Analysis
- user interaction
yes - max time kernel
151s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
24/08/2026, 19:01
General
- Target head-mingw/citra-qt.exe
- Size 55.0MB
- Sample260824-xpn4basdma
- SHA256 9719fd8350821bc8f8d83bc9174fbf92457ba64739383cf2e4e1c17780f07e4e
Malware Config
Signatures
- Drops desktop.ini file(s) 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 10 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\head-mingw\citra-qt.exe"C:\Users\Admin\AppData\Local\Temp\head-mingw\citra-qt.exe"1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
desktop.ini
memory/568-38-0x000001FFF2410000-0x000001FFF2A90000-memory.dmp
memory/4136-27-0x00007FFD761E0000-0x00007FFD76275000-memory.dmp
memory/4136-22-0x000000006BCD0000-0x000000006C208000-memory.dmp
memory/4136-36-0x000000006AB40000-0x000000006AB53000-memory.dmp
memory/4136-35-0x000000006AB60000-0x000000006ACB8000-memory.dmp
memory/4136-30-0x000000006FC40000-0x00000000714F4000-memory.dmp
memory/4136-34-0x00007FFD5C110000-0x00007FFD5F5DD000-memory.dmp
memory/4136-31-0x000000006AED0000-0x000000006B042000-memory.dmp
memory/4136-29-0x000000006B050000-0x000000006B1B7000-memory.dmp
memory/4136-18-0x0000000000400000-0x0000000001400000-memory.dmp
memory/4136-25-0x00007FFD7D8B0000-0x00007FFD7D969000-memory.dmp
memory/4136-23-0x000000006B760000-0x000000006BCC9000-memory.dmp
memory/4136-21-0x000000006C210000-0x000000006C302000-memory.dmp
memory/4136-20-0x0000000061440000-0x000000006155B000-memory.dmp
memory/4136-26-0x00007FFD6B540000-0x00007FFD6BB5B000-memory.dmp
memory/4136-37-0x000000006AB20000-0x000000006AB33000-memory.dmp
memory/4136-32-0x000000006ACF0000-0x000000006AECD000-memory.dmp
memory/4136-28-0x00007FFD742B0000-0x00007FFD74356000-memory.dmp
memory/4136-24-0x000000006B1C0000-0x000000006B75E000-memory.dmp
memory/4136-19-0x000000006C310000-0x000000006C3A8000-memory.dmp
memory/4136-33-0x000000006ACC0000-0x000000006ACE7000-memory.dmp
memory/4136-44-0x000000006B760000-0x000000006BCC9000-memory.dmp
memory/4136-45-0x000000006B1C0000-0x000000006B75E000-memory.dmp
memory/4136-84-0x000000006B760000-0x000000006BCC9000-memory.dmp
memory/4136-144-0x000000006B760000-0x000000006BCC9000-memory.dmp
memory/4136-145-0x000000006B1C0000-0x000000006B75E000-memory.dmp
memory/4136-164-0x000000006B760000-0x000000006BCC9000-memory.dmp
memory/4136-184-0x000000006B760000-0x000000006BCC9000-memory.dmp
memory/4136-204-0x000000006B760000-0x000000006BCC9000-memory.dmp
memory/4136-224-0x000000006B760000-0x000000006BCC9000-memory.dmp
memory/4136-244-0x000000006B760000-0x000000006BCC9000-memory.dmp
memory/4136-264-0x000000006B760000-0x000000006BCC9000-memory.dmp
memory/4136-284-0x000000006B760000-0x000000006BCC9000-memory.dmp