487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474

Analysis

user interaction
yes
max time kernel
509s
max time network
565s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dark desire train/[Kimochi] RJ01134914 v1.01/Game.exe
Size 1.5MB
Sample260809-3fa3zsch95
SHA256 487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474
MD5 9ebc7dd20fa66f5deabfd8873a4ed8c6
SHA1 cf1b1da0e5215738a8e972077be5804cb326b8ed
SHA512 5d0a052edec070ee573bc43ed9eb7eb92c0460efe60a5abc31d1200e092937b91eafce5492cd945d46645f9029f0f80a37907fe6292639d37f15f58dae377271
SSDEEP 24576:5XVhPcthsRP/d3qI4N+Nl49LPSncvK51CvO8ofTWIZAmOLB:R5RP/d6IxNIKnL5mO8ofTrZAmm
TLSH
T12D759D01A4629075CB522271EC2CF73D6B206E1D4BF249F7FB946DE9AFB01E0353259A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	Game.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{35F94BA7-D558-477E-9018-6F82998E36F6}	Game.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3776	Game.exe
3776	Game.exe
1856	Game.exe
1856	Game.exe
2688	Game.exe
2688	Game.exe
1856	Game.exe
1856	Game.exe
4448	Game.exe
4448	Game.exe
2756	Game.exe
2756	Game.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1856	Game.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1768	1856	Game.exe	84
PID 1768 wrote to memory of 5084	1768	Game.exe	85
PID 1856 wrote to memory of 3776	1856	Game.exe	86
PID 1856 wrote to memory of 2688	1856	Game.exe	87
PID 1856 wrote to memory of 4448	1856	Game.exe	98
PID 1856 wrote to memory of 2756	1856	Game.exe	100

C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
"C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --annotation=plat=Win32 --annotation=prod= --annotation=ver= --initial-client-data=0x2d4,0x2d8,0x2dc,0x2d0,0x2e0,0x75b1d0e0,0x75b1d0f0,0x75b1d0fc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
    "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" --annotation=plat=Win32 --annotation=prod= --annotation=ver= --initial-client-data=0x1e0,0x1e4,0x1e8,0x1d8,0x1ec,0x2fd820,0x2fd830,0x2fd83c
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5084
- C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe" --type=gpu-process --field-trial-handle=1696,1455954568641776425,15670926326182510109,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01" --gpu-preferences=KAAAAAAAAAAABwCAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor=Microsoft --gpu-driver-version=10.0.19041.868 --gpu-driver-date=6-21-2006 --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01" --service-request-channel-token=1E63E6B2A70EEE54CAEBB1964394CC0B --mojo-platform-channel-handle=1720 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3776
- C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe" --type=renderer --js-flags=--expose-gc --no-sandbox --no-zygote --field-trial-handle=1696,1455954568641776425,15670926326182510109,131072 --service-pipe-token=9A022CB4E9FF6BB4A5C26EB80E96236E --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01" --nwjs --extension-process --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true,cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-checker-imaging --enable-compositor-image-animations --service-request-channel-token=9A022CB4E9FF6BB4A5C26EB80E96236E --renderer-client-id=3 --mojo-platform-channel-handle=2512 /prefetch:1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2688
- C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe" --type=utility --field-trial-handle=1696,1455954568641776425,15670926326182510109,131072 --lang=en-US --no-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01" --service-request-channel-token=E6012102C57243226D0986C2C4341E5D --mojo-platform-channel-handle=1324 /prefetch:8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4448
- C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe" --type=utility --field-trial-handle=1696,1455954568641776425,15670926326182510109,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01" --service-request-channel-token=7F57871BE9AE5F2D2ACD5D94356694CB --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1b37ba8b-2697-4adc-96f1-73d24b5b90f4.tmp

Path C:\Users\Admin\AppData\Local\User Data\1b37ba8b-2697-4adc-96f1-73d24b5b90f4.tmp
Size 1KB
SHA256 12b87ddf1df2341b2e16b6323e0499767b699052452c02cd009498adf43041b8
MD5 67a5f2434fc54a97fd5e539657e7b58c
SHA1 9687e094ab8a81a20c9d2d8b525a415de5561da8
SHA512 e58aac95e8277c6b38f67bbc397c8c2251d87ea34481fb81dcb7c2aaceb41d1578a1db6d1ffba38a4dff9b226a926b3e364ce4fcff4b892667db477eb8aea1c1
TLSH
T1723110AD359EC83BBE97D109F8873B238B6A10462B595F41C3F84E3C0699B9C2326107
MD5 SHA1 SHA512 TLSH

