Analysis
- max time kernel
149s - max time network
187s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 21:09
General
- Target th06nc/data/bgm/th06_01.opus
- Size 3.0MB
- Sample260910-zzghbsweld
- SHA256 49a711314d9fb083f0b00c8fe083da43cd69efb7b023626bc34f9e3e213f22a2
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\th06nc\data\bgm\th06_01.opus1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\th06nc\data\bgm\th06_01.opus"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4548-0-0x00007FFC9BE8D000-0x00007FFC9BE8F000-memory.dmp
memory/4548-1-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-2-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-3-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-4-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-5-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-6-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-7-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-8-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-9-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-10-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-11-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-12-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-13-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-14-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-15-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-16-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-17-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-19-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-18-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-20-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-21-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-22-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-23-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-28-0x00007FFC9BBE0000-0x00007FFC9BE96000-memory.dmp
memory/4548-30-0x00007FFCAA320000-0x00007FFCAA354000-memory.dmp
memory/4548-29-0x00007FF772160000-0x00007FF772258000-memory.dmp
memory/4548-33-0x00007FFCAAAA0000-0x00007FFCAAAB9000-memory.dmp
memory/4548-32-0x00007FFCAAB00000-0x00007FFCAAB11000-memory.dmp
memory/4548-34-0x00007FFCAA030000-0x00007FFCAA052000-memory.dmp
memory/4548-35-0x00007FFCAA000000-0x00007FFCAA02B000-memory.dmp
memory/4548-38-0x00007FFCA9FB0000-0x00007FFCA9FC1000-memory.dmp
memory/4548-36-0x00007FFC9B850000-0x00007FFC9BBE0000-memory.dmp
memory/4548-37-0x00007FFCA9FD0000-0x00007FFCA9FE4000-memory.dmp
memory/4548-41-0x00007FFC9C6F0000-0x00007FFC9C7D8000-memory.dmp
memory/4548-44-0x00007FFCA2E00000-0x00007FFCA2E2F000-memory.dmp
memory/4548-43-0x00007FFCA9F10000-0x00007FFCA9F51000-memory.dmp
memory/4548-50-0x00007FFC9C660000-0x00007FFC9C671000-memory.dmp
memory/4548-49-0x00007FFC9C680000-0x00007FFC9C691000-memory.dmp
memory/4548-48-0x00007FFC9C6A0000-0x00007FFC9C6BA000-memory.dmp
memory/4548-53-0x00007FFC9B1C0000-0x00007FFC9B20F000-memory.dmp
memory/4548-52-0x00007FFC9B210000-0x00007FFC9B2A8000-memory.dmp
memory/4548-51-0x00007FFC9B2B0000-0x00007FFC9B4BB000-memory.dmp
memory/4548-47-0x00007FFC9C6C0000-0x00007FFC9C6ED000-memory.dmp
memory/4548-46-0x00007FFC9D4F0000-0x00007FFC9D516000-memory.dmp
memory/4548-45-0x00007FFCA2720000-0x00007FFCA2738000-memory.dmp
memory/4548-42-0x00007FFC9B4C0000-0x00007FFC9B5A3000-memory.dmp
memory/4548-40-0x00007FFC9B5B0000-0x00007FFC9B846000-memory.dmp
memory/4548-39-0x00007FFC9CA70000-0x00007FFC9CB42000-memory.dmp
memory/4548-54-0x00007FFC9C630000-0x00007FFC9C655000-memory.dmp
memory/4548-57-0x00007FFC9B0D0000-0x00007FFC9B0E2000-memory.dmp
memory/4548-56-0x00007FFC9B0F0000-0x00007FFC9B10B000-memory.dmp
memory/4548-55-0x00007FFC9B110000-0x00007FFC9B1BB000-memory.dmp
memory/4548-59-0x0000013E5C1C0000-0x0000013E5C1D1000-memory.dmp
memory/4548-62-0x0000013E5C220000-0x0000013E5C243000-memory.dmp
memory/4548-63-0x00007FFC92C60000-0x00007FFC92EA5000-memory.dmp
memory/4548-61-0x0000013E5C200000-0x0000013E5C218000-memory.dmp
memory/4548-60-0x0000013E5C1E0000-0x0000013E5C1F1000-memory.dmp
memory/4548-58-0x0000013E5C0F0000-0x0000013E5C1B5000-memory.dmp