Analysis
- max time kernel
149s - max time network
204s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 21:09
General
- Target th06nc/data/bgm/th06_13.opus
- Size 4.1MB
- Sample260910-zzghbsweld
- SHA256 13143aecae90f5c22b9105f818f5b7aa6108727b40f0de226380d111be426d4c
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\th06nc\data\bgm\th06_13.opus1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\th06nc\data\bgm\th06_13.opus"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4432-0-0x00007FF9146AD000-0x00007FF9146AF000-memory.dmp
memory/4432-1-0x00007FF914400000-0x00007FF9146B6000-memory.dmp
memory/4432-2-0x00007FF914400000-0x00007FF9146B6000-memory.dmp
memory/4432-3-0x00007FF914400000-0x00007FF9146B6000-memory.dmp
memory/4432-4-0x00007FF914400000-0x00007FF9146B6000-memory.dmp
memory/4432-5-0x00007FF914400000-0x00007FF9146B6000-memory.dmp
memory/4432-6-0x00007FF914400000-0x00007FF9146B6000-memory.dmp
memory/4432-7-0x00007FF914400000-0x00007FF9146B6000-memory.dmp
memory/4432-8-0x00007FF914400000-0x00007FF9146B6000-memory.dmp
memory/4432-9-0x00007FF914400000-0x00007FF9146B6000-memory.dmp
memory/4432-14-0x00007FF914400000-0x00007FF9146B6000-memory.dmp
memory/4432-15-0x00007FF752630000-0x00007FF752728000-memory.dmp
memory/4432-16-0x00007FF91BD50000-0x00007FF91BD84000-memory.dmp
memory/4432-21-0x00007FF914160000-0x00007FF91418B000-memory.dmp
memory/4432-18-0x00007FF9212B0000-0x00007FF9212C1000-memory.dmp
memory/4432-20-0x00007FF914190000-0x00007FF9141B2000-memory.dmp
memory/4432-19-0x00007FF9141C0000-0x00007FF9141D9000-memory.dmp
memory/4432-25-0x00007FF913CB0000-0x00007FF913D82000-memory.dmp
memory/4432-26-0x00007FF913A10000-0x00007FF913CA6000-memory.dmp
memory/4432-24-0x00007FF913D90000-0x00007FF913DA1000-memory.dmp
memory/4432-23-0x00007FF913DB0000-0x00007FF913DC4000-memory.dmp
memory/4432-22-0x00007FF913DD0000-0x00007FF914160000-memory.dmp
memory/4432-27-0x00007FF913920000-0x00007FF913A08000-memory.dmp
memory/4432-36-0x00007FF9136D0000-0x00007FF9136E1000-memory.dmp
memory/4432-35-0x00007FF9136F0000-0x00007FF913701000-memory.dmp
memory/4432-34-0x00007FF913710000-0x00007FF91372A000-memory.dmp
memory/4432-33-0x00007FF913730000-0x00007FF91375D000-memory.dmp
memory/4432-32-0x00007FF913760000-0x00007FF913786000-memory.dmp
memory/4432-31-0x00007FF913790000-0x00007FF9137A8000-memory.dmp
memory/4432-30-0x00007FF9137B0000-0x00007FF9137DF000-memory.dmp
memory/4432-28-0x00007FF913830000-0x00007FF913913000-memory.dmp
memory/4432-29-0x00007FF9137E0000-0x00007FF913821000-memory.dmp
memory/4432-37-0x00007FF9134C0000-0x00007FF9136CB000-memory.dmp
memory/4432-38-0x00007FF913420000-0x00007FF9134B8000-memory.dmp
memory/4432-39-0x00007FF9133D0000-0x00007FF91341F000-memory.dmp
memory/4432-40-0x00007FF9133A0000-0x00007FF9133C5000-memory.dmp
memory/4432-43-0x00007FF9132B0000-0x00007FF9132C2000-memory.dmp
memory/4432-42-0x00007FF9132D0000-0x00007FF9132EB000-memory.dmp
memory/4432-41-0x00007FF9132F0000-0x00007FF91339B000-memory.dmp
memory/4432-45-0x0000022202C80000-0x0000022202F49000-memory.dmp
memory/4432-46-0x00007FF908F10000-0x00007FF909155000-memory.dmp
memory/4432-44-0x0000022201410000-0x0000022202C7F000-memory.dmp