Malware Analysis Report

2025-04-03 13:31

Sample ID 241109-2d7hqssqas
Target VRCDC_1.2_win-x64.zip
SHA256 14a0b76354738918f75e0b867546da436d63385b14a94fce85d83c7266f5faf3
Tags
discovery persistence privilege_escalation
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

14a0b76354738918f75e0b867546da436d63385b14a94fce85d83c7266f5faf3

Threat Level: Likely malicious

The file VRCDC_1.2_win-x64.zip was found to be: Likely malicious.

Malicious Activity Summary

discovery persistence privilege_escalation

Drops file in Drivers directory

Checks computer location settings

Event Triggered Execution: Netsh Helper DLL

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of SendNotifyMessage

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Gathers network information

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 22:29

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-09 22:29

Reported

2024-11-09 22:31

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe"

Signatures

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe N/A

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\ipconfig.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4836 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe C:\Windows\SYSTEM32\cmd.exe
PID 4836 wrote to memory of 3924 N/A C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe C:\Windows\SYSTEM32\cmd.exe
PID 3924 wrote to memory of 1520 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 3924 wrote to memory of 1520 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 4836 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe C:\Windows\SYSTEM32\cmd.exe
PID 4836 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe C:\Windows\SYSTEM32\cmd.exe
PID 1992 wrote to memory of 2668 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 1992 wrote to memory of 2668 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 4836 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe C:\Windows\SYSTEM32\cmd.exe
PID 4836 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe C:\Windows\SYSTEM32\cmd.exe
PID 4760 wrote to memory of 4200 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 4760 wrote to memory of 4200 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 4836 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe C:\Windows\SYSTEM32\cmd.exe
PID 4836 wrote to memory of 556 N/A C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe C:\Windows\SYSTEM32\cmd.exe
PID 556 wrote to memory of 3452 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 556 wrote to memory of 3452 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 4836 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe C:\Windows\SYSTEM32\cmd.exe
PID 4836 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe C:\Windows\SYSTEM32\cmd.exe
PID 2236 wrote to memory of 3808 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 2236 wrote to memory of 3808 N/A C:\Windows\SYSTEM32\cmd.exe C:\Windows\system32\netsh.exe
PID 4836 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe C:\Windows\system32\cmd.exe
PID 4836 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe C:\Windows\system32\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe

"C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe"

C:\Windows\SYSTEM32\cmd.exe

"cmd.exe" /c ipconfig /flushdns

C:\Windows\system32\ipconfig.exe

ipconfig /flushdns

C:\Windows\SYSTEM32\cmd.exe

"cmd" /c ipconfig /release

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\SYSTEM32\cmd.exe

"cmd" /c ipconfig /renew

C:\Windows\system32\ipconfig.exe

ipconfig /renew

C:\Windows\SYSTEM32\cmd.exe

"cmd" /c netsh winsock reset

C:\Windows\system32\netsh.exe

netsh winsock reset

C:\Windows\SYSTEM32\cmd.exe

"cmd" /c netsh int ip reset

C:\Windows\system32\netsh.exe

netsh int ip reset

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\win-x64\Bat\StartVRC_NoVR.bat""

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\StopExit.m4a"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 8.179.89.13.in-addr.arpa udp

Files

memory/4836-0-0x00007FFB49F1B000-0x00007FFB49F1C000-memory.dmp

memory/4836-1-0x0000000180000000-0x000000018004F000-memory.dmp

memory/4836-5-0x0000026639FA0000-0x0000026639FD1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\win-x64\Bat\StartVRC_NoVR.bat

MD5 297bda8f07850f89cf6e2567f7dd2cef
SHA1 e4a4fe276f9ba3c1421a3eef6624859109d9a348
SHA256 24409f432ec016f13dae2d4536dcc8ff7b08f92d7781ad070b8c147cbb843374
SHA512 6946d0b8da6afe5846d0f9fb0fc139650844d6799e0458765052e818b8927b2df5810e587d70ebf955c43a92ad36ece5172e4f9616321d8c11199f20c849d3dc

memory/1116-17-0x00007FF6624E0000-0x00007FF6625D8000-memory.dmp

memory/1116-18-0x00007FFB5E200000-0x00007FFB5E234000-memory.dmp

memory/1116-21-0x00007FFB60C70000-0x00007FFB60C87000-memory.dmp

memory/1116-26-0x00007FFB5CE10000-0x00007FFB5CE21000-memory.dmp

memory/1116-28-0x00007FFB59C70000-0x00007FFB59CB1000-memory.dmp

memory/1116-25-0x00007FFB5E1E0000-0x00007FFB5E1FD000-memory.dmp

memory/1116-27-0x00007FFB4A430000-0x00007FFB4A63B000-memory.dmp

memory/1116-32-0x00007FFB59D40000-0x00007FFB59D51000-memory.dmp

memory/1116-31-0x00007FFB5CDF0000-0x00007FFB5CE08000-memory.dmp

memory/1116-30-0x00007FFB5CC50000-0x00007FFB5CC71000-memory.dmp

memory/1116-34-0x00007FFB59C30000-0x00007FFB59C41000-memory.dmp

memory/1116-33-0x00007FFB59C50000-0x00007FFB59C61000-memory.dmp

memory/1116-24-0x00007FFB5E290000-0x00007FFB5E2A1000-memory.dmp

memory/1116-23-0x00007FFB5E310000-0x00007FFB5E327000-memory.dmp

memory/1116-35-0x00007FFB49380000-0x00007FFB495D3000-memory.dmp

memory/1116-22-0x00007FFB5F150000-0x00007FFB5F161000-memory.dmp

memory/1116-19-0x00007FFB4A040000-0x00007FFB4A2F6000-memory.dmp

memory/1116-20-0x00007FFB61DC0000-0x00007FFB61DD8000-memory.dmp

memory/1116-29-0x00007FFB46980000-0x00007FFB47A30000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 22:29

Reported

2024-11-09 22:31

Platform

win7-20240903-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe

"C:\Users\Admin\AppData\Local\Temp\win-x64\VRC-Deep-Clean.exe"

C:\Windows\explorer.exe

"C:\Windows\explorer.exe"

Network

N/A

Files

N/A