Analysis
- max time kernel
149s - max time network
197s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/09/2026, 00:46
General
- Target DELTARUNE/mus/thrashmachine.ogg
- Size 1.3MB
- Sample260908-a4nd1ayerd
- SHA256 7721c2d07657ac74cc8cdb714b9d936c405607e1b30e15fa33140ea48cd500ff
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\DELTARUNE\mus\thrashmachine.ogg1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\DELTARUNE\mus\thrashmachine.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2260-0-0x00007FF805DED000-0x00007FF805DEF000-memory.dmp
memory/2260-1-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-2-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-3-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-4-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-5-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-6-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-9-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-8-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-7-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-10-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-11-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-12-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-13-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-14-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-15-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-16-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-17-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-18-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-19-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-20-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-21-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-23-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-22-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-25-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-24-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-26-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-27-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-28-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-33-0x00007FF756750000-0x00007FF756848000-memory.dmp
memory/2260-37-0x00007FF806200000-0x00007FF806219000-memory.dmp
memory/2260-38-0x00007FF805B10000-0x00007FF805B32000-memory.dmp
memory/2260-36-0x00007FF80BC30000-0x00007FF80BC41000-memory.dmp
memory/2260-35-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp
memory/2260-34-0x00007FF811940000-0x00007FF811974000-memory.dmp
memory/2260-39-0x00007FF805AE0000-0x00007FF805B0B000-memory.dmp
memory/2260-43-0x00007FF8059E0000-0x00007FF805AB2000-memory.dmp
memory/2260-40-0x00007FF804C00000-0x00007FF804F90000-memory.dmp
memory/2260-42-0x00007FF805AC0000-0x00007FF805AD1000-memory.dmp
memory/2260-41-0x00007FF806190000-0x00007FF8061A4000-memory.dmp
memory/2260-44-0x00007FF804960000-0x00007FF804BF6000-memory.dmp
memory/2260-46-0x00007FF804780000-0x00007FF804863000-memory.dmp
memory/2260-50-0x00007FF804720000-0x00007FF804746000-memory.dmp
memory/2260-49-0x00007FF805970000-0x00007FF805988000-memory.dmp
memory/2260-48-0x00007FF804750000-0x00007FF80477F000-memory.dmp
memory/2260-47-0x00007FF805990000-0x00007FF8059D1000-memory.dmp
memory/2260-45-0x00007FF804870000-0x00007FF804958000-memory.dmp
memory/2260-54-0x00007FF804690000-0x00007FF8046A1000-memory.dmp
memory/2260-53-0x00007FF8046B0000-0x00007FF8046C1000-memory.dmp
memory/2260-52-0x00007FF8046D0000-0x00007FF8046EA000-memory.dmp
memory/2260-51-0x00007FF8046F0000-0x00007FF80471D000-memory.dmp
memory/2260-55-0x00007FF804480000-0x00007FF80468B000-memory.dmp
memory/2260-56-0x00007FF8043E0000-0x00007FF804478000-memory.dmp
memory/2260-63-0x000001E12C1C0000-0x000001E12C1D2000-memory.dmp
memory/2260-62-0x000001E12C190000-0x000001E12C1B4000-memory.dmp
memory/2260-61-0x00007FF804270000-0x00007FF804282000-memory.dmp
memory/2260-60-0x00007FF804290000-0x00007FF8042AB000-memory.dmp
memory/2260-59-0x00007FF8042B0000-0x00007FF80435B000-memory.dmp
memory/2260-58-0x00007FF804360000-0x00007FF804385000-memory.dmp
memory/2260-57-0x00007FF804390000-0x00007FF8043DF000-memory.dmp
memory/2260-64-0x00007FFFFBE40000-0x00007FFFFC085000-memory.dmp
memory/2260-227-0x00007FF805B40000-0x00007FF805DF6000-memory.dmp