Analysis
- max time kernel
298s - max time network
237s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/07/2026, 19:33
General
- Target Moirai/data/music/village2.ogg
- Size 2.2MB
- Sample260727-x9z2bacr21
- SHA256 cfebceaa58fbe3aca636043d3dbeb33120729902deb4f2733f3c1d3104c80d0f
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Moirai\data\music\village2.ogg1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Moirai\data\music\village2.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4544-0-0x00007FF9484CD000-0x00007FF9484CF000-memory.dmp
memory/4544-1-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-2-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-3-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-4-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-5-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-6-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-7-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-8-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-9-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-10-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-11-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-16-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-18-0x00007FF955570000-0x00007FF9555A4000-memory.dmp
memory/4544-17-0x00007FF644420000-0x00007FF644518000-memory.dmp
memory/4544-23-0x00007FF9554E0000-0x00007FF95550B000-memory.dmp
memory/4544-22-0x00007FF955510000-0x00007FF955532000-memory.dmp
memory/4544-21-0x00007FF9560E0000-0x00007FF9560F9000-memory.dmp
memory/4544-26-0x00007FF9554A0000-0x00007FF9554B1000-memory.dmp
memory/4544-24-0x00007FF947CA0000-0x00007FF948030000-memory.dmp
memory/4544-27-0x00007FF9553C0000-0x00007FF955492000-memory.dmp
memory/4544-28-0x00007FF947A00000-0x00007FF947C96000-memory.dmp
memory/4544-29-0x00007FF947910000-0x00007FF9479F8000-memory.dmp
memory/4544-38-0x00007FF9477E0000-0x00007FF9477F1000-memory.dmp
memory/4544-37-0x00007FF947800000-0x00007FF947811000-memory.dmp
memory/4544-36-0x00007FF948700000-0x00007FF94871A000-memory.dmp
memory/4544-45-0x00007FF9473C0000-0x00007FF9473D2000-memory.dmp
memory/4544-34-0x00007FF94DE60000-0x00007FF94DE86000-memory.dmp
memory/4544-47-0x000002E16B300000-0x000002E16B545000-memory.dmp
memory/4544-46-0x000002E16AAF0000-0x000002E16AEFE000-memory.dmp
memory/4544-44-0x00007FF9473E0000-0x00007FF9473FB000-memory.dmp
memory/4544-43-0x00007FF947400000-0x00007FF9474AB000-memory.dmp
memory/4544-42-0x00007FF9474B0000-0x00007FF9474D5000-memory.dmp
memory/4544-41-0x00007FF9474E0000-0x00007FF94752F000-memory.dmp
memory/4544-40-0x00007FF947530000-0x00007FF9475C8000-memory.dmp
memory/4544-39-0x00007FF9475D0000-0x00007FF9477DB000-memory.dmp
memory/4544-35-0x00007FF948980000-0x00007FF9489AD000-memory.dmp
memory/4544-33-0x00007FF9546F0000-0x00007FF954708000-memory.dmp
memory/4544-31-0x00007FF948720000-0x00007FF948761000-memory.dmp
memory/4544-32-0x00007FF955110000-0x00007FF95513F000-memory.dmp
memory/4544-30-0x00007FF947820000-0x00007FF947903000-memory.dmp
memory/4544-25-0x00007FF9554C0000-0x00007FF9554D4000-memory.dmp
memory/4544-20-0x00007FF959150000-0x00007FF959161000-memory.dmp
memory/4544-50-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-112-0x00007FF948220000-0x00007FF9484D6000-memory.dmp
memory/4544-174-0x00007FF948220000-0x00007FF9484D6000-memory.dmp