Overview
overview
7Static
static
3PocketCamp...er.exe
windows7-x64
7PocketCamp...er.exe
windows10-2004-x64
7$PLUGINSDI...al.ini
windows7-x64
1$PLUGINSDI...al.ini
windows10-2004-x64
1$PLUGINSDI...er.bmp
windows7-x64
3$PLUGINSDI...er.bmp
windows10-2004-x64
7$PLUGINSDI...rd.bmp
windows7-x64
3$PLUGINSDI...rd.bmp
windows10-2004-x64
7alolanvulp..._1.mp4
windows7-x64
1alolanvulp..._1.mp4
windows10-2004-x64
6alolanvulp..._2.mp4
windows7-x64
1alolanvulp..._2.mp4
windows10-2004-x64
6alolanvulp..._3.mp4
windows7-x64
1alolanvulp..._3.mp4
windows10-2004-x64
6alolanvulp..._4.mp4
windows7-x64
1alolanvulp..._4.mp4
windows10-2004-x64
6alolanvulp..._5.mp4
windows7-x64
1alolanvulp..._5.mp4
windows10-2004-x64
6alolanvulp..._1.mp4
windows7-x64
1alolanvulp..._1.mp4
windows10-2004-x64
6alolanvulp..._2.mp4
windows7-x64
1alolanvulp..._2.mp4
windows10-2004-x64
6alolanvulp..._3.mp4
windows7-x64
1alolanvulp..._3.mp4
windows10-2004-x64
6alolanvulp..._4.mp4
windows7-x64
1alolanvulp..._4.mp4
windows10-2004-x64
6alolanvulp..._5.mp4
windows7-x64
1alolanvulp..._5.mp4
windows10-2004-x64
6alolanvulp..._1.mp4
windows7-x64
1alolanvulp..._1.mp4
windows10-2004-x64
6alolanvulp..._2.mp4
windows7-x64
1alolanvulp..._2.mp4
windows10-2004-x64
6Analysis
-
max time kernel
141s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/10/2024, 13:50
Static task
static1
Behavioral task
behavioral1
Sample
PocketCampfire_v2_WindowsInstaller.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PocketCampfire_v2_WindowsInstaller.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/modern-header.bmp
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
alolanvulpix/alolanvulpix_oral_f_1.mp4
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
alolanvulpix/alolanvulpix_oral_f_1.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
alolanvulpix/alolanvulpix_oral_f_2.mp4
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
alolanvulpix/alolanvulpix_oral_f_2.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
alolanvulpix/alolanvulpix_oral_f_3.mp4
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
alolanvulpix/alolanvulpix_oral_f_3.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
alolanvulpix/alolanvulpix_oral_f_4.mp4
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
alolanvulpix/alolanvulpix_oral_f_4.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
alolanvulpix/alolanvulpix_oral_f_5.mp4
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
alolanvulpix/alolanvulpix_oral_f_5.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
alolanvulpix/alolanvulpix_oral_m_1.mp4
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
alolanvulpix/alolanvulpix_oral_m_1.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
alolanvulpix/alolanvulpix_oral_m_2.mp4
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
alolanvulpix/alolanvulpix_oral_m_2.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
alolanvulpix/alolanvulpix_oral_m_3.mp4
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
alolanvulpix/alolanvulpix_oral_m_3.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
alolanvulpix/alolanvulpix_oral_m_4.mp4
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
alolanvulpix/alolanvulpix_oral_m_4.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
alolanvulpix/alolanvulpix_oral_m_5.mp4
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
alolanvulpix/alolanvulpix_oral_m_5.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
alolanvulpix/alolanvulpix_sex_f_1.mp4
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
alolanvulpix/alolanvulpix_sex_f_1.mp4
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
alolanvulpix/alolanvulpix_sex_f_2.mp4
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
alolanvulpix/alolanvulpix_sex_f_2.mp4
Resource
win10v2004-20241007-en
General
-
Target
alolanvulpix/alolanvulpix_oral_m_3.mp4
-
Size
2.7MB
-
MD5
ec7fd99cd734726b30b92a55f72a4699
-
SHA1
016e3b649f0a927fde96269335deeb1f79cd76f0
-
SHA256
4517e56b92ece512f08418b929703b26586e8723d2e81c7a45bfae5e4ed46282
-
SHA512
114e485aa8df55b2f24ec27ae939c2dc987485400d0d529b15cd00bd817266fc66f43a63f9c3059422f9184a6cd649c230fffbd7636ca4fce7c00e4ee728c75c
-
SSDEEP
49152:85BMKKSD0w7uah2VCUpg6YeAKcVZeg7A/K/LuTDQbb4J2V1Znbh2:ShKSDKp974ZPAiqTsEgZbI
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2448 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2448 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2448 vlc.exe Token: SeIncBasePriorityPrivilege 2448 vlc.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe 2448 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2448 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\alolanvulpix\alolanvulpix_oral_m_3.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2448