Analysis
-
max time kernel
138s -
max time network
156s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/11/2024, 08:12
Behavioral task
behavioral1
Sample
RPGVXAce_RTP/RTP100/Setup.exe
Resource
win11-20241023-en
Behavioral task
behavioral2
Sample
The_Moral_Sword_of_Asagi/Audio/SE/!$02_actor002_kiss02.ps1
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
The_Moral_Sword_of_Asagi/Game.exe
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
The_Moral_Sword_of_Asagi/System/RGSS301.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
The_Moral_Sword_of_Asagi/WFExit.dll
Resource
win11-20241007-en
General
-
Target
The_Moral_Sword_of_Asagi/WFExit.dll
-
Size
42KB
-
MD5
bb0d332a65b2a3eefb6a8734ee37a699
-
SHA1
98fff9d24e4db5da63bb33d490eb4908292895cc
-
SHA256
99234d8f4ac85c698fc1c57c2308a8b5d41e6c2b9ee3f9c029df083861c5450e
-
SHA512
233de12240a5dfc97385b21cc129987ca5064dab2040f2ae393cf9da3876691f4a69994219c301d2cb7e803f1dfec8e7d624d1d0068297fb5725727cee5f8bd9
-
SSDEEP
768:Nlb+JkEIkp2NBwVUGvvFLVSb01ugHoMRrlifh:Ha1qBAvvqittRr4fh
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2224 wrote to memory of 4304 2224 rundll32.exe 81 PID 2224 wrote to memory of 4304 2224 rundll32.exe 81 PID 2224 wrote to memory of 4304 2224 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\The_Moral_Sword_of_Asagi\WFExit.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\The_Moral_Sword_of_Asagi\WFExit.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4304
-