Overview
overview
5Static
static
3Vaydeer mu....6.exe
windows7-x64
4Vaydeer mu....6.exe
windows10-2004-x64
4$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1Vaydeer mu...ob.exe
windows7-x64
5Vaydeer mu...ob.exe
windows10-2004-x64
5d3dcompiler_47.dll
windows10-2004-x64
3ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
3libGLESv2.dll
windows10-2004-x64
3locales/ko.pak
windows7-x64
3locales/ko.pak
windows10-2004-x64
3resources/...ID.dll
windows7-x64
3resources/...ID.dll
windows10-2004-x64
3resources/...on.dll
windows7-x64
3resources/...on.dll
windows10-2004-x64
3resources/...tl.exe
windows7-x64
1resources/...tl.exe
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 21:33
Static task
static1
Behavioral task
behavioral1
Sample
Vaydeer multimedia knob Setup 0.1.6.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Vaydeer multimedia knob Setup 0.1.6.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240419-en
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
Vaydeer multimedia knob.exe
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
Vaydeer multimedia knob.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
ffmpeg.dll
Resource
win7-20231129-en
Behavioral task
behavioral17
Sample
ffmpeg.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
libEGL.dll
Resource
win7-20240611-en
Behavioral task
behavioral19
Sample
libEGL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
libGLESv2.dll
Resource
win7-20240419-en
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral22
Sample
locales/ko.pak
Resource
win7-20240508-en
Behavioral task
behavioral23
Sample
locales/ko.pak
Resource
win10v2004-20240611-en
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/node-hid/build/Release/HID.dll
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/node-hid/build/Release/HID.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/usb-detection/build/Release/detection.dll
Resource
win7-20240611-en
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/usb-detection/build/Release/detection.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
resources/assets/VolumeCtl.exe
Resource
win7-20240508-en
Behavioral task
behavioral29
Sample
resources/assets/VolumeCtl.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
resources/elevate.exe
Resource
win7-20240611-en
Behavioral task
behavioral31
Sample
resources/elevate.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
swiftshader/libEGL.dll
Resource
win7-20240220-en
General
-
Target
Vaydeer multimedia knob.exe
-
Size
117.8MB
-
MD5
0b1cee5f3dde4f08798f289429041adc
-
SHA1
186b44ba8995570e9c8de7e6bd804f1a7efe0a11
-
SHA256
caca49743c770aa5375cac879dc14b80ef48f11d2451f4449e339a44a0939c44
-
SHA512
cd6e6170cee691e303f85e5efab8b137cec0d0cdd9877b51db0efbd45218b6287f80cdad86cc5dae144f776338ac41d237899baf65c2b7257fc5211f3661ed88
-
SSDEEP
1572864:FsUh7AnP+tF2Luxxoy1XOAGcW0b4C6jwfEgZ2oyRYqcairhkmGhL9UdFUn+FwarP:I4nlO+zVGmGrarOV4CyIhi
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Vaydeer multimedia knob.exeVaydeer multimedia knob.exeVaydeer multimedia knob.exeVaydeer multimedia knob.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Vaydeer multimedia knob.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Vaydeer multimedia knob.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Vaydeer multimedia knob.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation Vaydeer multimedia knob.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
Vaydeer multimedia knob.exeVaydeer multimedia knob.exeVaydeer multimedia knob.exeVaydeer multimedia knob.exeVaydeer multimedia knob.exepid process 4316 Vaydeer multimedia knob.exe 4316 Vaydeer multimedia knob.exe 368 Vaydeer multimedia knob.exe 368 Vaydeer multimedia knob.exe 4768 Vaydeer multimedia knob.exe 4768 Vaydeer multimedia knob.exe 1216 Vaydeer multimedia knob.exe 1216 Vaydeer multimedia knob.exe 4824 Vaydeer multimedia knob.exe 4824 Vaydeer multimedia knob.exe 4824 Vaydeer multimedia knob.exe 4824 Vaydeer multimedia knob.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
Vaydeer multimedia knob.exepid process 4184 Vaydeer multimedia knob.exe 4184 Vaydeer multimedia knob.exe 4184 Vaydeer multimedia knob.exe 4184 Vaydeer multimedia knob.exe 4184 Vaydeer multimedia knob.exe 4184 Vaydeer multimedia knob.exe 4184 Vaydeer multimedia knob.exe 4184 Vaydeer multimedia knob.exe -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
Vaydeer multimedia knob.exepid process 4184 Vaydeer multimedia knob.exe 4184 Vaydeer multimedia knob.exe 4184 Vaydeer multimedia knob.exe 4184 Vaydeer multimedia knob.exe 4184 Vaydeer multimedia knob.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
Vaydeer multimedia knob.exedescription pid process target process PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4052 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4316 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4316 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4316 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 368 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 368 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 368 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 1216 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 1216 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 1216 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4768 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4768 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4768 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4824 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4824 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe PID 4184 wrote to memory of 4824 4184 Vaydeer multimedia knob.exe Vaydeer multimedia knob.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe"C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe"C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe" --type=gpu-process --field-trial-handle=1684,14295961634741354522,16132790538775234471,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --user-data-dir="C:\Users\Admin\AppData\Roaming\vaydeer-multimedia-knob" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 /prefetch:22⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe"C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1684,14295961634741354522,16132790538775234471,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\vaydeer-multimedia-knob" --mojo-platform-channel-handle=2136 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe"C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\vaydeer-multimedia-knob" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --field-trial-handle=1684,14295961634741354522,16132790538775234471,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2404 /prefetch:12⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:368 -
C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe"C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\vaydeer-multimedia-knob" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --field-trial-handle=1684,14295961634741354522,16132790538775234471,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 /prefetch:12⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe"C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\vaydeer-multimedia-knob" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --field-trial-handle=1684,14295961634741354522,16132790538775234471,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 /prefetch:12⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe"C:\Users\Admin\AppData\Local\Temp\Vaydeer multimedia knob.exe" --type=gpu-process --field-trial-handle=1684,14295961634741354522,16132790538775234471,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\vaydeer-multimedia-knob" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2996 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4824
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
54B
MD59276b0c4b2deb06ec890cac9ff36da59
SHA17304b67e569cce4fa5d1963eae10b1a12d51e5ba
SHA256c234a2cb7b6159220ad73a628fb37bb6b1dff42f300057db581cda026d4bdb26
SHA5123442a3dc3adb0d39ae42cb5b54fee87ce18a7cbb64f51cf89075917518008eb5db2df279d591166bd8cba0feeb6f226ffc7dda6c737496e8e715090989687e4e
-
Filesize
57B
MD558127c59cb9e1da127904c341d15372b
SHA162445484661d8036ce9788baeaba31d204e9a5fc
SHA256be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA5128d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a