Overview
overview
7Static
static
3moirai1.06.zip
windows10-2004-x64
1moirai1.06.zip
windows11-ltsc_2024-x64
1Moirai/dat...on.png
windows10-2004-x64
1Moirai/dat...on.png
windows11-ltsc_2024-x64
1Moirai/dat...or.png
windows10-2004-x64
1Moirai/dat...or.png
windows11-ltsc_2024-x64
1Moirai/dat...in.xml
windows10-2004-x64
3Moirai/dat...in.xml
windows11-ltsc_2024-x64
1Moirai/dat...ls.png
windows10-2004-x64
1Moirai/dat...ls.png
windows11-ltsc_2024-x64
1Moirai/dat...ve.ogg
windows10-2004-x64
7Moirai/dat...ve.ogg
windows11-ltsc_2024-x64
1Moirai/dat...e2.ogg
windows10-2004-x64
7Moirai/dat...e2.ogg
windows11-ltsc_2024-x64
1Moirai/dat...g1.wav
windows10-2004-x64
6Moirai/dat...g1.wav
windows11-ltsc_2024-x64
1Moirai/dat...ed.wav
windows10-2004-x64
6Moirai/dat...ed.wav
windows11-ltsc_2024-x64
1Moirai/dat..._3.wav
windows10-2004-x64
6Moirai/dat..._3.wav
windows11-ltsc_2024-x64
1Moirai/dat..._1.wav
windows10-2004-x64
6Moirai/dat..._1.wav
windows11-ltsc_2024-x64
1Moirai/dat..._2.wav
windows10-2004-x64
6Moirai/dat..._2.wav
windows11-ltsc_2024-x64
1Moirai/dat..._3.wav
windows10-2004-x64
6Moirai/dat..._3.wav
windows11-ltsc_2024-x64
1Moirai/dat..._4.wav
windows10-2004-x64
6Moirai/dat..._4.wav
windows11-ltsc_2024-x64
1Moirai/dat...e1.wav
windows10-2004-x64
6Moirai/dat...e1.wav
windows11-ltsc_2024-x64
1Moirai/dat...p1.wav
windows10-2004-x64
6Moirai/dat...p1.wav
windows11-ltsc_2024-x64
1Analysis
- max time kernel
298s - max time network
300s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/07/2026, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
moirai1.06.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
moirai1.06.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Moirai/data/levels/town/collision.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Moirai/data/levels/town/collision.png
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Moirai/data/levels/town/floor.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Moirai/data/levels/town/floor.png
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Moirai/data/levels/town/main.xml
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Moirai/data/levels/town/main.xml
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Moirai/data/levels/town/walls.png
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Moirai/data/levels/town/walls.png
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Moirai/data/music/cave.ogg
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Moirai/data/music/cave.ogg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Moirai/data/music/village2.ogg
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Moirai/data/music/village2.ogg
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Moirai/data/sfx/crying1.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Moirai/data/sfx/crying1.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Moirai/data/sfx/door_locked.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Moirai/data/sfx/door_locked.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Moirai/data/sfx/footstep_grass_3.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Moirai/data/sfx/footstep_grass_3.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Moirai/data/sfx/footstep_stone_1.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Moirai/data/sfx/footstep_stone_1.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
Moirai/data/sfx/footstep_stone_2.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Moirai/data/sfx/footstep_stone_2.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
Moirai/data/sfx/footstep_stone_3.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Moirai/data/sfx/footstep_stone_3.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Moirai/data/sfx/footstep_stone_4.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Moirai/data/sfx/footstep_stone_4.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
Moirai/data/sfx/rock_scrape1.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Moirai/data/sfx/rock_scrape1.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
Moirai/data/sfx/sheep1.wav
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Moirai/data/sfx/sheep1.wav
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
General
- Target Moirai/data/sfx/footstep_stone_4.wav
- Size 138KB
- Sample260727-x9z2bacr21
- SHA256 b9ba2d22a4f9207997f8e250155c3e06ab731cc8b24c51b253f68895c78b72c0
- MD5 1a828daded46b927b6f3139d775c7835
