Overview
overview
7Static
static
7�...WX.exe
windows10-2004-x64
5�...WX.exe
windows11-ltsc_2024-x64
5�...e).gba
windows10-2004-x64
3�...e).gba
windows11-ltsc_2024-x64
3�...n).gba
windows10-2004-x64
3�...n).gba
windows11-ltsc_2024-x64
3�...WX.exe
windows10-2004-x64
5�...WX.exe
windows11-ltsc_2024-x64
6�...1).gba
windows10-2004-x64
3�...1).gba
windows11-ltsc_2024-x64
3�...WX.exe
windows10-2004-x64
5�...WX.exe
windows11-ltsc_2024-x64
6�...n).gba
windows10-2004-x64
3�...n).gba
windows11-ltsc_2024-x64
3�...xa.dll
windows10-2004-x64
3�...xa.dll
windows11-ltsc_2024-x64
3�...nt.dll
windows10-2004-x64
5�...nt.dll
windows11-ltsc_2024-x64
5�...se.dll
windows10-2004-x64
1�...se.dll
windows11-ltsc_2024-x64
1�...ia.exe
windows10-2004-x64
6�...ia.exe
windows11-ltsc_2024-x64
6�...ar.dll
windows10-2004-x64
3�...ar.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 11:01
Behavioral task
behavioral1
Sample
2 GBA/VisualBoyAdvance-M-WX.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
2 GBA/VisualBoyAdvance-M-WX.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
2 GBA/roms/Super Mario Advance (USA, Europe).gba
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
2 GBA/roms/Super Mario Advance (USA, Europe).gba
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
2 GBA/roms/Super Mario Advance - Super Mario USA + Mario Brothers (Japan).gba
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
2 GBA/roms/Super Mario Advance - Super Mario USA + Mario Brothers (Japan).gba
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
GBA/VisualBoyAdvance-M-WX.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
GBA/VisualBoyAdvance-M-WX.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
GBA/roms/Famicom Mini 01 - Super Mario Bros. (Japan) (En) (Rev 1).gba
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
GBA/roms/Famicom Mini 01 - Super Mario Bros. (Japan) (En) (Rev 1).gba
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
2հ GBA/VisualBoyAdvance-M-WX.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
2հ GBA/VisualBoyAdvance-M-WX.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
2հ GBA/roms/Famicom Mini 21 - Super Mario Bros. 2 (Japan).gba
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
2հ GBA/roms/Famicom Mini 21 - Super Mario Bros. 2 (Japan).gba
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
1+2հ/7zxa.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
1+2հ/7zxa.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral17
Sample
1+2հ/kailleraclient.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
1+2հ/kailleraclient.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
1+2հ/language/Chinese.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
1+2հ/language/Chinese.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
1+2հ/nestopia.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
1+2հ/nestopia.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
1+2հ/unrar.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
1+2հ/unrar.dll
Resource
win11ltsc2024-20260709-en
General
- Target GBA/VisualBoyAdvance-M-WX.exe
- Size 2.1MB
- Sample260802-m4z41sysaw
- SHA256 1be4fe42ae7d4038e8c698bd29eb9debddb31fa3583a5dbdf5dd110653a6bdfe
- MD5 a48cb861ef3b8bbff1ec2252cdb58130
- SHA1 5ee42cfe92294e4a84409552ccefb81eb5b1e696
- SHA512 0104c48e1df4527c2116b02d3ce0afa752e59387ed19ff08d848791436a2528bfafb94f20826bdf91780f289c7ce945c105dcb199b725cf0a68b4e37482f70ce
- SSDEEP 49152:zyy5kTHYXxKglzBOeVIe5X5dmjkefWc2GaE/+mwzmc:zy+kTYXxKglFJy65wfz2GaE/+mpc
- TLSH T1F3A533CE79278469C1EF41F7FF26658B560F9CCE0B0E598A3552B2B35473BA0621834E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral7/memory/3572-0-0x0000000000400000-0x000000000110F000-memory.dmp upx behavioral7/memory/3572-2-0x0000000000400000-0x000000000110F000-memory.dmp upx - Program crash 1 IoCs
pid pid_target Process procid_target 3872 3572 WerFault.exe 86 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VisualBoyAdvance-M-WX.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3572 VisualBoyAdvance-M-WX.exe 3572 VisualBoyAdvance-M-WX.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ GBA\VisualBoyAdvance-M-WX.exe"C:\Users\Admin\AppData\Local\Temp\ GBA\VisualBoyAdvance-M-WX.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3572 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 6922⤵
- Program crash
PID:3872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3572 -ip 35721⤵PID:4868