f28ec304a07d51cfd9cc4a7cdf2ca6081bcb343ffa6f96225a75d532be94463c

Analysis

user interaction
yes
max time kernel
898s
max time network
406s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/03/2026, 17:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI.rar
Size 13.2MB
Sample260308-vysfzset3p
SHA256 f28ec304a07d51cfd9cc4a7cdf2ca6081bcb343ffa6f96225a75d532be94463c
MD5 68340e026e713f23131abf0b68cc3aed
SHA1 12aa4b349056217704600337a3b2e19ab1afaf5b
SHA512 0a705dcdd436092d2e2b29f2745dcb23131ef3bed8f0d997fbc6af5341a2207024ff3d68e5de05568b95f4b60975334bb0f9b6b5b8b6b646e7ab2f47105a5789
SSDEEP 196608:aqdCtViS27cyB+BS4+ZdeQQys5dP142bIHVnRdQIlQX7v6nuyQmmo6mUEBe2M/Oz:4IXcXo3Qj3e2boBlCDypB6jvGTS5jQ
TLSH
T1B5E633BE7BEE7757E1B12592F475270D46C0B2046C1C98274444F2ABBDE93BDAE2C026
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
1148	watchdog.exe
1180	steamclient_loader_x64.exe
2168	watchdog.exe
4576	watchdog.exe
4884	EfiDSEFix.exe
2848	steamclient_loader_x64.exe
4496	watchdog.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zG.exe
Key created	\REGISTRY\USER\S-1-5-21-747994418-3253881032-1527946131-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zG.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3300	7zFM.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	3300	7zFM.exe
Token: 35	3300	7zFM.exe
Token: SeSecurityPrivilege	3300	7zFM.exe
Token: SeRestorePrivilege	3952	7zG.exe
Token: 35	3952	7zG.exe
Token: SeSecurityPrivilege	3952	7zG.exe
Token: SeSecurityPrivilege	3952	7zG.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3300	7zFM.exe
3300	7zFM.exe
3952	7zG.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3300 wrote to memory of 3952	3300	7zFM.exe	80

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3300
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\" -ad -an -ai#7zMap20777:168:7zEvent29722
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4828

C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\watchdog.exe
"C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\watchdog.exe"
1⤵
- Executes dropped EXE
PID:1148

C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\steamclient_loader_x64.exe
"C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\steamclient_loader_x64.exe"
1⤵
- Executes dropped EXE
PID:1180

C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\watchdog.exe
"C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\watchdog.exe"
1⤵
- Executes dropped EXE
PID:2168

C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\watchdog.exe
"C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\watchdog.exe"
1⤵
- Executes dropped EXE
PID:4576

C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\EfiGuard\EfiDSEFix.exe
"C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\EfiGuard\EfiDSEFix.exe"
1⤵
- Executes dropped EXE
PID:4884

C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\steamclient_loader_x64.exe
"C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\steamclient_loader_x64.exe"
1⤵
- Executes dropped EXE
PID:2848

C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\watchdog.exe
"C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\watchdog.exe"
1⤵
- Executes dropped EXE
PID:4496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

ColdClientLoader.ini

Path C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\ColdClientLoader.ini
Size 2KB
SHA256 44e451d5e560b541a98ca186f8617520f23e99def31b5a861e94877b3cdce2a4
MD5 915d5bdc21d829e44b4d6ae242585cd2
SHA1 8509e40b9b810ec427a0c97f5a60409a3bf84f13
SHA512 243cbb115cf5ac1b60e32247ca3a28a811e55037b04e41ee43a7b4730d88ec495cf8a23ec77cb293b62fafe73d3450a127413918a88f1af46a186b307a43515f
TLSH
T1345163426B5853B5D262D208F54EACD4C32EC4DF123654A06038D12D6290EFEE37E9DB
MD5 SHA1 SHA512 TLSH

Submit Download

EfiDSEFix.exe

Path C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\EfiGuard\EfiDSEFix.exe
Size 21KB
SHA256 923ccf2257bfcb6e0a386977f4ce79f4a1a9a9a7c58620979d691e8a20cb68b4
MD5 210d874edc49f624ce78eb7ec9f0b73f
SHA1 56ad197f3683d9427e3fde0fa257ad7e966fd266
SHA512 cb4533d97849860d58f2fc589a51aa53e59b79d24c80b40bc0f62ac35799be598f92f49fcd505f36d287d2746c1bc1ddb660baf3119005bf6b2e461a882cf347
SSDEEP 192:ve7MmoiTlnU9OmnKkTkBh0zKkfpuptOAbm4biRA4ojGnN/2XnkG5G67KjYsH:vegmxiQoKokBhsuLLi6jG92XjPkYK
TLSH
T183A2A59173ED619CF1B73B75AFB6C1565B36BC816232CA5F3090822E29F29805D31B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamclient_loader_x64.exe

Path C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\steamclient_loader_x64.exe
Size 342KB
SHA256 551a28422e1cd119140aad059f9d44237ebf8c850037ef4ff4522a02627b3d65
MD5 e3901b3d2889dcf02f3fb9174f806f94
SHA1 5280bd47fafbb32f34839f1d74eecbec162410ed
SHA512 52329830c36a356a9e28ceb093b6754e79e5489289aa06de3b2aeaf8ced644e19272ee1f76009c593a5267c82ce726db40af5e8e7126395bbc7fcc8deda70625
SSDEEP 6144:BGq6IsVjtdVb8z9G0SDUpkT8kU+W4AxTjaK2F/lrTw072T4:BkJ09G0wUpkvWnxT52trM14
TLSH
T16E746E66F79414F9E1B7C138CD428905EBB2BC5A4761EADF23E04A962F236D08E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

watchdog.exe

Path C:\Users\Admin\Desktop\Resident.Evil.Requiem.HYPERVISOR.V2-KIRIGIRI\watchdog.exe
Size 65KB
SHA256 6fe71d7bd09ba6518f49ce27abfc3eab6d83b07cc990a72682b421e106fd80e5
MD5 f912a8cab09669e2b5cc40d01d2c1f35
SHA1 d3b5ec43075923916b2f4d42e60d84fc7d07504c
SHA512 35214a1c6e0dc68238d35ac96b7767a0d23ddc35ff826270a4c29fefa680ce44a097544f6398e26866882e00c861ac63a3c7bb76e142e9ac76b533e8c9265802
SSDEEP 1536:TUD5ndR4ESf3r8qaSfjUxvW4Tlqe/LRjlFEZUIf:gdmfrZa3xlrd
TLSH
T11563F194A6DE0AD4F8E086B7D3370648B136B9A6E33035DF42B2912D193ABD05CF1257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1148-120-0x000001DD4D330000-0x000001DD4D41A000-memory.dmp

Download

memory/2168-126-0x000002B285850000-0x000002B28593A000-memory.dmp

Download

memory/3300-0-0x0000021F287F0000-0x0000021F28821000-memory.dmp

Download

memory/3952-59-0x0000014F50F40000-0x0000014F50F71000-memory.dmp

Download

memory/3952-115-0x0000014F50F40000-0x0000014F50F71000-memory.dmp

Download

memory/4496-135-0x000001E215EF0000-0x000001E215FDA000-memory.dmp

Download

memory/4576-128-0x00000201A1F00000-0x00000201A1FEA000-memory.dmp

Download

memory/4828-116-0x000002647E7D0000-0x000002647E801000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads