Analysis
- user interaction
yes - max time kernel
40s - max time network
45s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/07/2026, 04:31
General
- Target 0A4A11160051390E65C0F203E83F69CF_As-Sahab_1431_Safar_Mahriqa_BM_--_Landi_Kotal.divx
- Size 7.4MB
- Sample260701-e5pexaet4n
- SHA256 c0e5a3231764edda8feb7b3b18848746fc827b2099d52b7abb9e40c03f04d0d9
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 16 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\0A4A11160051390E65C0F203E83F69CF_As-Sahab_1431_Safar_Mahriqa_BM_--_Landi_Kotal.divx1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\0A4A11160051390E65C0F203E83F69CF_As-Sahab_1431_Safar_Mahriqa_BM_--_Landi_Kotal.divx"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3252-0-0x00007FFB86B6D000-0x00007FFB86B6F000-memory.dmp
memory/3252-1-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-2-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-3-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-4-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-6-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-5-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-7-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-8-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-10-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-9-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-11-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-12-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-13-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-14-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-15-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-16-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-17-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-18-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-19-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-24-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-25-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-26-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-27-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-31-0x00007FFB93890000-0x00007FFB938C4000-memory.dmp
memory/3252-35-0x00007FFB93EC0000-0x00007FFB93EE2000-memory.dmp
memory/3252-36-0x00007FFB93860000-0x00007FFB9388B000-memory.dmp
memory/3252-34-0x00007FFB94290000-0x00007FFB942A9000-memory.dmp
memory/3252-33-0x00007FFB943D0000-0x00007FFB943E1000-memory.dmp
memory/3252-32-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp
memory/3252-30-0x00007FF7074E0000-0x00007FF7075D8000-memory.dmp
memory/3252-39-0x00007FFB93840000-0x00007FFB93851000-memory.dmp
memory/3252-37-0x00007FFB85F20000-0x00007FFB862B0000-memory.dmp
memory/3252-40-0x00007FFB93760000-0x00007FFB93832000-memory.dmp
memory/3252-38-0x00007FFB94250000-0x00007FFB94264000-memory.dmp
memory/3252-41-0x00007FFB85C80000-0x00007FFB85F16000-memory.dmp
memory/3252-42-0x00007FFB85B90000-0x00007FFB85C78000-memory.dmp
memory/3252-51-0x00007FFB934D0000-0x00007FFB934E1000-memory.dmp
memory/3252-53-0x00007FFB86820000-0x00007FFB868B8000-memory.dmp
memory/3252-58-0x00007FFB86800000-0x00007FFB86812000-memory.dmp
memory/3252-62-0x0000028847270000-0x0000028847281000-memory.dmp
memory/3252-63-0x00007FFB7F6B0000-0x00007FFB7F8F5000-memory.dmp
memory/3252-61-0x0000028845550000-0x0000028845563000-memory.dmp
memory/3252-60-0x0000028845530000-0x0000028845541000-memory.dmp
memory/3252-59-0x00000288473F0000-0x00000288477FE000-memory.dmp
memory/3252-57-0x00007FFB93210000-0x00007FFB9322B000-memory.dmp
memory/3252-56-0x00007FFB857E0000-0x00007FFB8588B000-memory.dmp
memory/3252-55-0x00007FFB8DA60000-0x00007FFB8DA85000-memory.dmp
memory/3252-54-0x00007FFB8DA90000-0x00007FFB8DADF000-memory.dmp
memory/3252-52-0x00007FFB85890000-0x00007FFB85A9B000-memory.dmp
memory/3252-50-0x00007FFB936E0000-0x00007FFB936F1000-memory.dmp
memory/3252-48-0x00007FFB93700000-0x00007FFB9372D000-memory.dmp
memory/3252-47-0x00007FFB93730000-0x00007FFB93756000-memory.dmp
memory/3252-46-0x00007FFB93CF0000-0x00007FFB93D08000-memory.dmp
memory/3252-45-0x00007FFB93D10000-0x00007FFB93D3F000-memory.dmp
memory/3252-44-0x00007FFB93D40000-0x00007FFB93D81000-memory.dmp
memory/3252-43-0x00007FFB85AA0000-0x00007FFB85B83000-memory.dmp
memory/3252-49-0x00007FFB93CD0000-0x00007FFB93CEA000-memory.dmp
memory/3252-140-0x00007FF7074E0000-0x00007FF7075D8000-memory.dmp
memory/3252-141-0x00007FFB93890000-0x00007FFB938C4000-memory.dmp
memory/3252-143-0x00007FFB868C0000-0x00007FFB86B76000-memory.dmp