrXoRHq:5+vyTnJFwL3qrJvCIxi6By2QrXoE

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo	vlc-3.0.18-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libflac_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll	vlc-3.0.18-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll	vlc-3.0.18-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtimecode_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcroppadd_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hi\	vlc-3.0.18-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll	vlc-3.0.18-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libogg_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_gather_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\libmosaic_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libextract_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\gui\	vlc-3.0.18-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libxa_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libgestures_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\control\libwin_hotkeys_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_dirac_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\liblogo_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll	vlc-3.0.18-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspatializer_plugin.dll	vlc-3.0.18-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\librtpvideo_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\brx\LC_MESSAGES\	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\vlc.mo	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac	vlc-3.0.18-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libkaraoke_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nl\LC_MESSAGES\vlc.mo	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo	vlc-3.0.18-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttps_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\	vlc-3.0.18-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_rist_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\vlc.mo	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_sse2_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\	vlc-3.0.18-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libuleaddvaudio_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_wav_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\sd\	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\libwav_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uk\	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libsftp_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\	vlc-3.0.18-win64.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaom_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_mpjpeg_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\spu\libremoteosd_plugin.dll	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\speaker-32.png	vlc-3.0.18-win64.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\logger\	vlc-3.0.18-win64.exe

Loads dropped DLL 4 IoCs

pid	Process
5012	vlc-3.0.18-win64.exe
5012	vlc-3.0.18-win64.exe
5012	vlc-3.0.18-win64.exe
5012	vlc-3.0.18-win64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5012	vlc-3.0.18-win64.exe
5012	vlc-3.0.18-win64.exe
5012	vlc-3.0.18-win64.exe
5012	vlc-3.0.18-win64.exe

C:\Users\Admin\AppData\Local\Temp\vlc-3.0.18-win64.exe
"C:\Users\Admin\AppData\Local\Temp\vlc-3.0.18-win64.exe"
1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsc73CA.tmp\LangDLL.dll

Filesize
7KB

MD5
20850d4d5416fbfd6a02e8a120f360fc

SHA1
ac34f3a34aaa4a21efd6a32bc93102639170e219

SHA256
860b409b065b747aab2a9937f02d08b6fd7309993b50d8e4b53983c8c2b56b61

SHA512
c8048b9ae0ced72a384c5ab781083a76b96ae08d5c8a5c7797f75a7e54e9cd9192349f185ee88c9cf0514fc8d59e37e01d88b9c8106321c0581659ebe1d1c276

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc73CA.tmp\System.dll

Filesize
26KB

MD5
4f25d99bf1375fe5e61b037b2616695d

SHA1
958fad0e54df0736ddab28ff6cb93e6ed580c862

SHA256
803931797d95777248dee4f2a563aed51fe931d2dd28faec507c69ed0f26f647

SHA512
96a8446f322cd62377a93d2088c0ce06087da27ef95a391e02c505fb4eb1d00419143d67d89494c2ef6f57ae2fd7f049c86e00858d1b193ec6dde4d0fe0e3130

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc73CA.tmp\nsDialogs.dll

Filesize
12KB

MD5
2029c44871670eec937d1a8c1e9faa21

SHA1
e8d53b9e8bc475cc274d80d3836b526d8dd2747a

SHA256
a4ae6d33f940a80e8fe34537c5cc1f8b8679c979607969320cfb750c15809ac2

SHA512
6f151c9818ac2f3aef6d4cabd8122c7e22ccf0b84fa5d4bcc951f8c3d00e8c270127eac1e9d93c5f4594ac90de8aff87dc6e96562f532a3d19c0da63a28654b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc73CA.tmp\nsProcess.dll

Filesize
35KB

MD5
1d391f65d3f16149d324dfe4178f2941

SHA1
834a465290feea0ea6f2783cfeccf85a1ff31648

SHA256
ded1a83fbd3dab203ca4e5db33b5a826d25d5cbb9413fb18ba21e1a91fb5f113

SHA512
7096362fa5b71fb8fc7f0a1a46686d7efb82fc079d00a508091cd8c3e8c36974c841d3a3185ce27c5a2bba468c301bf2bd720cb5b515fe34d3a2c987f36ba3ce

Download Submit
memory/5012-8-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/5012-9-0x0000000074420000-0x000000007442E000-memory.dmp

Filesize
56KB

Download
memory/5012-10-0x0000000074410000-0x0000000074419000-memory.dmp

Filesize
36KB

Download
memory/5012-17-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/5012-19-0x0000000074410000-0x000000007441B000-memory.dmp

Filesize
44KB

Download
memory/5012-232-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/5012-234-0x0000000074410000-0x000000007441B000-memory.dmp

Filesize
44KB

Download