487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474

Analysis

user interaction
yes
max time kernel
152s
max time network
197s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dark desire train/[Kimochi] RJ01134914 v1.01/Game.exe
Size 1.5MB
Sample260809-3fa3zsch95
SHA256 487bd28f3d0b43ed9827ba519d6d113c4f31059bd62b4492da586c7bc82a9474
MD5 9ebc7dd20fa66f5deabfd8873a4ed8c6
SHA1 cf1b1da0e5215738a8e972077be5804cb326b8ed
SHA512 5d0a052edec070ee573bc43ed9eb7eb92c0460efe60a5abc31d1200e092937b91eafce5492cd945d46645f9029f0f80a37907fe6292639d37f15f58dae377271
SSDEEP 24576:5XVhPcthsRP/d3qI4N+Nl49LPSncvK51CvO8ofTWIZAmOLB:R5RP/d6IxNIKnL5mO8ofTrZAmm
TLSH
T12D759D01A4629075CB522271EC2CF73D6B206E1D4BF249F7FB946DE9AFB01E0353259A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Game.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{17404387-B82D-4843-BA7D-B831FA7AC113}	Game.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2644	Game.exe
2644	Game.exe
5948	Game.exe
5948	Game.exe
1620	Game.exe
1620	Game.exe
5948	Game.exe
5948	Game.exe
4156	Game.exe
4156	Game.exe
1124	Game.exe
1124	Game.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5948	Game.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5948 wrote to memory of 4544	5948	Game.exe	88
PID 4544 wrote to memory of 4856	4544	Game.exe	89
PID 5948 wrote to memory of 2644	5948	Game.exe	90
PID 5948 wrote to memory of 1620	5948	Game.exe	91
PID 5948 wrote to memory of 4156	5948	Game.exe	94
PID 5948 wrote to memory of 1124	5948	Game.exe	95

C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
"C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --annotation=plat=Win32 --annotation=prod= --annotation=ver= --initial-client-data=0x2fc,0x300,0x304,0x2f8,0x308,0x7512d0e0,0x7512d0f0,0x7512d0fc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
    "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" --annotation=plat=Win32 --annotation=prod= --annotation=ver= --initial-client-data=0x1c8,0x1cc,0x1d0,0x1c4,0x1d4,0x86d820,0x86d830,0x86d83c
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4856
- C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe" --type=gpu-process --field-trial-handle=1668,14998738907240514671,10602239163155957844,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01" --gpu-preferences=KAAAAAAAAAAABwCAAQAAAAAAAAAAAGAAAQAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor=Microsoft --gpu-driver-version=10.0.26100.1 --gpu-driver-date=6-21-2006 --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01" --service-request-channel-token=019E3F6BF5D2E13B187031F131A04A34 --mojo-platform-channel-handle=1684 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2644
- C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe" --type=renderer --js-flags=--expose-gc --no-sandbox --no-zygote --field-trial-handle=1668,14998738907240514671,10602239163155957844,131072 --service-pipe-token=0A856CB971A07C82D33D8D48695CE4D5 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01" --nwjs --extension-process --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true,cssExternalScannerNoPreload=false,cssExternalScannerPreload=true --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-checker-imaging --enable-compositor-image-animations --service-request-channel-token=0A856CB971A07C82D33D8D48695CE4D5 --renderer-client-id=3 --mojo-platform-channel-handle=2560 /prefetch:1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1620
- C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe" --type=utility --field-trial-handle=1668,14998738907240514671,10602239163155957844,131072 --lang=en-US --no-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01" --service-request-channel-token=4524878341584520A1664DA41C60C7AB --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe
  "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\Game.exe" --type=utility --field-trial-handle=1668,14998738907240514671,10602239163155957844,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01" --service-request-channel-token=162592444C29103B91221173224B9C49 --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57142267-625b-4f68-a992-7efb33561ce8.tmp

Path C:\Users\Admin\AppData\Local\User Data\57142267-625b-4f68-a992-7efb33561ce8.tmp
Size 1KB
SHA256 797e842ca73a635c7eb2ce325f80a1e2b2709398c3c53238f3525fc00c867dcc
MD5 8812404edbd0523f5a799133473dfdcc
SHA1 c2d2e4a7f4800b5aa6546818c2bb534c503a2423
SHA512 ff2c9904e210c7c3d0ad0b178e8c3cfbc9ac20d3f1bc03d66f1ff96cb73210718b3cbe5ef63df2deb2d7b97ada16d8d3fd0820234f51c6746205bc0c75dc4953
TLSH
T1D4311F59259EC83BBE9BD006F8473B63976A10466B552F00C3F44F3C56AAB8C232A107
MD5 SHA1 SHA512 TLSH

