0cc54e69016e3d5a80e229c768ac37a02aea3a973a5447593c0132281e383942

Analysis

max time kernel
150s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2024 14:16

Target

vlc-3.0.8-win64.exe
Size

40.1MB
MD5

96dc4f2f4f32ae1ef991b9f79eb3bb62
SHA1

c1e4cac1ce891fab7c1832877bb5608f97ff1b81
SHA256

0cc54e69016e3d5a80e229c768ac37a02aea3a973a5447593c0132281e383942
SHA512

6c858ae4dd46cba11b37f1dc6fb1b3fff6831ed61937bb8c8b51406763bbfcff12e95376516889673e96ff66a4d1d3db62be743c5dc204838c4d0345201dfd68
SSDEEP

786432:SJIeFmjqOmM5MB4wpMDZlUwQ9xM44Q7M1/Lp3P4n/MX3lnLT4ybl/zWf3:IN7aCVp9w4M4Pw1hPQMTNh/w3

Score

4^/10

Loads dropped DLL 3 IoCs

Processes:

vlc-3.0.8-win64.exe

pid process

4696 vlc-3.0.8-win64.exe
4696 vlc-3.0.8-win64.exe
4696 vlc-3.0.8-win64.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\vlc-3.0.8-win64.exe
"C:\Users\Admin\AppData\Local\Temp\vlc-3.0.8-win64.exe"
1⤵
- Loads dropped DLL
PID:4696

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\nsf3981.tmp\LangDLL.dll
Filesize
7KB

MD5
a68a2144cd9611dd04c0df27327e55d0

SHA1
5b5f4af19fd23ca18674b530f5d1a48d1115ddb4

SHA256
b7983533a2612821d469811d00ded8c41d7ee807880b8a15b3a72e8f86eb1a5c

SHA512
154da5959ae15d52ed05f0280bc100a25b3d27a413a7727cea2035b02ef561177b0572b80cfd034d2a3eeaf54ac6ae10d38b826c9b2696e7a3b8ac22a33ca87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf3981.tmp\System.dll
Filesize
26KB

MD5
5c2674f6fb2f2a7c2987ec137e5abd4d

SHA1
ce0410b83c2f0e3dc21759aadcfb8a11d43117d4

SHA256
91d60522037aa7369f3c86da6549bcf31c52754946b32386d8063bd6d6b10596

SHA512
c3730103a30f029d52b336ca808d8998bf256162381224b7939c9dd21ecda6d219bf0d077cd611f1bd968bd4ed1166e8b0dfa1544c3344ff84a3745f9deb8e98

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsf3981.tmp\nsDialogs.dll
Filesize
12KB

MD5
cc1302234015bf9787d158e5554a0139

SHA1
f42e262bb9a2130db668af324b5e54a8891b7e46

SHA256
829c15b7dad26c39b69a55e8b888ae14029fc3d701d73f77b8af38b9db6dc67a

SHA512
fcf583a9dec95071a07e11f870d7a97739ad51a1dfe9b6658341ebf0205d4c6435574e2e7f4cb7b12d502df7f5f5376d266a9006c1fd30bf5d6c735686ea2f0a

Download Submit
memory/4696-14-0x0000000000400000-0x0000000000480000-memory.dmp

Filesize
512KB

Download
memory/4696-15-0x0000000074AE0000-0x0000000074AEE000-memory.dmp

Filesize
56KB

Download
memory/4696-16-0x0000000074AD0000-0x0000000074ADB000-memory.dmp

Filesize
44KB

Download