Analysis
- user interaction
yes - max time kernel
150s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
11/08/2026, 10:33
General
- Target 4_5780522172162251845.webm
- Size 85KB
- Sample260811-mlx7psxtbz
- SHA256 f3ee747534c0ca194f01d6d2a1e0a5610ef30d4ab885b2c0dfb8579e00f3683e
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 21 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\4_5780522172162251845.webm1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\4_5780522172162251845.webm"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
vlc-qt-interface.ini
memory/4520-0-0x00007FFC8E3BD000-0x00007FFC8E3BF000-memory.dmp
memory/4520-1-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-2-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-3-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-4-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-5-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-6-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-7-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-8-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-10-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-9-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-11-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-12-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-13-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-15-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-14-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-17-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-16-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-18-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-20-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-19-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-21-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-26-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-28-0x00007FFC9B030000-0x00007FFC9B064000-memory.dmp
memory/4520-33-0x00007FFC9A580000-0x00007FFC9A5AB000-memory.dmp
memory/4520-32-0x00007FFC9A7F0000-0x00007FFC9A812000-memory.dmp
memory/4520-31-0x00007FFC9AC90000-0x00007FFC9ACA9000-memory.dmp
memory/4520-30-0x00007FFC9B2A0000-0x00007FFC9B2B1000-memory.dmp
memory/4520-29-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-27-0x00007FF75AF20000-0x00007FF75B018000-memory.dmp
memory/4520-34-0x00007FFC8DB90000-0x00007FFC8DF20000-memory.dmp
memory/4520-36-0x00007FFC9ADB0000-0x00007FFC9ADC1000-memory.dmp
memory/4520-35-0x00007FFC9ADD0000-0x00007FFC9ADE4000-memory.dmp
memory/4520-37-0x00007FFC95740000-0x00007FFC95812000-memory.dmp
memory/4520-38-0x00007FFC8D8F0000-0x00007FFC8DB86000-memory.dmp
memory/4520-39-0x00007FFC8D800000-0x00007FFC8D8E8000-memory.dmp
memory/4520-48-0x00007FFC9A4C0000-0x00007FFC9A4D1000-memory.dmp
memory/4520-47-0x00007FFC9A4E0000-0x00007FFC9A4F1000-memory.dmp
memory/4520-46-0x00007FFC9A500000-0x00007FFC9A51A000-memory.dmp
memory/4520-50-0x00007FFC8D460000-0x00007FFC8D4F8000-memory.dmp
memory/4520-56-0x000001457A510000-0x000001457A7D9000-memory.dmp
memory/4520-55-0x00007FFC93B10000-0x00007FFC93B22000-memory.dmp
memory/4520-54-0x00007FFC996B0000-0x00007FFC996CB000-memory.dmp
memory/4520-53-0x00007FFC8D360000-0x00007FFC8D40B000-memory.dmp
memory/4520-52-0x00007FFC93FF0000-0x00007FFC94015000-memory.dmp
memory/4520-51-0x00007FFC8D410000-0x00007FFC8D45F000-memory.dmp
memory/4520-49-0x00007FFC8D500000-0x00007FFC8D70B000-memory.dmp
memory/4520-45-0x00007FFC9A520000-0x00007FFC9A54D000-memory.dmp
memory/4520-44-0x00007FFC9A550000-0x00007FFC9A576000-memory.dmp
memory/4520-43-0x00007FFC9AC70000-0x00007FFC9AC88000-memory.dmp
memory/4520-42-0x00007FFC9AD30000-0x00007FFC9AD5F000-memory.dmp
memory/4520-41-0x00007FFC9AD60000-0x00007FFC9ADA1000-memory.dmp
memory/4520-40-0x00007FFC8D710000-0x00007FFC8D7F3000-memory.dmp
memory/4520-57-0x00007FFC83850000-0x00007FFC83A95000-memory.dmp
memory/4520-60-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-65-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-66-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-67-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp
memory/4520-70-0x00007FFC8E110000-0x00007FFC8E3C6000-memory.dmp