Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 01:51
General
- Target bit_flowery.ogg
- Size 398KB
- Sample260930-b96cfacb63
- SHA256 3af34b72cc7af213a0c5bb31939e9af8d354802bad231f3305ed2134a641ed98
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\bit_flowery.ogg1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\bit_flowery.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2176-0-0x00007FFBBE6DD000-0x00007FFBBE6DF000-memory.dmp
memory/2176-1-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-2-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-3-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-4-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-6-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-7-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-5-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-8-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-9-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-10-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-11-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-12-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-14-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-13-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-15-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-16-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-17-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-18-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-19-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-20-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-21-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-22-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-23-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-24-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-25-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-26-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-27-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-30-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-29-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-28-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-31-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-32-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-33-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-34-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-35-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-38-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-39-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-37-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-36-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-44-0x00007FF745640000-0x00007FF745738000-memory.dmp
memory/2176-49-0x00007FFBCB890000-0x00007FFBCB8B2000-memory.dmp
memory/2176-50-0x00007FFBCB860000-0x00007FFBCB88B000-memory.dmp
memory/2176-48-0x00007FFBD1560000-0x00007FFBD1579000-memory.dmp
memory/2176-53-0x00007FFBCC2C0000-0x00007FFBCC2D1000-memory.dmp
memory/2176-54-0x00007FFBCB4E0000-0x00007FFBCB5B2000-memory.dmp
memory/2176-52-0x00007FFBCE110000-0x00007FFBCE124000-memory.dmp
memory/2176-51-0x00007FFBBE0A0000-0x00007FFBBE430000-memory.dmp
memory/2176-47-0x00007FFBD1630000-0x00007FFBD1641000-memory.dmp
memory/2176-46-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-45-0x00007FFBCBE60000-0x00007FFBCBE94000-memory.dmp
memory/2176-55-0x00007FFBBDE00000-0x00007FFBBE096000-memory.dmp
memory/2176-64-0x00007FFBBDB40000-0x00007FFBBDB51000-memory.dmp
memory/2176-65-0x00007FFBBDB20000-0x00007FFBBDB31000-memory.dmp
memory/2176-63-0x00007FFBBFB90000-0x00007FFBBFBAA000-memory.dmp
memory/2176-62-0x00007FFBBF6E0000-0x00007FFBBF70D000-memory.dmp
memory/2176-75-0x0000024AE7710000-0x0000024AE773B000-memory.dmp
memory/2176-76-0x0000024AE78B0000-0x0000024AE7B03000-memory.dmp
memory/2176-77-0x00007FFBB4B90000-0x00007FFBB4DD5000-memory.dmp
memory/2176-74-0x0000024AE76F0000-0x0000024AE7705000-memory.dmp
memory/2176-73-0x0000024AE76D0000-0x0000024AE76E2000-memory.dmp
memory/2176-72-0x00007FFBCBDB0000-0x00007FFBCBDC2000-memory.dmp
memory/2176-71-0x00007FFBCBDD0000-0x00007FFBCBDEB000-memory.dmp
memory/2176-70-0x00007FFBBEC80000-0x00007FFBBED2B000-memory.dmp
memory/2176-69-0x00007FFBBD820000-0x00007FFBBD845000-memory.dmp
memory/2176-68-0x00007FFBBD4B0000-0x00007FFBBD4FF000-memory.dmp
memory/2176-66-0x00007FFBBD910000-0x00007FFBBDB1B000-memory.dmp
memory/2176-60-0x00007FFBC4E90000-0x00007FFBC4EA8000-memory.dmp
memory/2176-58-0x00007FFBC4EB0000-0x00007FFBC4EF1000-memory.dmp
memory/2176-59-0x00007FFBC08E0000-0x00007FFBC090F000-memory.dmp
memory/2176-61-0x00007FFBBF710000-0x00007FFBBF736000-memory.dmp
memory/2176-57-0x00007FFBBDB60000-0x00007FFBBDC43000-memory.dmp
memory/2176-56-0x00007FFBBDC50000-0x00007FFBBDD38000-memory.dmp
memory/2176-67-0x00007FFBBD870000-0x00007FFBBD908000-memory.dmp
memory/2176-78-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp
memory/2176-115-0x00007FFBBE430000-0x00007FFBBE6E6000-memory.dmp