782f999684f33104a22919440cb2327f4f3adffb7cd1a5dd4e8ff407e5864030

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
out/vlc
Size 741KB
Sample260727-ppb5rasxax
SHA256 782f999684f33104a22919440cb2327f4f3adffb7cd1a5dd4e8ff407e5864030
MD5 dc72ec29bf7bd40c48100240d5e5094a
SHA1 51e372f428e7ca53ee062eca09dab499a94bed16
SHA512 a3b9782af454b4f7ff22ffe4ceddc2e80edab31df760abdc99044ec7ed70ae9a2fa20debdd0a47548db7d2eb110d68322e73f915944ff6704b16c2fd9300d326
SSDEEP 12288:kVzOMQNTYJ9KdeJnmrWUu/AExzndWvycceAgQtGrZToDJYW6VjxGJ5YVA4UkMos8:UvtIEADAptGrZcJYZVj0J6VAfkMu
TLSH
T123F4236192105B5D94E1BC71EC3A7C702AEF5C15C20FE06ACFA6E3667939ABED70B404
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3544	vlc.exe
4468	vlc.exe

Loads dropped DLL 2 IoCs

pid	Process
3544	vlc.exe
4468	vlc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3108	cmd.exe
640	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\TaskApp = "\"C:\\ProgramData\\vlc\\vlc.exe\" -i"	vlc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	vlc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	vlc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4468	vlc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 2176	3108	cmd.exe	86
PID 2176 wrote to memory of 640	2176	vlc.exe	87
PID 2176 wrote to memory of 3544	2176	vlc.exe	89

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\out\vlc
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Users\Admin\AppData\Local\Temp\out\vlc.exe
  C:\Users\Admin\AppData\Local\Temp\out\vlc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:640
- - C:\ProgramData\vlc\vlc.exe
    "C:\ProgramData\vlc\vlc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:3544

C:\ProgramData\vlc\vlc.exe
"C:\ProgramData\vlc\vlc.exe" -i
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libvlc.dll

Path C:\ProgramData\vlc\libvlc.dll
Size 15KB
SHA256 4b79e9865140e210afea6b2ad95e5d95760ce309dd41e02ea52e438f351679a8
MD5 fca947d53208f48bc20d37e59fe794a7
SHA1 1ede9f124cbe2fdbde0419692e8b63f58cf046a1
SHA512 205631e33059a2f3665b6a04ca085a98b62ba7f062a92e875626c4bfaa457545ee686317ed95c24e27c3513ff2bc8d71cccb68f8598ae76fbd1ea5d731ba12d8
SSDEEP 192:LwzRT6qvpmjzpf8WoKSgYQ/fEWFrZIy3y5+36:LwzRT6qhgfNoLc/OKy5+q
TLSH
T1BF62E789BB4194F3C1B78EB14DCBDFF69EA43A528443EAB1FB9ED20D78317026448449
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc

Path C:\ProgramData\vlc\vlc
Size 741KB
SHA256 782f999684f33104a22919440cb2327f4f3adffb7cd1a5dd4e8ff407e5864030
MD5 dc72ec29bf7bd40c48100240d5e5094a
SHA1 51e372f428e7ca53ee062eca09dab499a94bed16
SHA512 a3b9782af454b4f7ff22ffe4ceddc2e80edab31df760abdc99044ec7ed70ae9a2fa20debdd0a47548db7d2eb110d68322e73f915944ff6704b16c2fd9300d326
SSDEEP 12288:kVzOMQNTYJ9KdeJnmrWUu/AExzndWvycceAgQtGrZToDJYW6VjxGJ5YVA4UkMos8:UvtIEADAptGrZcJYZVj0J6VAfkMu
TLSH
T123F4236192105B5D94E1BC71EC3A7C702AEF5C15C20FE06ACFA6E3667939ABED70B404
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe

Path C:\ProgramData\vlc\vlc.exe
Size 943KB
SHA256 2727f2739579932c4319feb3e484cb9be3b0e0d0ca36ab773ea19ead06c8db3a
MD5 0f403fbfe09131e82cf5222bf6cd29c2
SHA1 c24c9bd3e6f7ed82b8143bce59954bf81e91cc32
SHA512 287ad20576b48e4f2639ebbae5b35a5dd31cf0cf6988793ffeb4ed3f759143a97059995c5537486869353ad2cc42f55cf24a24abc0a7c11825a0d8549f1269ff
SSDEEP 24576:qJ5BOnKF/GBXXPj460HvjdF8rhaRUON0tITU5E:qhOnKuEPN0tZa
TLSH
T111255A66EA4384F0DE5705F1550BFBFBA9349F198020CD6FE288DE94FBB2C532469225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.bat

Path C:\Users\Public\1.bat
Size 411B
SHA256 51bc32ae55bcfe14ed63ef14cca86c3d51e714e00d7c668ea72ad2dae97b700f
MD5 62c15398e0472fa754ef970d15242145
SHA1 6aea4dd7f4d77ae23734408c56cff76b025df6d8
SHA512 cfc5467507fc382ef229b283fbc25536e03d45f5d1625eb3a8f119215e6639918894302da40a94b124c6f3e19c637bb6dd595f3a453941814eb2adaabe3e6077
TLSH
T141E06D0186D7C7BA594650AB0FAEA18CD0640A3C2F8AB750AB64C85CA1C344EB6C33C1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2176-24-0x00000000000C0000-0x00000000001B2000-memory.dmp

Download

memory/2176-25-0x0000000075C60000-0x0000000075C6B000-memory.dmp

Download

memory/2176-0-0x0000000002F70000-0x0000000003270000-memory.dmp

Download

memory/2176-27-0x0000000002F70000-0x0000000003270000-memory.dmp

Download

memory/3544-41-0x0000000000EC0000-0x0000000000FB2000-memory.dmp

Download

memory/3544-28-0x0000000003770000-0x0000000003A70000-memory.dmp

Download

memory/3544-53-0x0000000000EC0000-0x0000000000FB2000-memory.dmp

Download

memory/3544-55-0x0000000003770000-0x0000000003A70000-memory.dmp

Download

memory/3544-54-0x0000000074210000-0x000000007421B000-memory.dmp

Download

memory/3544-42-0x0000000074210000-0x000000007421B000-memory.dmp

Download

memory/4468-32-0x0000000002210000-0x0000000002510000-memory.dmp

Download

memory/4468-49-0x0000000002210000-0x0000000002510000-memory.dmp

Download

memory/4468-44-0x0000000074210000-0x000000007421B000-memory.dmp

Download

memory/4468-43-0x0000000000EC0000-0x0000000000FB2000-memory.dmp

Download

memory/4468-37-0x0000000002210000-0x0000000002510000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads