2727f2739579932c4319feb3e484cb9be3b0e0d0ca36ab773ea19ead06c8db3a

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
out/vlc.exe
Size 943KB
Sample260727-ppb5rasxax
SHA256 2727f2739579932c4319feb3e484cb9be3b0e0d0ca36ab773ea19ead06c8db3a
MD5 0f403fbfe09131e82cf5222bf6cd29c2
SHA1 c24c9bd3e6f7ed82b8143bce59954bf81e91cc32
SHA512 287ad20576b48e4f2639ebbae5b35a5dd31cf0cf6988793ffeb4ed3f759143a97059995c5537486869353ad2cc42f55cf24a24abc0a7c11825a0d8549f1269ff
SSDEEP 24576:qJ5BOnKF/GBXXPj460HvjdF8rhaRUON0tITU5E:qhOnKuEPN0tZa
TLSH
T111255A66EA4384F0DE5705F1550BFBFBA9349F198020CD6FE288DE94FBB2C532469225
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5988	vlc.exe
3448	vlc.exe

Loads dropped DLL 2 IoCs

pid	Process
5988	vlc.exe
3448	vlc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vlc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	vlc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\TaskApp = "\"C:\\ProgramData\\vlc\\vlc.exe\" -i"	vlc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	vlc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3448	vlc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1092	1492	vlc.exe	90
PID 1492 wrote to memory of 5988	1492	vlc.exe	92

C:\Users\Admin\AppData\Local\Temp\out\vlc.exe
"C:\Users\Admin\AppData\Local\Temp\out\vlc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\1.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1092
- C:\ProgramData\vlc\vlc.exe
  "C:\ProgramData\vlc\vlc.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5988

C:\ProgramData\vlc\vlc.exe
"C:\ProgramData\vlc\vlc.exe" -i
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

libvlc.dll

Path C:\ProgramData\vlc\libvlc.dll
Size 15KB
SHA256 4b79e9865140e210afea6b2ad95e5d95760ce309dd41e02ea52e438f351679a8
MD5 fca947d53208f48bc20d37e59fe794a7
SHA1 1ede9f124cbe2fdbde0419692e8b63f58cf046a1
SHA512 205631e33059a2f3665b6a04ca085a98b62ba7f062a92e875626c4bfaa457545ee686317ed95c24e27c3513ff2bc8d71cccb68f8598ae76fbd1ea5d731ba12d8
SSDEEP 192:LwzRT6qvpmjzpf8WoKSgYQ/fEWFrZIy3y5+36:LwzRT6qhgfNoLc/OKy5+q
TLSH
T1BF62E789BB4194F3C1B78EB14DCBDFF69EA43A528443EAB1FB9ED20D78317026448449
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vlc.exe

Path C:\ProgramData\vlc\vlc.exe
Size 943KB
SHA256 2727f2739579932c4319feb3e484cb9be3b0e0d0ca36ab773ea19ead06c8db3a
MD5 0f403fbfe09131e82cf5222bf6cd29c2
SHA1 c24c9bd3e6f7ed82b8143bce59954bf81e91cc32
SHA512 287ad20576b48e4f2639ebbae5b35a5dd31cf0cf6988793ffeb4ed3f759143a97059995c5537486869353ad2cc42f55cf24a24abc0a7c11825a0d8549f1269ff
SSDEEP 24576:qJ5BOnKF/GBXXPj460HvjdF8rhaRUON0tITU5E:qhOnKuEPN0tZa
TLSH
T111255A66EA4384F0DE5705F1550BFBFBA9349F198020CD6FE288DE94FBB2C532469225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1.bat

Path C:\Users\Public\1.bat
Size 411B
SHA256 51bc32ae55bcfe14ed63ef14cca86c3d51e714e00d7c668ea72ad2dae97b700f
MD5 62c15398e0472fa754ef970d15242145
SHA1 6aea4dd7f4d77ae23734408c56cff76b025df6d8
SHA512 cfc5467507fc382ef229b283fbc25536e03d45f5d1625eb3a8f119215e6639918894302da40a94b124c6f3e19c637bb6dd595f3a453941814eb2adaabe3e6077
TLSH
T141E06D0186D7C7BA594650AB0FAEA18CD0640A3C2F8AB750AB64C85CA1C344EB6C33C1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1492-0-0x0000000000573000-0x0000000000574000-memory.dmp

Download

memory/1492-15-0x00000000004A0000-0x0000000000592000-memory.dmp

Download

memory/1492-14-0x00000000749D0000-0x00000000749DB000-memory.dmp

Download

memory/1492-1-0x00000000004A0000-0x0000000000592000-memory.dmp

Download

memory/3448-20-0x0000000001B20000-0x0000000001E20000-memory.dmp

Download

memory/3448-27-0x0000000000D80000-0x0000000000E72000-memory.dmp

Download

memory/3448-28-0x00000000749D0000-0x00000000749DB000-memory.dmp

Download

memory/3448-35-0x0000000001B20000-0x0000000001E20000-memory.dmp

Download

memory/5988-17-0x0000000000D80000-0x0000000000E72000-memory.dmp

Download

memory/5988-26-0x00000000749D0000-0x00000000749DB000-memory.dmp

Download

memory/5988-37-0x0000000000D80000-0x0000000000E72000-memory.dmp

Download

memory/5988-38-0x00000000749D0000-0x00000000749DB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads