Analysis
- max time kernel
149s - max time network
192s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 21:09
General
- Target th06nc/data/bgm/th06_03.opus
- Size 1.4MB
- Sample260910-zzghbsweld
- SHA256 c5ef1842daafe7b517896f08c93adf7cbd41b3de98e774c45ecd86c03121c17a
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\th06nc\data\bgm\th06_03.opus1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\th06nc\data\bgm\th06_03.opus"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2376-0-0x00007FF9F3DED000-0x00007FF9F3DEF000-memory.dmp
memory/2376-1-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-3-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-4-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-2-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-6-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-7-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-9-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-11-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-12-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-13-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-14-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-16-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-18-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-17-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-20-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-19-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-15-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-21-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-10-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-8-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-5-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-23-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-25-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-24-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-27-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-30-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-32-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-33-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-31-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-34-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-36-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-38-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-41-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-43-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-42-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-40-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-39-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-37-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-35-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-29-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-28-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-26-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-22-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-46-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-49-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-50-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-48-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-51-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-47-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-45-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-44-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-56-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-57-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-58-0x00007FF9F3B40000-0x00007FF9F3DF6000-memory.dmp
memory/2376-65-0x00007FFA00A80000-0x00007FFA00AAB000-memory.dmp
memory/2376-63-0x00007FFA01510000-0x00007FFA01529000-memory.dmp
memory/2376-69-0x00007FF9F4070000-0x00007FF9F4142000-memory.dmp
memory/2376-76-0x00007FF9F3F50000-0x00007FF9F3F76000-memory.dmp
memory/2376-80-0x00007FF9F33D0000-0x00007FF9F33E1000-memory.dmp
memory/2376-82-0x00007FF9F3120000-0x00007FF9F31B8000-memory.dmp
memory/2376-84-0x00007FF9F30A0000-0x00007FF9F30C5000-memory.dmp
memory/2376-87-0x00007FF9F2FB0000-0x00007FF9F2FC2000-memory.dmp
memory/2376-89-0x00007FF9ED050000-0x00007FF9ED295000-memory.dmp
memory/2376-88-0x000002657DFC0000-0x000002657E289000-memory.dmp
memory/2376-85-0x00007FF9F2FF0000-0x00007FF9F309B000-memory.dmp
memory/2376-86-0x00007FF9F2FD0000-0x00007FF9F2FEB000-memory.dmp
memory/2376-83-0x00007FF9F30D0000-0x00007FF9F311F000-memory.dmp
memory/2376-81-0x00007FF9F31C0000-0x00007FF9F33CB000-memory.dmp
memory/2376-79-0x00007FF9F3F30000-0x00007FF9F3F41000-memory.dmp
memory/2376-78-0x00007FF9F45E0000-0x00007FF9F45FA000-memory.dmp
memory/2376-77-0x00007FF9F33F0000-0x00007FF9F341D000-memory.dmp
memory/2376-75-0x00007FFA005E0000-0x00007FFA005F8000-memory.dmp
memory/2376-74-0x00007FFA00A10000-0x00007FFA00A3F000-memory.dmp
memory/2376-73-0x00007FFA00670000-0x00007FFA006B1000-memory.dmp
memory/2376-66-0x00007FF9F37B0000-0x00007FF9F3B40000-memory.dmp
memory/2376-72-0x00007FF9F3420000-0x00007FF9F3503000-memory.dmp
memory/2376-71-0x00007FF9F3F80000-0x00007FF9F4068000-memory.dmp
memory/2376-70-0x00007FF9F3510000-0x00007FF9F37A6000-memory.dmp
memory/2376-68-0x00007FFA00A40000-0x00007FFA00A51000-memory.dmp
memory/2376-67-0x00007FFA00A60000-0x00007FFA00A74000-memory.dmp
memory/2376-64-0x00007FFA00AB0000-0x00007FFA00AD2000-memory.dmp
memory/2376-62-0x00007FFA05BF0000-0x00007FFA05C01000-memory.dmp
memory/2376-60-0x00007FFA01080000-0x00007FFA010B4000-memory.dmp
memory/2376-59-0x00007FF61F270000-0x00007FF61F368000-memory.dmp