Submit Download

67566106-78ba-4e61-8e0a-714c0e0676db.tmp

Path C:\Users\Admin\AppData\Local\User Data\67566106-78ba-4e61-8e0a-714c0e0676db.tmp
Size 3KB
SHA256 10f83a4005748dee8ca04e752444d78029c5a4e7e9a3a58b34bb743ad772acb0
MD5 1b208fc25a7ab5756cac9561a00d44a7
SHA1 888250765d8c02aa4370882e49534536ac2527b8
SHA512 34cb6953cc1dc7195a79864add27204a0580bb470bd85b7e589f55476abb2582c5a29284b3657effb247271a79e206553d78246d330ba4de9b72e95577633877
TLSH
T17261865A7949D53F6EEBC245FA4F2B43BFEB00531288BF41C2E90A3D0A6EF5C0216106
MD5 SHA1 SHA512 TLSH

Submit Download

8efebdbc-f987-4f9d-a624-0a25554e6c4c.tmp

Path C:\Users\Admin\AppData\Local\User Data\8efebdbc-f987-4f9d-a624-0a25554e6c4c.tmp
Size 1KB
SHA256 db1e645d9048a482fb344ebd2ed634fcb10dec1834f3c737b7392043e9d77d0c
MD5 3f01eb1cd591b6c955567f77be28765b
SHA1 bbaa9e8bf74fbc87e6964ce224427a11681b01db
SHA512 f8d6f46eb01375f2c84f58d6279f5e13d5e9a7f66c38d3410ca98b9fb1bdc0b23542e5c3e1d4c9d1b839b77512ed90fe84ff5962eda883db465f868519f54d6c
TLSH
T1CF31FF59359EC83BBEDBD105F8473B239B6A10462B596F41C3F84E3C16AAB9D2326107
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\User Data\Default\Download Service\EntryDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Preferences~RFe59d4ea.TMP

Path C:\Users\Admin\AppData\Local\User Data\Default\Preferences~RFe59d4ea.TMP
Size 1KB
SHA256 7f142bf24b9798c59a4c9e00dd11c3d8127908682cf72ccb2fd1873192d44f63
MD5 b3ac4617a3d421c832f262180b074f73
SHA1 a63de5052fe1b414ccf6cea605ac66b86374f68f
SHA512 4e2603b4bf4cf14155bb795c013c2ce40c32055664c2f6249aa3b955e92ff40a5cd03c837bc30a1e50ad70be6fc4644fbec78ddabdf8a7642705863e32793670
TLSH
T1923170068C24FD779CCDD718BD2C79A3D5F20492AA90084887F88E6C0C7E7ED221B90A
MD5 SHA1 SHA512 TLSH

Submit Download

bfbfcf89-996a-4033-9c58-10a8a5e4a3c9.tmp

Path C:\Users\Admin\AppData\Local\User Data\Default\bfbfcf89-996a-4033-9c58-10a8a5e4a3c9.tmp
Size 1KB
SHA256 505b46ac48cfdfae6e1bbf4d4b6e8fdb9b9d8b4858b2272f67b5cddeb40acbfe
MD5 43c84b356f810f60d654964f180e57a1
SHA1 d72a460d2f82804537c1838d3acff44df92ebb6a
SHA512 1322e6d1230c34db77b29064f997f086d379ea32936a82a6971f16a1d49e70138199b3196b1ffbd1231fc4400e35d221efeb166532cbd04ab82bfe763d4aa975
TLSH
T10B3153068C24FD779CCDD7187D2D79A3D5F214525A90194C86F88E6C0C7E7ED211B90A
MD5 SHA1 SHA512 TLSH

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State~RFe5973af.TMP

Path C:\Users\Admin\AppData\Local\User Data\Local State~RFe5973af.TMP
Size 1KB
SHA256 d75cbb0b4b07c06bd5d743e07526a85b7dc76ba940ba3e10e15b648d7f2607c8
MD5 88c1eb17562a7161cccd392e3e8e62e7
SHA1 29b7f377e6dd7ffafe228665e663e59da78a0f59
SHA512 6e28470b8d8c6992ea70a6c63b55fb59ada2701eea00e93e6af7d69db9415c0afbe5b6910d0c80e8816e7d0f29a6325d61622076b62c29b3e2fbc516fd004c91
TLSH
T12631025D359EC83BBE97D105F8873B239B6A10562B595F41C3F84E3C0699B9C2326107
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad\settings.dat
Size 40B
SHA256 57642d4dc6c2a743a5c9260a1f116e46f0705fed18cca23784322ac549d34f48
MD5 dca8153de3d32a750cc78dfe71857bd4
SHA1 98182265e57da1907773769189e1d1a42e9ea6dd
SHA512 4ad71e4eb1bdd29f5302847ed61c8a717743c16c6ca3abb16a564f88adcbad408b4ce443beff9a9c0015c65cf0c5164852ac4babdede6da658b48c34455bb01f
MD5 SHA1 SHA512

Submit Download