979a66f347df50eea02a69e44985585a1c13d9ed93c63f65ed241dcc142064ae

Analysis

max time kernel
292s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/bgm.xm
Size

1.0MB
MD5

eac249a6cbd92e5a744f1921261b4134
SHA1

3c1be061f209bf9cef151399f896a1e7927bb2cb
SHA256

9ae311e672f224a27350dd37cce871187377531741df048082b9cb680cd12882
SHA512

3cdb465c746c816b5f9badbe10020a636aca694c1992e076cb251f81ba9cca158ba5455587d0bb966743b943ce88ad0c99c74d39664c55723e169d070a799459
SSDEEP

24576:njg85PbKWstZdIzNIPRnuEHDGLG5nyQweozKajh/q0nqVVjAsOktahU5F+eOohVz:njgcPuWs6zNIeLG5nyQweozKa1/q0nqH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3100	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3100	vlc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	3004	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3004	AUDIODG.EXE
Token: 33	3100	vlc.exe
Token: SeIncBasePriorityPrivilege	3100	vlc.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3100	vlc.exe
3100	vlc.exe
3100	vlc.exe
3100	vlc.exe
3100	vlc.exe
3100	vlc.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
3100	vlc.exe
3100	vlc.exe
3100	vlc.exe
3100	vlc.exe
3100	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3100	vlc.exe

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\$TEMP\bgm.xm"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3100

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x46c 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3100-6-0x00007FF8D54E0000-0x00007FF8D5514000-memory.dmp

Filesize
208KB

Download
memory/3100-5-0x00007FF72B000000-0x00007FF72B0F8000-memory.dmp

Filesize
992KB

Download
memory/3100-14-0x00007FF8D5260000-0x00007FF8D5271000-memory.dmp

Filesize
68KB

Download
memory/3100-13-0x00007FF8D5280000-0x00007FF8D529D000-memory.dmp

Filesize
116KB

Download
memory/3100-7-0x00007FF8D4A60000-0x00007FF8D4D16000-memory.dmp

Filesize
2.7MB

Download
memory/3100-16-0x00007FF8D5150000-0x00007FF8D5191000-memory.dmp

Filesize
260KB

Download
memory/3100-15-0x00007FF8C5E60000-0x00007FF8C606B000-memory.dmp

Filesize
2.0MB

Download
memory/3100-12-0x00007FF8D5420000-0x00007FF8D5431000-memory.dmp

Filesize
68KB

Download
memory/3100-11-0x00007FF8D5440000-0x00007FF8D5457000-memory.dmp

Filesize
92KB

Download
memory/3100-23-0x00007FF8D0BD0000-0x00007FF8D0C05000-memory.dmp

Filesize
212KB

Download
memory/3100-22-0x00007FF8D50A0000-0x00007FF8D50B1000-memory.dmp

Filesize
68KB

Download
memory/3100-21-0x00007FF8D50C0000-0x00007FF8D50D1000-memory.dmp

Filesize
68KB

Download
memory/3100-20-0x00007FF8D50E0000-0x00007FF8D50F1000-memory.dmp

Filesize
68KB

Download
memory/3100-19-0x00007FF8D5100000-0x00007FF8D5118000-memory.dmp

Filesize
96KB

Download
memory/3100-18-0x00007FF8D5120000-0x00007FF8D5141000-memory.dmp

Filesize
132KB

Download
memory/3100-10-0x00007FF8D8610000-0x00007FF8D8621000-memory.dmp

Filesize
68KB

Download
memory/3100-9-0x00007FF8DAB70000-0x00007FF8DAB87000-memory.dmp

Filesize
92KB

Download
memory/3100-8-0x00007FF8DE7D0000-0x00007FF8DE7E8000-memory.dmp

Filesize
96KB

Download
memory/3100-17-0x00007FF8C4DB0000-0x00007FF8C5E60000-memory.dmp

Filesize
16.7MB

Download
memory/3100-36-0x00007FF8C4DB0000-0x00007FF8C5E60000-memory.dmp

Filesize
16.7MB

Download
memory/3100-55-0x00007FF8C4DB0000-0x00007FF8C5E60000-memory.dmp

Filesize
16.7MB

Download