Submit Download

75175bf5-36aa-4624-afab-a955a1b7e4ca.tmp

Path C:\Users\Admin\AppData\Local\User Data\75175bf5-36aa-4624-afab-a955a1b7e4ca.tmp
Size 1KB
SHA256 b9d9b07983e9e59e51ce0ca77c8823ed3ce07b3e5b8ab04451f27b398bdd2b5b
MD5 097dcdea18a986e66a49ad3051eb087b
SHA1 9a8828ee45f49d3fc47ceda5498b60e94aa5b37d
SHA512 a42ae9d03df752666f67c0810224e9c04ca5c6bee93a81f70d5317f496546b3a1816b6a076b81aab37dd4f96e3bd93b49b3bcbf00c7e4173afd9ecd434158fe9
TLSH
T16E31245D359EC83BFE979105F8473B638B6A104527156F44C3F40F3C56A9B9C232A107
MD5 SHA1 SHA512 TLSH

Submit Download

77af05e6-9eea-43be-865d-f19b5ea6de3f.tmp

Path C:\Users\Admin\AppData\Local\User Data\77af05e6-9eea-43be-865d-f19b5ea6de3f.tmp
Size 3KB
SHA256 7650aff3f52ee57a67e09634791cb8c5a3b4e3c98af7a5d0a177bc2f2eefd143
MD5 a21ab518165eaf3a0fc6c30890affcc0
SHA1 093a86c98531d57f49ed7bd802c2bc50256a2b71
SHA512 4d6d7521eac2b45ada92adf449c0881623d42b493615daaa8bcd3a4945580e07d5bc0cb700d20cf82014ab0defe5b081f4f75dc2c30a6d303a877ae0157a44ea
TLSH
T17461865A7989C53F5ED7C245F94F2B43BFAB00535288BF40D2E90A3D066EF5C0316106
MD5 SHA1 SHA512 TLSH

Submit Download

672accd8-c185-49f5-a8cd-98c5f4aa007e.tmp

Path C:\Users\Admin\AppData\Local\User Data\Default\672accd8-c185-49f5-a8cd-98c5f4aa007e.tmp
Size 1KB
SHA256 b78b75da921638253750b9ebad3cb0d5c8ede9f405fafcae447b44ec5edf27a8
MD5 051d6fd9f7cda213ea96ba07f396a31f
SHA1 a5b56c883f8af1636872d00203f428db4d0657a2
SHA512 ae65c0d63fd2bba89c00c8f2a233a6da8faf372cb485f2b9f568302f4b61254e1133eb5baaad7a187b9831b1cb044bae3f7e29428f431e9296a5eae11805aead
TLSH
T1AB3156058C34FD778C89D7187D2D7963D1F51452AA80194C96F84A6C0C6E6ED211B906
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe5b9641.TMP

Path C:\Users\Admin\AppData\Local\User Data\Default\Preferences~RFe5b9641.TMP
Size 1KB
SHA256 02edef316cdc60c7eba8c54588fd8a964d8a3512ea17228d770e3352521850a7
MD5 70d6b71699720e4dfacc3dd6c1a97376
SHA1 6cfb6af76cd9667ce5e7a8f5d8c043ebba4ca2f9
SHA512 1287b640b3bb4dac4b4fa25361351c22ac00e6cf0b35ced7ab2458bcc5753bca6c01a61315f2ed7746facb7d45f6957924cf786a8f4ad0dca098a96e0aed9529
TLSH
T1E63153068C24FDB79C9DD7187D2C79A3D1F60492AA80195C96F84A6C0CAE7ED221B90A
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\User Data\Default\Thumbnails\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000002.dbtmp

Path C:\Users\Admin\AppData\Local\User Data\Default\data_reduction_proxy_leveldb\000002.dbtmp
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State~RFe5b35c2.TMP

Path C:\Users\Admin\AppData\Local\User Data\Local State~RFe5b35c2.TMP
Size 1KB
SHA256 af0c8cf900283453dacc10ca3c2769d749ecfc7c88f937725a4f5ff6810d9cae
MD5 a906d8c9c59f59f166e915bb3f65f30a
SHA1 35da0ab93ab82696e20e65d9945fc1907097bb6e
SHA512 ecd9c35012b049177d42f6e168112056339f064fd0286144069b43828bc04ba9fa2438213d6f40ae4db2ff470a36f04c327d5663a08d92f0154e5e542c129533
TLSH
T1BF31225D35AEC83BBE979105F8473B238B2A104627192F44C3F40F3C46AAB9C2326107
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad\settings.dat
Size 40B
SHA256 3df95c70adf986dc1ab77886923f69ec741c9823bd1c3472615a967e0f01c14a
MD5 241caa3f0e7fc728edd9b90a47c5edb2
SHA1 e35fc40f38084bd552a7ef8a8a30038e633f8388
SHA512 c44b7744f510718d1eda472db075f9e1992a40595afbf7e77b0d5341dbf8f2c29ef09cff59b87544491a2e36c5cbde4d3498f609557dabbc498a727443fddca2
MD5 SHA1 SHA512

Submit Download