Analysis
- max time kernel
298s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
17/10/2026, 18:44
General
- Target lol.ogg
- Size 41KB
- Sample261017-xdjdpabs7k
- SHA256 6144120aaf83da04fa13de58a3ae95d5f47859df8c7b2cb4e7445320349c01b3
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\lol.ogg1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\lol.ogg"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
vlc-qt-interface.ini
memory/3268-0-0x00007FFE5D8ED000-0x00007FFE5D8EF000-memory.dmp
memory/3268-1-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-2-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-3-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-4-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-5-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-6-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-7-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-8-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-10-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-9-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-11-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-12-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-15-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-14-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-16-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-18-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-17-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-13-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-19-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-20-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-22-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-21-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-23-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-24-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-25-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-26-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-28-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-27-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-29-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-30-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-32-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-31-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-33-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-37-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-39-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-38-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-36-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-40-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-41-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-42-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-43-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-44-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-45-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-46-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-35-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-34-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-52-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-53-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-54-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-55-0x00007FF6B0B60000-0x00007FF6B0C58000-memory.dmp
memory/3268-57-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp
memory/3268-64-0x00007FFE6D0B0000-0x00007FFE6D0C1000-memory.dmp
memory/3268-63-0x00007FFE6EBB0000-0x00007FFE6EBC4000-memory.dmp
memory/3268-65-0x00007FFE6CFD0000-0x00007FFE6D0A2000-memory.dmp
memory/3268-66-0x00007FFE5CE20000-0x00007FFE5D0B6000-memory.dmp
memory/3268-76-0x00007FFE6AA10000-0x00007FFE6AA21000-memory.dmp
memory/3268-83-0x00007FFE6A640000-0x00007FFE6A652000-memory.dmp
memory/3268-87-0x00007FFE554F0000-0x00007FFE55735000-memory.dmp
memory/3268-86-0x00000157ACD80000-0x00000157ACDD7000-memory.dmp
memory/3268-84-0x00000157ACE30000-0x00000157AD0F9000-memory.dmp
memory/3268-82-0x00007FFE6A880000-0x00007FFE6A89B000-memory.dmp
memory/3268-81-0x00007FFE5C740000-0x00007FFE5C7EB000-memory.dmp
memory/3268-80-0x00007FFE6A6C0000-0x00007FFE6A6E5000-memory.dmp
memory/3268-62-0x00007FFE5D0C0000-0x00007FFE5D450000-memory.dmp
memory/3268-78-0x00007FFE5DB10000-0x00007FFE5DBA8000-memory.dmp
memory/3268-77-0x00007FFE5C7F0000-0x00007FFE5C9FB000-memory.dmp
memory/3268-85-0x00000157ACC80000-0x00000157ACD7F000-memory.dmp
memory/3268-75-0x00007FFE6B150000-0x00007FFE6B161000-memory.dmp
memory/3268-74-0x00007FFE6B220000-0x00007FFE6B23A000-memory.dmp
memory/3268-73-0x00007FFE6A740000-0x00007FFE6A76D000-memory.dmp
memory/3268-72-0x00007FFE6A8A0000-0x00007FFE6A8C6000-memory.dmp
memory/3268-71-0x00007FFE6BF10000-0x00007FFE6BF28000-memory.dmp
memory/3268-70-0x00007FFE6CFA0000-0x00007FFE6CFCF000-memory.dmp
memory/3268-69-0x00007FFE6AA30000-0x00007FFE6AA71000-memory.dmp
memory/3268-68-0x00007FFE5DBB0000-0x00007FFE5DC93000-memory.dmp
memory/3268-79-0x00007FFE6A6F0000-0x00007FFE6A73F000-memory.dmp
memory/3268-67-0x00007FFE69E90000-0x00007FFE69F78000-memory.dmp
memory/3268-61-0x00007FFE6D0D0000-0x00007FFE6D0FB000-memory.dmp
memory/3268-60-0x00007FFE6D240000-0x00007FFE6D262000-memory.dmp
memory/3268-59-0x00007FFE6ED40000-0x00007FFE6ED59000-memory.dmp
memory/3268-58-0x00007FFE6EF00000-0x00007FFE6EF11000-memory.dmp
memory/3268-56-0x00007FFE6D2A0000-0x00007FFE6D2D4000-memory.dmp
memory/3268-123-0x00007FFE5D640000-0x00007FFE5D8F6000-memory.dmp