Analysis
- max time kernel
299s - max time network
293s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
31/05/2026, 03:45
General
- Target cinecraftx\soundflowx.exe
- Size 16.0MB
- Sample260531-ea7yrshs8s
- SHA256 dcc09facdb6ce0ccc05b9a937b03cf3fbe460912670da3ae858f666a16c0d67b
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cinecraftx\soundflowx.exe"C:\Users\Admin\AppData\Local\Temp\cinecraftx\soundflowx.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\GameXbox\msi.exeC:\GameXbox\msi.exe2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\GameXbox\gdbox.exeC:\GameXbox\gdbox.exe2⤵
- Executes dropped EXE
-
-
C:\GameXbox\RiverText.exeC:\GameXbox\RiverText.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\GameXbox\msi.exeC:\GameXbox\msi.exe1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\GameXbox\gdbox.exeC:\GameXbox\gdbox.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
RiverText.exe
gdbox.exe
msi.exe
memory/692-28-0x0000000000280000-0x000000000128B000-memory.dmp
memory/692-2-0x0000029E44BA0000-0x0000029E44BA1000-memory.dmp
memory/692-1-0x0000000000280000-0x000000000128B000-memory.dmp
memory/692-0-0x0000029E44BA0000-0x0000029E44BA1000-memory.dmp
memory/692-22-0x0000000000280000-0x000000000128B000-memory.dmp
memory/788-45-0x0000000000A70000-0x0000000001A7E000-memory.dmp
memory/788-37-0x0000000000A70000-0x0000000001A7E000-memory.dmp
memory/1268-43-0x0000000000A70000-0x0000000001A7E000-memory.dmp
memory/1268-23-0x000001FB90BA0000-0x000001FB90BA1000-memory.dmp
memory/1268-35-0x0000000000A70000-0x0000000001A7E000-memory.dmp
memory/1268-29-0x0000000000A70000-0x0000000001A7E000-memory.dmp
memory/2744-31-0x00000000009A0000-0x000000000171B000-memory.dmp
memory/2744-34-0x00000000009A0000-0x000000000171B000-memory.dmp
memory/3924-36-0x0000000000E40000-0x0000000001F35000-memory.dmp
memory/3924-40-0x0000000000E40000-0x0000000001F35000-memory.dmp
memory/3924-44-0x0000000000E40000-0x0000000001F35000-memory.dmp
memory/3924-30-0x0000000000E40000-0x0000000001F35000-memory.dmp
memory/3924-48-0x0000000000E40000-0x0000000001F35000-memory.dmp
memory/3924-80-0x0000000000E40000-0x0000000001F35000-memory.dmp
memory/5020-42-0x0000000000E40000-0x0000000001F35000-memory.dmp
memory/5020-38-0x0000000000E40000-0x0000000001F35000-memory.dmp
memory/5020-46-0x0000000000E40000-0x0000000001F35000-memory.dmp
memory/5020-50-0x0000000000E40000-0x0000000001F35000-memory.dmp
memory/5020-54-0x0000000000E40000-0x0000000001F35000-memory.dmp
memory/5020-58-0x0000000000E40000-0x0000000001F35000-memory.dmp
memory/5020-86-0x0000000000E40000-0x0000000001F35000-memory.dmp