Analysis
- max time kernel
149s - max time network
187s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 21:09
General
- Target th06nc/data/bgm/th06_11.opus
- Size 3.0MB
- Sample260910-zzghbsweld
- SHA256 d8db415ae88af211338945f65b1c918a2cc8ddbaf2061d283093e63a87017432
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\th06nc\data\bgm\th06_11.opus1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\th06nc\data\bgm\th06_11.opus"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1308-0-0x00007FFE8B5ED000-0x00007FFE8B5EF000-memory.dmp
memory/1308-2-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-1-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-3-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-4-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-5-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-6-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-7-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-9-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-8-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-10-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-11-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-12-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-13-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-14-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-15-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-16-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-17-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-18-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-19-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-20-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-21-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-22-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-24-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-23-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-26-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-25-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-27-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-28-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-29-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-30-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-35-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-36-0x00007FFE8B340000-0x00007FFE8B5F6000-memory.dmp
memory/1308-37-0x00007FF7E9B30000-0x00007FF7E9C28000-memory.dmp
memory/1308-38-0x00007FFE8BBB0000-0x00007FFE8BBE4000-memory.dmp
memory/1308-43-0x00007FFE8B310000-0x00007FFE8B33B000-memory.dmp
memory/1308-42-0x00007FFE8C1F0000-0x00007FFE8C212000-memory.dmp
memory/1308-41-0x00007FFE8FCC0000-0x00007FFE8FCD9000-memory.dmp
memory/1308-40-0x00007FFE90BD0000-0x00007FFE90BE1000-memory.dmp
memory/1308-46-0x00007FFE8BB90000-0x00007FFE8BBA1000-memory.dmp
memory/1308-44-0x00007FFE7E1B0000-0x00007FFE7E540000-memory.dmp
memory/1308-50-0x00007FFE7DC50000-0x00007FFE7DD33000-memory.dmp
memory/1308-58-0x00007FFE7DBE0000-0x00007FFE7DBF1000-memory.dmp
memory/1308-57-0x00007FFE7DC00000-0x00007FFE7DC11000-memory.dmp
memory/1308-67-0x000002B896A50000-0x000002B896A75000-memory.dmp
memory/1308-71-0x000002B898DB0000-0x000002B898F30000-memory.dmp
memory/1308-70-0x000002B898960000-0x000002B898977000-memory.dmp
memory/1308-69-0x000002B8988F0000-0x000002B898957000-memory.dmp
memory/1308-68-0x00007FFE77660000-0x00007FFE778A5000-memory.dmp
memory/1308-66-0x000002B898870000-0x000002B8988C7000-memory.dmp
memory/1308-65-0x00007FFE7D7C0000-0x00007FFE7D7D2000-memory.dmp
memory/1308-64-0x00007FFE7D7E0000-0x00007FFE7D7FB000-memory.dmp
memory/1308-63-0x00007FFE7D800000-0x00007FFE7D8AB000-memory.dmp
memory/1308-62-0x00007FFE7D8B0000-0x00007FFE7D8D5000-memory.dmp
memory/1308-61-0x00007FFE7D8E0000-0x00007FFE7D92F000-memory.dmp
memory/1308-60-0x00007FFE7D930000-0x00007FFE7D9C8000-memory.dmp
memory/1308-55-0x00007FFE7DC20000-0x00007FFE7DC4D000-memory.dmp
memory/1308-54-0x00007FFE844E0000-0x00007FFE84506000-memory.dmp
memory/1308-53-0x00007FFE8B270000-0x00007FFE8B288000-memory.dmp
memory/1308-52-0x00007FFE8B290000-0x00007FFE8B2BF000-memory.dmp
memory/1308-51-0x00007FFE8B2C0000-0x00007FFE8B301000-memory.dmp
memory/1308-56-0x00007FFE7EB30000-0x00007FFE7EB4A000-memory.dmp
memory/1308-48-0x00007FFE7DE30000-0x00007FFE7E0C6000-memory.dmp
memory/1308-49-0x00007FFE7DD40000-0x00007FFE7DE28000-memory.dmp
memory/1308-47-0x00007FFE7E0D0000-0x00007FFE7E1A2000-memory.dmp
memory/1308-45-0x00007FFE8C090000-0x00007FFE8C0A4000-memory.dmp
memory/1308-59-0x00007FFE7D9D0000-0x00007FFE7DBDB000-memory.dmp