Overview
overview
5Static
static
3vlc-3.0.21-win64.exe
windows7-x64
4vlc-3.0.21-win64.exe
windows10-2004-x64
4$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3NEWS.vbs
windows7-x64
1NEWS.vbs
windows10-2004-x64
1axvlc.dll
windows7-x64
5axvlc.dll
windows10-2004-x64
5libvlc.dll
windows7-x64
1libvlc.dll
windows10-2004-x64
1libvlccore.dll
windows7-x64
1libvlccore.dll
windows10-2004-x64
1lua/http/custom.js
windows7-x64
3lua/http/custom.js
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3lua/http/d...m.html
windows7-x64
3lua/http/d...m.html
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3lua/http/d...w.html
windows7-x64
3lua/http/d...w.html
windows10-2004-x64
3Analysis
- max time kernel
142s - max time network
122s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
09/08/2024, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
vlc-3.0.21-win64.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
vlc-3.0.21-win64.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
NEWS.vbs
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
NEWS.vbs
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
axvlc.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
axvlc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
libvlc.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
libvlc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
libvlccore.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
libvlccore.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
lua/http/custom.js
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
lua/http/custom.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
lua/http/dialogs/batch_window.html
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
lua/http/dialogs/batch_window.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
lua/http/dialogs/browse_window.html
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
lua/http/dialogs/browse_window.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
lua/http/dialogs/create_stream.html
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
lua/http/dialogs/create_stream.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
lua/http/dialogs/equalizer_window.html
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
lua/http/dialogs/equalizer_window.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
lua/http/dialogs/error_window.html
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
lua/http/dialogs/error_window.html
Resource
win10v2004-20240802-en
General
- Target vlc-3.0.21-win64.exe
- Size 42.9MB
- Sample240809-gysj4a1dpg
- SHA256 9742689a50e96ddc04d80ceff046b28da2beefd617be18166f8c5e715ec60c59
- MD5 a6f92affb6ce711f9f5048410cb4bc32
- SHA1 80d994fb95087efce34aeb4a98c8f4d7d2a035a6
- SHA512 1a8ff18e29514c48b29fab5ad419b506610c462c09891b4ba6dc0cee550d05eed03bed8d018b9bd61b3d81e1848da7845d53c1b01a508dd87381791541a44f2c
- SSDEEP 786432:7OvIHtds0udYsBQv3eva1Umww8RZLyP7QL5ojI54qcDhvcOm:2C3/sB0eyyxwXP7QL+jI5UDNcH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 1716 vlc-3.0.21-win64.exe 1716 vlc-3.0.21-win64.exe 1716 vlc-3.0.21-win64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlc-3.0.21-win64.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1716 vlc-3.0.21-win64.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \Users\Admin\AppData\Local\Temp\nsy87B8.tmp\LangDLL.dll
- Size 8KB
- SHA256 42c46cde21b03935314697ef444b01d85e319fc443519bde35fec90c8b21fc98
- MD5 6a4ce8d10efd06369f368898462546e0
- SHA1 79b9c182afcfddb4687663f287327fb968731c1b
- SHA512 8a5f1d1bf6fef5ed5b51f41129715bdad0ebabb539c0260b080e567a101db7acdba722a9df5e55527ccdd2bf05a009bfee3c4a3745825c953f3348ef55e61918
- SSDEEP 96:e0nLo47eYkrGj23kBTPEa8ir2qUuRkNB/RMZCabEe/2/HdNfdpX2N:foZYkrGj20tEEeYkv/RaCw/2/9h2N
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsy87B8.tmp\System.dll
- Size 28KB
- SHA256 b07a12c5ced6a1ece5e7dc4103f8b3e15bf77f5edb70daef115b9a77bcf55885
- MD5 4a82832a6209cdc3a2447ab2de137542
- SHA1 21f334bf90566e3a94a712b68f2cbc32746711d4
- SHA512 6bceff4d3eba26a84029d09f6e403f3fc0c95a744f4d6bfde22accf480a724a0f38960d848a5255258a6a57d3ec9b384847acf167b485ff67f7161aac04300f0
- SSDEEP 384:AGEs6MVKQq0DwRiGUaLYuAXLaMoy4m973uwYkv56YPewyy1Eiu8IuFd/9:AGEQKZ2wRiGUcY8TBsdvkdwyyvIs
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsy87B8.tmp\nsDialogs.dll
- Size 14KB
- SHA256 47a1976b7736371b9b2e073ef0dd49db3bdbe604ec9ee77e50621e5f19d9ae7b
- MD5 8b11196dc49c4df98c6f97457c97e590
- SHA1 7ee6c21506ac68a1ecf36be5d632ee339311d51a
- SHA512 4c77005b35f9c9c3cd64d5dba178f45ed250974848086e9da283d539add6aa70bb9ec44782f69f115ab87d1d1d723a63698f9b9db817710b52ab836a87e654b7
- SSDEEP 192:RlWWck581HwPRLG/CocFR1w5nEYkv/RGl5Boi6+6SZSM3CU:mdk5SoRLG/CocFR62Ykv8l5Boi9XyU
- MD5 SHA1 SHA512 SSDEEP