Analysis
- max time kernel
149s - max time network
184s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
25/06/2026, 13:22
General
- Target DELTARUNE.Chapter.5/DELTARUNE.Chapter.5/mus/nightmare_nes.ogg
- Size 39KB
- Sample260625-qmd21act2x
- SHA256 897a6e5928253c2cb59e5a6fc889f0f9ebbde1e8e2a42cdb47d2c556e1d579e9
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\DELTARUNE.Chapter.5\DELTARUNE.Chapter.5\mus\nightmare_nes.ogg1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\DELTARUNE.Chapter.5\DELTARUNE.Chapter.5\mus\nightmare_nes.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2208-0-0x00007FFA8EADD000-0x00007FFA8EADF000-memory.dmp
memory/2208-1-0x00007FFA8E830000-0x00007FFA8EAE6000-memory.dmp
memory/2208-2-0x00007FFA8E830000-0x00007FFA8EAE6000-memory.dmp
memory/2208-3-0x00007FFA8E830000-0x00007FFA8EAE6000-memory.dmp
memory/2208-5-0x00007FFA8E830000-0x00007FFA8EAE6000-memory.dmp
memory/2208-7-0x00007FFA8E830000-0x00007FFA8EAE6000-memory.dmp
memory/2208-4-0x00007FFA8E830000-0x00007FFA8EAE6000-memory.dmp
memory/2208-6-0x00007FFA8E830000-0x00007FFA8EAE6000-memory.dmp
memory/2208-10-0x00007FFA8E830000-0x00007FFA8EAE6000-memory.dmp
memory/2208-9-0x00007FFA8E830000-0x00007FFA8EAE6000-memory.dmp
memory/2208-8-0x00007FFA8E830000-0x00007FFA8EAE6000-memory.dmp
memory/2208-15-0x00007FFA8E830000-0x00007FFA8EAE6000-memory.dmp
memory/2208-16-0x00007FFA8E830000-0x00007FFA8EAE6000-memory.dmp
memory/2208-17-0x00007FF7712D0000-0x00007FF7713C8000-memory.dmp
memory/2208-18-0x00007FFA9B200000-0x00007FFA9B234000-memory.dmp
memory/2208-22-0x00007FFA9C790000-0x00007FFA9C7B2000-memory.dmp
memory/2208-21-0x00007FFA9C920000-0x00007FFA9C939000-memory.dmp
memory/2208-20-0x00007FFA9C970000-0x00007FFA9C981000-memory.dmp
memory/2208-23-0x00007FFA8F9A0000-0x00007FFA8F9CB000-memory.dmp
memory/2208-26-0x00007FFA8F980000-0x00007FFA8F991000-memory.dmp
memory/2208-24-0x00007FFA8E4A0000-0x00007FFA8E830000-memory.dmp
memory/2208-25-0x00007FFA95D60000-0x00007FFA95D74000-memory.dmp
memory/2208-27-0x00007FFA8E3C0000-0x00007FFA8E492000-memory.dmp
memory/2208-29-0x00007FFA8E030000-0x00007FFA8E118000-memory.dmp
memory/2208-28-0x00007FFA8E120000-0x00007FFA8E3B6000-memory.dmp
memory/2208-30-0x00007FFA8DF40000-0x00007FFA8E023000-memory.dmp
memory/2208-31-0x00007FFA8DEF0000-0x00007FFA8DF31000-memory.dmp
memory/2208-32-0x00007FFA8F950000-0x00007FFA8F97F000-memory.dmp
memory/2208-38-0x00007FFA8DE10000-0x00007FFA8DE21000-memory.dmp
memory/2208-37-0x00007FFA8DE30000-0x00007FFA8DE41000-memory.dmp
memory/2208-36-0x00007FFA8DE50000-0x00007FFA8DE6A000-memory.dmp
memory/2208-35-0x00007FFA8DE70000-0x00007FFA8DE9D000-memory.dmp
memory/2208-34-0x00007FFA8DEA0000-0x00007FFA8DEC6000-memory.dmp
memory/2208-33-0x00007FFA8DED0000-0x00007FFA8DEE8000-memory.dmp
memory/2208-42-0x00007FFA8DAE0000-0x00007FFA8DB05000-memory.dmp
memory/2208-39-0x00007FFA8DC00000-0x00007FFA8DE0B000-memory.dmp
memory/2208-40-0x00007FFA8DB60000-0x00007FFA8DBF8000-memory.dmp
memory/2208-41-0x00007FFA8DB10000-0x00007FFA8DB5F000-memory.dmp
memory/2208-45-0x00007FFA8D9F0000-0x00007FFA8DA02000-memory.dmp
memory/2208-44-0x00007FFA8DA10000-0x00007FFA8DA2B000-memory.dmp
memory/2208-43-0x00007FFA8DA30000-0x00007FFA8DADB000-memory.dmp
memory/2208-47-0x0000019F384A0000-0x0000019F384B2000-memory.dmp
memory/2208-49-0x0000019F3A3F0000-0x0000019F3A401000-memory.dmp
memory/2208-48-0x0000019F384C0000-0x0000019F384DD000-memory.dmp
memory/2208-46-0x0000019F3A450000-0x0000019F3BCBF000-memory.dmp
memory/2208-50-0x00007FFA84430000-0x00007FFA84675000-memory.dmp