95a5df362f5b6719ab17a988f72be87f6006b35dffc454e9235c1d1f0214fba2

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MovieBox.exe
Size 201.4MB
Sample260930-pgt1laxajd
SHA256 95a5df362f5b6719ab17a988f72be87f6006b35dffc454e9235c1d1f0214fba2
MD5 fce83fd966513154c1d85a85bae1c8b6
SHA1 46983e3aef830418caedbd4ee33384c0a5edb909
SHA512 58bb532a83e9cb08dfbf717232b360496f17605f3790638ca6df819282011666001eda03b36ab65cf5d8a5844804af93b4dbd0b3179a9baac4ce65931a1fff09
SSDEEP 1572864:KECknSEVQtIDR08zinOKvnHkunxaYjAbyJc3ASu9nP2xE+7H+ZEmIiteng/eiU4V:MKD4ja4Vfxe+iYLg
TLSH
T17AA88C13E29641D9E05DD1B5974A9733FE72B80A4728A2DF2B5407522F77EE42B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	MovieBox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	MovieBox.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MovieBox.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MovieBox.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MovieBox.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MovieBox.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4164	MovieBox.exe
4164	MovieBox.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe
Token: SeShutdownPrivilege	4292	MovieBox.exe
Token: SeCreatePagefilePrivilege	4292	MovieBox.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 580	4292	MovieBox.exe	89
PID 4292 wrote to memory of 580	4292	MovieBox.exe	89
PID 4292 wrote to memory of 4836	4292	MovieBox.exe	90
PID 4292 wrote to memory of 3656	4292	MovieBox.exe	91
PID 4292 wrote to memory of 3656	4292	MovieBox.exe	91
PID 4292 wrote to memory of 4164	4292	MovieBox.exe	106

C:\Users\Admin\AppData\Local\Temp\MovieBox.exe
"C:\Users\Admin\AppData\Local\Temp\MovieBox.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Users\Admin\AppData\Local\Temp\MovieBox.exe
  "C:\Users\Admin\AppData\Local\Temp\MovieBox.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\moviebox-windows" --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,2151220761071661911,11797158895491364898,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:580
- C:\Users\Admin\AppData\Local\Temp\MovieBox.exe
  "C:\Users\Admin\AppData\Local\Temp\MovieBox.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\moviebox-windows" --field-trial-handle=1888,i,2151220761071661911,11797158895491364898,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4836
- C:\Users\Admin\AppData\Local\Temp\MovieBox.exe
  "C:\Users\Admin\AppData\Local\Temp\MovieBox.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\moviebox-windows" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1790770546788933 --launch-time-ticks=546599743 --field-trial-handle=1888,i,2151220761071661911,11797158895491364898,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:3656
- C:\Users\Admin\AppData\Local\Temp\MovieBox.exe
  "C:\Users\Admin\AppData\Local\Temp\MovieBox.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\moviebox-windows" --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,2151220761071661911,11797158895491364898,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\moviebox-windows\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 e30443b9c937f198d41e067e64f15c73fff7edd3cee1aca93fe17c66a497c6dc
MD5 00e8242518388cfc207f16e0a97b3797
SHA1 07754d5f27fc6358b203b3b43e3671a8a1a28805
SHA512 07f333563dca000819082f613206fe099343c21ca34c93caaf13634c53934a309e9273e7145eeb486e531c4a423d326d0447aab68beb3ec2cfeefd9622b925c2
TLSH
T143E08C84C2C1332ACF440AB488955E0463233892859B7B1F4C56423DFD673CD9C89705
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\moviebox-windows\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 bf7e1f50c7467bce40a7b4fef3677053617d9b33515434850c7d46602045f660
MD5 7d63fe0cd833a01ac0c25dae670d60c6
SHA1 5d2c19f7c38bdf1516807a41178bd0444f74d8d2
SHA512 0ab2481bf7e90dc2b1374886c0322ba1355ed6d3cf6cfd200689c5583295bfb83dee16e49277d7ef16f365e96f036200af911724a50e3b5197213c207be98e0b
TLSH
T142E02C80C2C0332ACF400A70CC645E0463133AA28A9B730F0C56023CFDE23CCDD89204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5920dc.TMP

Path C:\Users\Admin\AppData\Roaming\moviebox-windows\Code Cache\js\index-dir\the-real-index~RFe5920dc.TMP
Size 48B
SHA256 abbd6836456de70b5d71b5560b25770371998ceb693dc9f6f4fad476a06ac5cb
MD5 427d17cca6eab9adb15dc7018cf23d23
SHA1 3444bfb4b6dd27aa89060a9d34e66327bba0b4ec
SHA512 8e6dcf325398e9615c9234ff84a0b66d042f97df0d57ae68f8b30c0c811eae5f4c36ac96df3e08fab295bb93f10ad82745ab6bb4bc5bfa145f7f45c14ed7c98e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\moviebox-windows\Network\Network Persistent State
Size 2KB
SHA256 35ad2a22b3c8e1d6e0d9a8863a0c5601edf6faee027f9aa28f4bbf9567c11a5a
MD5 63ac314c81e71e2c50aa411652ebb1c4
SHA1 49030ae400cda83cbc244032a4ae950f9bcb9bd8
SHA512 bef0678e15bb75da709c2b13939ebcc361a3d895c3a93f51265e72a3741878b6be4cbaef0f5a6cebd12aedbe527bcad7cd5434a0d9b8114fe5eb7796c118edc7
TLSH
T13C518CD7C3EC463E8922A7F96B253E23C5ED091C03283D0688D9DF4E53E2471465218E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59bdf7.TMP

Path C:\Users\Admin\AppData\Roaming\moviebox-windows\Network\Network Persistent State~RFe59bdf7.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\moviebox-windows\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

memory/3656-29-0x00007FFFA0290000-0x00007FFFA0291000-memory.dmp

Download

memory/3656-30-0x00007FFFA0500000-0x00007FFFA0501000-memory.dmp

Download

memory/4164-173-0x000001F6CD2E0000-0x000001F6CD2E1000-memory.dmp

Download

memory/4164-162-0x000001F6CD2E0000-0x000001F6CD2E1000-memory.dmp

Download

memory/4164-161-0x000001F6CD2E0000-0x000001F6CD2E1000-memory.dmp

Download

memory/4164-163-0x000001F6CD2E0000-0x000001F6CD2E1000-memory.dmp

Download

memory/4164-172-0x000001F6CD2E0000-0x000001F6CD2E1000-memory.dmp

Download

memory/4164-171-0x000001F6CD2E0000-0x000001F6CD2E1000-memory.dmp

Download

memory/4164-170-0x000001F6CD2E0000-0x000001F6CD2E1000-memory.dmp

Download

memory/4164-169-0x000001F6CD2E0000-0x000001F6CD2E1000-memory.dmp

Download

memory/4164-168-0x000001F6CD2E0000-0x000001F6CD2E1000-memory.dmp

Download

memory/4164-167-0x000001F6CD2E0000-0x000001F6CD2E1000-memory.dmp

Download