Analysis
- user interaction
yes - max time kernel
246s - max time network
249s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
24/05/2026, 16:50
General
- Target Peeping-Dorm-Manager.rar
- Size 590.5MB
- Sample260524-vcnkxae121
- SHA256 beaa5476e8572bd2d6fe7e8e0145134d535ff23611f7b4fabc23f24b07140a04
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Peeping-Dorm-Manager.rar"1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Peeping Dorm Manager\Peeping Dorm Manager\Peeping Dorm Manager.exe"C:\Users\Admin\Desktop\Peeping Dorm Manager\Peeping Dorm Manager\Peeping Dorm Manager.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Peeping Dorm Manager_patch-run.exe"C:\Users\Admin\AppData\Local\Temp\Peeping Dorm Manager_patch-run.exe" C:\Users\Admin\Desktop\Peeping Dorm Manager\Peeping Dorm Manager2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Peeping Dorm Manager\Peeping Dorm Manager\Peeping Dorm Manager.exe"C:\Users\Admin\Desktop\Peeping Dorm Manager\Peeping Dorm Manager\Peeping Dorm Manager.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Peeping Dorm Manager\Peeping Dorm Manager\UnityCrashHandler64.exe"C:\Users\Admin\Desktop\Peeping Dorm Manager\Peeping Dorm Manager\UnityCrashHandler64.exe" --attach 1876 27570461122564⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Peeping Dorm Manager\Peeping Dorm Manager\UnityCrashHandler64.exe"C:\Users\Admin\Desktop\Peeping Dorm Manager\Peeping Dorm Manager\UnityCrashHandler64.exe" "1876" "2757046112256"5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3c8 0x2d01⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
GameAssembly.dll
Peeping Dorm Manager.exe
Peeping Dorm Manager.exe
fmodstudio.dll
steam_api64.dll
unity default resources
unity_builtin_extra
RuntimeInitializeOnLoads.json
ScriptingAssemblies.json
audio_demo_assets_all_3c63e214be7b3e2856cc658dad408767.bundle
duplicateassetisolation_assets_all_5588b5b749f760051b2e6b91e1f9c5d8.bundle
localization-asset-tables-english_assets_all.bundle
localization-assets-english_assets_all.bundle
localization-assets-shared_assets_all.bundle
localization-assets-日本語_assets_all.bundle
localization-assets-繁體中文_assets_all.bundle
localization-locales_assets_all.bundle
localization-string-tables-english_assets_all.bundle
notificationui_assets_all_20eebbd642d484494ca2eb64012e9ab8.bundle
popupwindow_assets_all_5e5f3f833c4d49ce902b6142e1ee2b38.bundle
scenetransition_assets_all_e9b2f933f58b23f741a6e79c4edd252c.bundle
catalog.json
settings.json
app.info
boot.config
globalgamemanagers
globalgamemanagers.assets
globalgamemanagers.assets.resS
global-metadata.dat
mscorlib.dll-resources.dat
level0
level1
level12.resS
resources.assets
resources.assets.resS
sharedassets0.assets
sharedassets1.assets
sharedassets18.assets.resS
UnityCrashHandler64.exe
UnityPlayer.dll
baselib.dll
memory/1876-662-0x000002830EA90000-0x0000028311DC7000-memory.dmp
memory/1876-663-0x000002830EA90000-0x0000028311DC7000-memory.dmp
memory/1876-633-0x000002830EA90000-0x0000028311DC7000-memory.dmp
memory/1876-668-0x000002830EA90000-0x0000028311DC7000-memory.dmp