- SHA1 ec719bb04cfde7c54cae4cca692041b76bfe5479
- SHA512 80b8d172b3f436cbfd2007a1e09dd0bd8e68ef32259ba68d7e42780ab6b720597cd081816ec7b67b510efe937d6dd3fe88d1aaee65a5a2269c89b41a34e5493b
- SSDEEP 3072:/fOl8sLLtjeWYHfhNl2tOvUvt2bfA34Hn8iklESGuzL00lJYEc5Z6Ei:HOPLtKXHvl2gokbfAinB8ESXMrE+u
- TLSH T13AD3BE79D2B7728ABB5D289DF113CF580B4173CA49274AAC145CF387B1EB292A580D2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops desktop.ini file(s) 7 IoCs
description ioc Process File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\A: wmplayer.exe File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll svchost.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language unregmp2.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{0CBEC340-CAED-431D-867C-457638EC0035} wmplayer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer wmplayer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-wmplayer\CLSID = "{cd3afa96-b84f-48f0-9393-7edc34128127}" wmplayer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 2224 wmplayer.exe Token: SeCreatePagefilePrivilege 2224 wmplayer.exe Token: SeShutdownPrivilege 4596 unregmp2.exe Token: SeCreatePagefilePrivilege 4596 unregmp2.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2224 wmplayer.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2224 wrote to memory of 3676 2224 wmplayer.exe 85 PID 3676 wrote to memory of 4596 3676 unregmp2.exe 86
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Open "C:\Users\Admin\AppData\Local\Temp\Moirai\data\sfx\footstep_stone_4.wav"1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost1⤵
- Drops file in Windows directory
PID:1656
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 384KB
- SHA256 48ef6c07237ebb2772b4ace5a724b6fe081eb4dc3f596955ab0fbe8d0fc064d7
- MD5 f63420442b67dfd4d341e8db8dd5ec7f
- SHA1 6472a539757ba7ccade29887f2d86eea95b36af0
- SHA512 d43f7f4dedaf56f2b54951ef05fc7168e9d0d3829d5a8678ed6df4c10509259a4a86b0bc6e017397aa981a3908c5b00688bb668f7bec32a2a73fd6333fa82c83
- SSDEEP 768:v7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrzcooJImdba5aSt3MjxngbCjPC:59tQeoVYo
- TLSH T198841037E560A098DB3C75B1E2AC5B4CBD72250B11E006822FB4B57E7A237D4CA4F5E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
- Size 1024KB
- SHA256 e31e4be59b6d9a920dc6c73970edbfd826a2d9ed737e583a7a6030be7f5785cc
- MD5 7a033230430bc9685d4ba36f7d4a503f
- SHA1 b864f203f154d2ce23508865008d4f0fa32e7c7e
- SHA512 4f451bb688f9df638320da7f7debf9b1aa3ed5d5a2c589f0b916f349e06a894d6ee5f4d6ebb69d2bfaa88309124490758e36f72b755356e4be7e89679014a877
- SSDEEP 768:C0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaO:sZP2tFP3vqY8fqEMxTaBacg
- TLSH T142257437D190B0C5CE2C7171E9ED8F09BA23B10B11A052465FF8A57E7A633D99D0B1EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\LocalMLS_3.wmdb
- Size 68KB
- SHA256 787fa7c89f384d926cfdf94e0238a70f66173aff4270be969e1ebb4e943f32a3
- MD5 280c5f646c61238d36e2af55c32b2d63
- SHA1 370a27c806be639a07d73e03dfa78feb6500b646
- SHA512 9209315c6ca715b8021e32cd3d89b9639268aa6d18df188f448ecc7fd7716d894ea8490dbcd0c472c1ba8960cef842e53d3a94302c3e6096e3842625f35edf87
- SSDEEP 96:DPyltnNXtMUMUstS7XtXUMbstQUMlst9OXtGL2tPLXtNtwAtUt:DJnqnFnC
- TLSH T1AA63011162E59ACDF3F72E313AF654122E3A38A15E39D58D0614429E0DA0F28DEB4F27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD
- Size 498B
- SHA256 644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf
- MD5 90be2701c8112bebc6bd58a7de19846e
- SHA1 a95be407036982392e2e684fb9ff6602ecad6f1e
- SHA512 d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe
- TLSH T15BF027AD4BE26C59323110903E78A0B0DD05F0B3645B3A6970CE5C7679E7D9C0407FD1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
- Size 9KB
- SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
- MD5 7050d5ae8acfbe560fa11073fef8185d
- SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
- SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
- SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
- TLSH T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
- Size 1KB
- SHA256 5bae64deca72ca28678775804c127c86411cf30f40cd72438b508ba7fa3b1cc0
- MD5 4e67f8af1f5e0dd26f8c43a00a51f28c
- SHA1 f1093ab1fd2563e910d985499390d4b7410b27af
- SHA512 46dcb7d8409f2c0e39d122ca11532d92c64d27da76f3fdea0b9353782a60216d9cdb415b6dd4afa5d9264e9e4c41cadaa5e4fc1c5e865075194663e6ba4751b8
- TLSH T162216B5B1B8EE47089E01BE75DEC8E2573BBD7CA83A0D065B38CA439890352D5B3D16D
- MD5 SHA1 SHA512 TLSH