Analysis
- max time kernel
149s - max time network
200s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 21:09
General
- Target th06nc/data/bgm/th06_06.opus
- Size 3.6MB
- Sample260910-zzghbsweld
- SHA256 cf7880179a46a8cfb96c07e54dd0871d48c3cddd5c1fdd3bfc26f8b590b9a052
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\th06nc\data\bgm\th06_06.opus1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\th06nc\data\bgm\th06_06.opus"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3748-0-0x00007FFB1B00D000-0x00007FFB1B00F000-memory.dmp
memory/3748-1-0x00007FFB1AD60000-0x00007FFB1B016000-memory.dmp
memory/3748-2-0x00007FFB1AD60000-0x00007FFB1B016000-memory.dmp
memory/3748-3-0x00007FFB1AD60000-0x00007FFB1B016000-memory.dmp
memory/3748-4-0x00007FFB1AD60000-0x00007FFB1B016000-memory.dmp
memory/3748-5-0x00007FFB1AD60000-0x00007FFB1B016000-memory.dmp
memory/3748-6-0x00007FFB1AD60000-0x00007FFB1B016000-memory.dmp
memory/3748-7-0x00007FFB1AD60000-0x00007FFB1B016000-memory.dmp
memory/3748-9-0x00007FFB1AD60000-0x00007FFB1B016000-memory.dmp
memory/3748-8-0x00007FFB1AD60000-0x00007FFB1B016000-memory.dmp
memory/3748-10-0x00007FFB1AD60000-0x00007FFB1B016000-memory.dmp
memory/3748-11-0x00007FFB1AD60000-0x00007FFB1B016000-memory.dmp
memory/3748-12-0x00007FFB1AD60000-0x00007FFB1B016000-memory.dmp
memory/3748-13-0x00007FFB1AD60000-0x00007FFB1B016000-memory.dmp
memory/3748-18-0x00007FFB27970000-0x00007FFB27989000-memory.dmp
memory/3748-19-0x00007FFB27940000-0x00007FFB27962000-memory.dmp
memory/3748-26-0x00007FFB1A370000-0x00007FFB1A458000-memory.dmp
memory/3748-28-0x00007FFB1B8E0000-0x00007FFB1B921000-memory.dmp
memory/3748-35-0x00007FFB1A1C0000-0x00007FFB1A1D1000-memory.dmp
memory/3748-42-0x00007FFB19DA0000-0x00007FFB19DB2000-memory.dmp
memory/3748-46-0x0000020549CD0000-0x0000020549CE1000-memory.dmp
memory/3748-47-0x00007FFB114F0000-0x00007FFB11735000-memory.dmp
memory/3748-45-0x0000020549CA0000-0x0000020549CC4000-memory.dmp
memory/3748-44-0x0000020547DA0000-0x0000020547DB1000-memory.dmp
memory/3748-43-0x0000020549D70000-0x000002054A17E000-memory.dmp
memory/3748-41-0x00007FFB19DC0000-0x00007FFB19DDB000-memory.dmp
memory/3748-40-0x00007FFB19DE0000-0x00007FFB19E8B000-memory.dmp
memory/3748-39-0x00007FFB19E90000-0x00007FFB19EB5000-memory.dmp
memory/3748-38-0x00007FFB19EC0000-0x00007FFB19F0F000-memory.dmp
memory/3748-37-0x00007FFB19F10000-0x00007FFB19FA8000-memory.dmp
memory/3748-36-0x00007FFB19FB0000-0x00007FFB1A1BB000-memory.dmp
memory/3748-34-0x00007FFB1A1E0000-0x00007FFB1A1F1000-memory.dmp
memory/3748-33-0x00007FFB1A200000-0x00007FFB1A21A000-memory.dmp
memory/3748-32-0x00007FFB1A220000-0x00007FFB1A24D000-memory.dmp
memory/3748-31-0x00007FFB1A250000-0x00007FFB1A276000-memory.dmp
memory/3748-30-0x00007FFB27540000-0x00007FFB27558000-memory.dmp
memory/3748-29-0x00007FFB27890000-0x00007FFB278BF000-memory.dmp
memory/3748-27-0x00007FFB1A280000-0x00007FFB1A363000-memory.dmp
memory/3748-25-0x00007FFB1A460000-0x00007FFB1A6F6000-memory.dmp
memory/3748-20-0x00007FFB27910000-0x00007FFB2793B000-memory.dmp
memory/3748-24-0x00007FFB1A700000-0x00007FFB1A7D2000-memory.dmp
memory/3748-23-0x00007FFB278C0000-0x00007FFB278D1000-memory.dmp
memory/3748-21-0x00007FFB1A7E0000-0x00007FFB1AB70000-memory.dmp
memory/3748-22-0x00007FFB278E0000-0x00007FFB278F4000-memory.dmp
memory/3748-17-0x00007FFB2DBA0000-0x00007FFB2DBB1000-memory.dmp
memory/3748-15-0x00007FFB27D60000-0x00007FFB27D94000-memory.dmp
memory/3748-14-0x00007FF7739C0000-0x00007FF773AB8000-memory.dmp