Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
26/04/2026, 17:33
General
- Target AutoClicker.exe
- Size 850KB
- Sample260426-v41dsads41
- SHA256 e4a3b0ce536c0996082311077ac65a096d9e6bbf404c6e6a155ecefb32e864c5
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 11 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"C:\Users\Admin\AppData\Local\Temp\AutoClicker.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RedoUnregister.3gpp"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
vlc-qt-interface.ini.NlY764
vlc-qt-interface.ini.lock
memory/1344-31-0x00007FF90B9B0000-0x00007FF90B9D2000-memory.dmp
memory/1344-72-0x00007FF8F8EF0000-0x00007FF8F8F3F000-memory.dmp
memory/1344-30-0x00007FF90C0C0000-0x00007FF90C0D9000-memory.dmp
memory/1344-29-0x00007FF90F250000-0x00007FF90F261000-memory.dmp
memory/1344-77-0x00007FF8FC510000-0x00007FF8FC535000-memory.dmp
memory/1344-33-0x00007FF8F95D0000-0x00007FF8F9960000-memory.dmp
memory/1344-67-0x00007FF8F8F40000-0x00007FF8F914B000-memory.dmp
memory/1344-40-0x00007FF90BD10000-0x00007FF90BD21000-memory.dmp
memory/1344-41-0x00007FF8FA910000-0x00007FF8FA9E2000-memory.dmp
memory/1344-71-0x00007FF8FA870000-0x00007FF8FA908000-memory.dmp
memory/1344-22-0x00007FF90BD30000-0x00007FF90BD64000-memory.dmp
memory/1344-56-0x00007FF90AA30000-0x00007FF90AA48000-memory.dmp
memory/1344-44-0x00007FF8F9240000-0x00007FF8F9328000-memory.dmp
memory/1344-39-0x00007FF90BF10000-0x00007FF90BF24000-memory.dmp
memory/1344-43-0x00007FF8F9330000-0x00007FF8F95C6000-memory.dmp
memory/1344-65-0x00007FF8FC540000-0x00007FF8FC551000-memory.dmp
memory/1344-32-0x00007FF90ACB0000-0x00007FF90ACDB000-memory.dmp
memory/1344-63-0x00007FF8FC560000-0x00007FF8FC571000-memory.dmp
memory/1344-62-0x00007FF8FC580000-0x00007FF8FC59A000-memory.dmp
memory/1344-46-0x00007FF8F9150000-0x00007FF8F9233000-memory.dmp
memory/1344-50-0x00007FF9007F0000-0x00007FF900831000-memory.dmp
memory/1344-59-0x00007FF901850000-0x00007FF90187D000-memory.dmp
memory/1344-53-0x00007FF90AAA0000-0x00007FF90AACF000-memory.dmp
memory/1344-58-0x00007FF902A80000-0x00007FF902AA6000-memory.dmp
memory/2476-66-0x00007FF8FC540000-0x00007FF8FC551000-memory.dmp
memory/2476-24-0x00007FF90BD10000-0x00007FF90BD21000-memory.dmp
memory/2476-57-0x00007FF902A80000-0x00007FF902AA6000-memory.dmp
memory/2476-54-0x00007FF90AAA0000-0x00007FF90AACF000-memory.dmp
memory/2476-51-0x00007FF9007F0000-0x00007FF900831000-memory.dmp
memory/2476-60-0x00007FF901850000-0x00007FF90187D000-memory.dmp
memory/2476-13-0x00007FF90BD30000-0x00007FF90BD64000-memory.dmp
memory/2476-61-0x00007FF8FC580000-0x00007FF8FC59A000-memory.dmp
memory/2476-47-0x00007FF8F9150000-0x00007FF8F9233000-memory.dmp
memory/2476-12-0x00007FF7E1520000-0x00007FF7E1618000-memory.dmp
memory/2476-45-0x00007FF8F9240000-0x00007FF8F9328000-memory.dmp
memory/2476-64-0x00007FF8FC560000-0x00007FF8FC571000-memory.dmp
memory/2476-15-0x00007FF90F250000-0x00007FF90F261000-memory.dmp
memory/2476-14-0x00007FF8F9B90000-0x00007FF8F9E46000-memory.dmp
memory/2476-17-0x00007FF90B9B0000-0x00007FF90B9D2000-memory.dmp
memory/2476-23-0x00007FF90BF10000-0x00007FF90BF24000-memory.dmp
memory/2476-18-0x00007FF90ACB0000-0x00007FF90ACDB000-memory.dmp
memory/2476-68-0x00007FF8F8F40000-0x00007FF8F914B000-memory.dmp
memory/2476-70-0x00007FF8FA870000-0x00007FF8FA908000-memory.dmp
memory/2476-55-0x00007FF90AA30000-0x00007FF90AA48000-memory.dmp
memory/2476-19-0x00007FF8F95D0000-0x00007FF8F9960000-memory.dmp
memory/2476-16-0x00007FF90C0C0000-0x00007FF90C0D9000-memory.dmp
memory/2476-73-0x00007FF8F8EF0000-0x00007FF8F8F3F000-memory.dmp
memory/2476-26-0x00007FF8FA910000-0x00007FF8FA9E2000-memory.dmp
memory/2476-74-0x00007FF8FC510000-0x00007FF8FC535000-memory.dmp
memory/2476-42-0x00007FF8F9330000-0x00007FF8F95C6000-memory.dmp
memory/3076-36-0x00007FF90B9B0000-0x00007FF90B9D2000-memory.dmp
memory/3076-48-0x00007FF90BF10000-0x00007FF90BF24000-memory.dmp
memory/3076-38-0x00007FF8F95D0000-0x00007FF8F9960000-memory.dmp
memory/3076-20-0x00007FF7E1520000-0x00007FF7E1618000-memory.dmp
memory/3076-27-0x00007FF90BD30000-0x00007FF90BD64000-memory.dmp
memory/3076-35-0x00007FF90C0C0000-0x00007FF90C0D9000-memory.dmp
memory/3076-52-0x00007FF8FA910000-0x00007FF8FA9E2000-memory.dmp
memory/3076-37-0x00007FF90ACB0000-0x00007FF90ACDB000-memory.dmp
memory/3076-69-0x00007FF8F9330000-0x00007FF8F95C6000-memory.dmp
memory/3076-49-0x00007FF90BD10000-0x00007FF90BD21000-memory.dmp
memory/3076-34-0x00007FF90F250000-0x00007FF90F261000-memory.dmp
memory/3680-10-0x0000019CEEEE0000-0x0000019CEEFFE000-memory.dmp
memory/3992-9-0x00000204A41F0000-0x00000204A430E000-memory.dmp
memory/4972-7-0x0000000001AA0000-0x00000000020A2000-memory.dmp