Analysis
- user interaction
yes - max time kernel
1799s - max time network
1805s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
20/04/2026, 04:31
General
- Target Family-music-desktop.exe
- Size 142.1MB
- Sample260420-e5hx5acy9s
- SHA256 c1c10e39958ecd71de39fa71747e0431a3505a3f1afa1607246a1eac69f1a1f9
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Modifies registry class 8 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=gpu-process --disable-gpu-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1500 --field-trial-handle=1720,i,17375915541234138591,7591875229226763033,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --mojo-platform-channel-handle=1900 --field-trial-handle=1720,i,17375915541234138591,7591875229226763033,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2264 --field-trial-handle=1720,i,17375915541234138591,7591875229226763033,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --mojo-platform-channel-handle=2692 --field-trial-handle=1720,i,17375915541234138591,7591875229226763033,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --mojo-platform-channel-handle=2700 --field-trial-handle=1720,i,17375915541234138591,7591875229226763033,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --node-integration-in-worker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2880 --field-trial-handle=1720,i,17375915541234138591,7591875229226763033,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --disable-gpu-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=908 --field-trial-handle=1720,i,17375915541234138591,7591875229226763033,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3c4 0x2401⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
4ec11524-5ebc-435e-a38c-a7bc9c07918f.tmp.node
61fbbd9c-f66e-4ea0-b0a8-9265728bcd18.tmp.node
b8ceea59-d1a0-464a-8495-dfa48db191f6.tmp.node
config_v2.json
config_v2.json
config_v2.json.tmp-66596463759eb461
hot_key.json
Preferences
Preferences~RFe587d49.TMP
CURRENT
default.dic
memory/3064-453-0x0000029CCB920000-0x0000029CCB975000-memory.dmp
memory/3088-488-0x000002906B9B0000-0x000002906B9B1000-memory.dmp
memory/3088-490-0x000002906B9B0000-0x000002906B9B1000-memory.dmp
memory/3088-495-0x000002906B8A0000-0x000002906B8F5000-memory.dmp
memory/3088-484-0x000002906B9B0000-0x000002906B9B1000-memory.dmp
memory/3088-483-0x000002906B9B0000-0x000002906B9B1000-memory.dmp
memory/3088-482-0x000002906B9B0000-0x000002906B9B1000-memory.dmp
memory/3088-489-0x000002906B9B0000-0x000002906B9B1000-memory.dmp
memory/3088-491-0x000002906B9B0000-0x000002906B9B1000-memory.dmp
memory/3088-494-0x000002906B9B0000-0x000002906B9B1000-memory.dmp
memory/3088-493-0x000002906B9B0000-0x000002906B9B1000-memory.dmp
memory/3088-492-0x000002906B9B0000-0x000002906B9B1000-memory.dmp
memory/5420-417-0x00007FFF99AE0000-0x00007FFF99AE1000-memory.dmp
memory/5448-420-0x00007FFF98680000-0x00007FFF98681000-memory.dmp
memory/5448-421-0x00007FFF9A4F0000-0x00007FFF9A4F1000-memory.dmp