Analysis
- user interaction
yes - max time kernel
1800s - max time network
1776s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 04:31
General
- Target Family-music-desktop.exe
- Size 142.1MB
- Sample260420-e5hx5acy9s
- SHA256 c1c10e39958ecd71de39fa71747e0431a3505a3f1afa1607246a1eac69f1a1f9
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Modifies trusted root certificate store through registry 1 TTPs 5 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Modifies registry class 8 IoCs
- Modifies system certificate store 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"1⤵
- Loads dropped DLL
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=gpu-process --disable-gpu-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1528 --field-trial-handle=1672,i,10513229525850135317,10326162969137280608,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --mojo-platform-channel-handle=1568 --field-trial-handle=1672,i,10513229525850135317,10326162969137280608,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2296 --field-trial-handle=1672,i,10513229525850135317,10326162969137280608,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --mojo-platform-channel-handle=2312 --field-trial-handle=1672,i,10513229525850135317,10326162969137280608,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --mojo-platform-channel-handle=2364 --field-trial-handle=1672,i,10513229525850135317,10326162969137280608,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --node-integration-in-worker --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2752 --field-trial-handle=1672,i,10513229525850135317,10326162969137280608,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe"C:\Users\Admin\AppData\Local\Temp\Family-music-desktop.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --disable-gpu-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Family-music-desktop" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 --field-trial-handle=1672,i,10513229525850135317,10326162969137280608,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004CC1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
5ee3ce28-458b-49a2-9dd0-a87d9bdf2c79.tmp.node
8ec70987-da60-4839-962d-5a2f5ff17e69.tmp.node
f2777497-a52c-41d5-b612-723cafcad59d.tmp.node
config_v2.json
config_v2.json
config_v2.json.tmp-66596495175edb23
hot_key.json
Preferences
Preferences~RFe580d1a.TMP
CURRENT
default.dic
memory/32-748-0x000001A8F8F30000-0x000001A8F8F31000-memory.dmp
memory/32-754-0x000001A8F8F30000-0x000001A8F8F31000-memory.dmp
memory/32-742-0x000001A8F8F30000-0x000001A8F8F31000-memory.dmp
memory/32-744-0x000001A8F8F30000-0x000001A8F8F31000-memory.dmp
memory/32-743-0x000001A8F8F30000-0x000001A8F8F31000-memory.dmp
memory/32-755-0x000001A8F7150000-0x000001A8F72FC000-memory.dmp
memory/32-751-0x000001A8F8F30000-0x000001A8F8F31000-memory.dmp
memory/32-752-0x000001A8F8F30000-0x000001A8F8F31000-memory.dmp
memory/32-753-0x000001A8F8F30000-0x000001A8F8F31000-memory.dmp
memory/32-750-0x000001A8F8F30000-0x000001A8F8F31000-memory.dmp
memory/32-749-0x000001A8F8F30000-0x000001A8F8F31000-memory.dmp
memory/1080-634-0x000002E18C3A0000-0x000002E18C54C000-memory.dmp
memory/2672-643-0x0000028361FB0000-0x000002836215C000-memory.dmp
memory/2988-642-0x0000028E83120000-0x0000028E832CC000-memory.dmp
memory/3980-641-0x00000245E0CC0000-0x00000245E0E6C000-memory.dmp
memory/5672-706-0x000001E1BE040000-0x000001E1BE0E3000-memory.dmp
memory/5672-653-0x000001E1BE040000-0x000001E1BE0E3000-memory.dmp
memory/5672-682-0x000001E1BE040000-0x000001E1BE0E3000-memory.dmp
memory/5672-840-0x000001E1BE040000-0x000001E1BE0E3000-memory.dmp
memory/5672-599-0x00007FFAC6570000-0x00007FFAC6571000-memory.dmp
memory/5672-792-0x000001E1BE040000-0x000001E1BE0E3000-memory.dmp
memory/5672-652-0x000001E1BDE90000-0x000001E1BE03C000-memory.dmp
memory/5684-633-0x0000024FD84B0000-0x0000024FD865C000-memory.dmp
memory/5716-692-0x0000022044D00000-0x0000022044DA3000-memory.dmp
memory/5716-655-0x0000022044D00000-0x0000022044DA3000-memory.dmp
memory/5716-654-0x0000022044B40000-0x0000022044CEC000-memory.dmp
memory/5716-602-0x00007FFAC6680000-0x00007FFAC6681000-memory.dmp
memory/5716-663-0x0000022044D00000-0x0000022044DA3000-memory.dmp
memory/5716-603-0x0000022044CF0000-0x0000022044CF1000-memory.dmp
memory/5716-906-0x0000022044D00000-0x0000022044DA3000-memory.dmp