Analysis
- user interaction
yes - max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
01/08/2026, 19:56
General
- Target iw3mp.exe
- Size 3.2MB
- Sample260801-ynn8csvgpc
- SHA256 e41fcd5921dfdcb8c71a76a605f71df4b5f6a525b5859e590e2dd9645f1fa893
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 35 IoCs
- Suspicious use of SendNotifyMessage 33 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\iw3mp.exe"C:\Users\Admin\AppData\Local\Temp\iw3mp.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\HideMeasure.aiff"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ml.xspf
vlc-qt-interface.ini
vlc-qt-interface.ini
vlc-qt-interface.ini.lock
vlcrc
memory/1304-10-0x00007FF676960000-0x00007FF676A58000-memory.dmp
memory/1304-11-0x00007FFB14390000-0x00007FFB143C4000-memory.dmp
memory/1304-12-0x00007FFB07D50000-0x00007FFB08006000-memory.dmp
memory/4584-69-0x00007FFAFC270000-0x00007FFAFC4B5000-memory.dmp
memory/4584-63-0x00007FFB06AB0000-0x00007FFB06AFF000-memory.dmp
memory/4584-44-0x00007FFB0E140000-0x00007FFB0E162000-memory.dmp
memory/4584-43-0x00007FFB13210000-0x00007FFB13229000-memory.dmp
memory/4584-42-0x00007FFB13F20000-0x00007FFB13F31000-memory.dmp
memory/4584-41-0x00007FFB079F0000-0x00007FFB07CA6000-memory.dmp
memory/4584-46-0x00007FFB07470000-0x00007FFB07800000-memory.dmp
memory/4584-49-0x00007FFB07390000-0x00007FFB07462000-memory.dmp
memory/4584-50-0x00007FFB070F0000-0x00007FFB07386000-memory.dmp
memory/4584-55-0x00007FFB06E70000-0x00007FFB06E88000-memory.dmp
memory/4584-61-0x00007FFB06BA0000-0x00007FFB06DAB000-memory.dmp
memory/4584-68-0x0000024F15420000-0x0000024F1548D000-memory.dmp
memory/4584-40-0x00007FFB14370000-0x00007FFB143A4000-memory.dmp
memory/4584-67-0x00007FFB06990000-0x00007FFB069A2000-memory.dmp
memory/4584-66-0x00007FFB069B0000-0x00007FFB069CB000-memory.dmp
memory/4584-65-0x00007FFB069D0000-0x00007FFB06A7B000-memory.dmp
memory/4584-64-0x00007FFB06A80000-0x00007FFB06AA5000-memory.dmp
memory/4584-45-0x00007FFB0E110000-0x00007FFB0E13B000-memory.dmp
memory/4584-62-0x00007FFB06B00000-0x00007FFB06B98000-memory.dmp
memory/4584-60-0x00007FFB06DB0000-0x00007FFB06DC1000-memory.dmp
memory/4584-59-0x00007FFB06DD0000-0x00007FFB06DE1000-memory.dmp
memory/4584-58-0x00007FFB06DF0000-0x00007FFB06E0A000-memory.dmp
memory/4584-57-0x00007FFB06E10000-0x00007FFB06E3D000-memory.dmp
memory/4584-56-0x00007FFB06E40000-0x00007FFB06E66000-memory.dmp
memory/4584-54-0x00007FFB06E90000-0x00007FFB06EBF000-memory.dmp
memory/4584-53-0x00007FFB06EC0000-0x00007FFB06F01000-memory.dmp
memory/4584-47-0x00007FFB0E0F0000-0x00007FFB0E104000-memory.dmp
memory/4584-52-0x00007FFB06F10000-0x00007FFB06FF3000-memory.dmp
memory/4584-51-0x00007FFB07000000-0x00007FFB070E8000-memory.dmp
memory/4584-48-0x00007FFB0DC10000-0x00007FFB0DC21000-memory.dmp
memory/4584-39-0x00007FF676960000-0x00007FF676A58000-memory.dmp
memory/4584-110-0x00007FFB14370000-0x00007FFB143A4000-memory.dmp
memory/4584-111-0x00007FFB079F0000-0x00007FFB07CA6000-memory.dmp
memory/4584-109-0x00007FF676960000-0x00007FF676A58000-memory.dmp