Analysis
-
max time kernel
135s -
max time network
161s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/11/2024, 08:12
Behavioral task
behavioral1
Sample
RPGVXAce_RTP/RTP100/Setup.exe
Resource
win11-20241023-en
Behavioral task
behavioral2
Sample
The_Moral_Sword_of_Asagi/Audio/SE/!$02_actor002_kiss02.ps1
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
The_Moral_Sword_of_Asagi/Game.exe
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
The_Moral_Sword_of_Asagi/System/RGSS301.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
The_Moral_Sword_of_Asagi/WFExit.dll
Resource
win11-20241007-en
General
-
Target
RPGVXAce_RTP/RTP100/Setup.exe
-
Size
571KB
-
MD5
f3a1050bac829eebf38a553db08c02e1
-
SHA1
8a6a2a4e825b1b9de88791c03d7404e181fb0241
-
SHA256
3b178f718655dab3c444857b5e6fd755dc611de72dc229de486b3e06d8548fd2
-
SHA512
9e52b8e46192f72eb06971ee06bad397304db7714df4fd0b8397e2bd9d23c1aacdb10667ec1dfeb3b03b600875656f2a60e3b8582ccb6e86aefcae4a38a895f7
-
SSDEEP
12288:Z3Mjhv8888888888888W88888888888H09+kjn3bVNyRvh6QoqJh5+B+98LApiag:dMjhQ09+miWQpJh5n98LAoa58h5j
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4424 Setup.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-MPNOO.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-CAVCS.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Characters\is-52TQB.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\ME\is-EJ4QR.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-F92JU.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-F7KMU.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Animations\is-AMJ8L.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Tilesets\is-5PP6J.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-GDTL3.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-HP12R.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-BI068.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlers\is-05222.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-S8L9G.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlebacks1\is-TKA7B.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlebacks2\is-NS7LI.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Parallaxes\is-JKMOO.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-8A6MK.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlebacks2\is-S5AJ7.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Characters\is-K8KND.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-M62AB.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-0QPAA.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-69H8Q.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlebacks1\is-TLJLE.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlers\is-P4H8D.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Faces\is-JRROC.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-4HO6P.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-G1T5C.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlebacks1\is-8P7QQ.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlers\is-TUKV6.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-RKED5.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-SFU5A.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Animations\is-T9HO2.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Animations\is-KRJOC.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Parallaxes\is-4UBH7.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Titles1\is-EON9M.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-8Q1IR.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-2QLCD.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-VRK71.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-L9PCC.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlebacks1\is-KB154.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlers\is-CQ1S2.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Animations\is-IS8DU.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlebacks2\is-S3LGG.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\BGM\is-I4JFU.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-SJRT2.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-I9IIQ.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-9CH2O.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-V8SON.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Animations\is-IMN5C.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlebacks2\is-1OCAK.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\BGM\is-4R6A6.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\BGS\is-MBSL1.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-J7L1O.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-JI8J9.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-FR83T.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlebacks1\is-PS23B.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-ASBUE.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlebacks1\is-75HG0.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Parallaxes\is-PTSUP.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Graphics\Battlers\is-OSO32.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-5CHGO.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-GJU9J.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-SKQ99.tmp Setup.tmp File created C:\Program Files (x86)\Common Files\Enterbrain\RGSS3\RPGVXAce\Audio\SE\is-TIIKD.tmp Setup.tmp -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4424 Setup.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4860 wrote to memory of 4424 4860 Setup.exe 79 PID 4860 wrote to memory of 4424 4860 Setup.exe 79 PID 4860 wrote to memory of 4424 4860 Setup.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\RPGVXAce_RTP\RTP100\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RPGVXAce_RTP\RTP100\Setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\is-0B51E.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-0B51E.tmp\Setup.tmp" /SL5="$70220,140800,0,C:\Users\Admin\AppData\Local\Temp\RPGVXAce_RTP\RTP100\Setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5394289faec0a43faea574588cb367018
SHA1b02982a816782c3c16ad5a321dce0a79cab124a2
SHA25689c8d27247ff86f189ebba01e27c47daa184a04c5f002130f9d336ca80d71202
SHA512e99977ed9b3ea6607d347fe3e339cff40e70166db6a93443046cb7e0bc2a6f7c598503a55030f7d9ae0e8ede8b706bb4bd682bbdadf215641247b96bae0d09f4