Analysis
- user interaction
yes - max time kernel
191s - max time network
191s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
21/04/2026, 01:50
General
- Target Tomodachi Life_0t-3QM8.exe
- Size 13.8MB
- Sample260421-b9dmesax4x
- SHA256 888bfc44c03e97875fd1e88f56c8c052c94af130803a096114a76e480313f0dc
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 15 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 41 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tomodachi Life_0t-3QM8.exe"C:\Users\Admin\AppData\Local\Temp\Tomodachi Life_0t-3QM8.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-RKA2L.tmp\Tomodachi Life_0t-3QM8.tmp"C:\Users\Admin\AppData\Local\Temp\is-RKA2L.tmp\Tomodachi Life_0t-3QM8.tmp" /SL5="$5022A,13603942,780800,C:\Users\Admin\AppData\Local\Temp\Tomodachi Life_0t-3QM8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"netsh" firewall add allowedprogramC:\Users\Admin\AppData\Local\Temp\is-75P6D.tmp\qbittorrent.exe "qBittorrent" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\is-75P6D.tmp\qbittorrent.exe"C:\Users\Admin\AppData\Local\Temp\is-75P6D.tmp\qbittorrent.exe" magnet:?xt=urn:btih:BFF18AF5608F9196CF05BF0C1F0B54A18C3F0A773⤵
- Enumerates connected drives
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x304 0x3001⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Purble place\purble_place\readme.txt1⤵
-
C:\Users\Admin\Downloads\Purble place\purble_place\Purble Place.exe"C:\Users\Admin\Downloads\Purble place\purble_place\Purble Place.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
PurblePlace.exe
WebAdvisor.png
botva2.dll
finish.png
qbittorrent.exe
zbShieldUtils.dll
Tomodachi Life_0t-3QM8.tmp
qBittorrent.ini
qBittorrent.ini
watched_folders.json
Vista.Emulation.zip
memory/1404-7643-0x0000029EBD2B0000-0x0000029EBD3DB000-memory.dmp
memory/1404-7645-0x0000029EBD2B0000-0x0000029EBD3DB000-memory.dmp
memory/2284-47-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/2284-26-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/2284-49-0x0000000007120000-0x000000000712F000-memory.dmp
memory/2284-53-0x0000000000400000-0x00000000006EE000-memory.dmp
memory/2284-5-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/2284-54-0x0000000000850000-0x0000000000869000-memory.dmp
memory/2284-28-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/2284-33-0x0000000007120000-0x000000000712F000-memory.dmp
memory/2284-27-0x0000000000850000-0x0000000000869000-memory.dmp
memory/2856-7671-0x0000000001000000-0x00000000010F2000-memory.dmp
memory/3620-64-0x00000000025B0000-0x00000000025C9000-memory.dmp
memory/3968-7672-0x0000000000400000-0x000000000047B000-memory.dmp
memory/4384-0-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/4384-56-0x0000000000510000-0x0000000000529000-memory.dmp
memory/4384-25-0x0000000000510000-0x0000000000529000-memory.dmp
memory/4384-24-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/4384-55-0x0000000000400000-0x00000000004CC000-memory.dmp