Overview
overview
7Static
static
3vdhcoapp-w...er.exe
windows7-x64
7vdhcoapp-w...er.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3ffmpeg.exe
windows7-x64
1ffmpeg.exe
windows10-2004-x64
1ffprobe.exe
windows7-x64
1ffprobe.exe
windows10-2004-x64
1filepicker.exe
windows7-x64
1filepicker.exe
windows10-2004-x64
1vdhcoapp.exe
windows7-x64
1vdhcoapp.exe
windows10-2004-x64
1Analysis
-
max time kernel
587s -
max time network
603s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07-06-2024 14:54
Static task
static1
Behavioral task
behavioral1
Sample
vdhcoapp-windows-x86_64-installer.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
vdhcoapp-windows-x86_64-installer.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
ffmpeg.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
ffmpeg.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
ffprobe.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
ffprobe.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
filepicker.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
filepicker.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
vdhcoapp.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
vdhcoapp.exe
Resource
win10v2004-20240226-en
General
-
Target
vdhcoapp.exe
-
Size
37.1MB
-
MD5
33655aef9d0adb582e25c4c98a446b56
-
SHA1
614b2178ab67879ed66f646a770b52bcc4401e67
-
SHA256
ae64bf753d871391d69d0b2b9cfe63ba4dd0c73efe5fe4dc74b18c279722865b
-
SHA512
851635a9949e351518a12d1d71a123e127642be49934e92ae0acd740cd15a5b1aae028e4f2ebc9fd85642a6bd796ea784cff803141605dd61bace07289d37cbd
-
SSDEEP
393216:f1Du8BtuBw2FEL3Z3aLUoQvo6LP/SgbSpYvKEh1EdKwlGQKPJuGsiTfREsrgCYfX:fMguj8Q4VfvNqFTrYTs
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe 336 vdhcoapp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vdhcoapp.exe"C:\Users\Admin\AppData\Local\Temp\vdhcoapp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵PID:700
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵PID:4872