Analysis
- max time kernel
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 23:26
General
- Target dark desire train/[Kimochi] RJ01134914 v1.01/www/audio/bgs/7-ハードピストン（中速）.ps1
- Size 433KB
- Sample260809-3fa3zsch95
- SHA256 836764cae9f28b15d0af66fc72d7ce8fde6dfd8f431db56314e7a8623436306e
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\dark desire train\[Kimochi] RJ01134914 v1.01\www\audio\bgs\7-ハードピストン（中速）.ps1"1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004F01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/6356-0-0x00007FFCEE58F000-0x00007FFCEE590000-memory.dmp
memory/6356-1-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/6356-4-0x000001F0689C0000-0x000001F0689E2000-memory.dmp
memory/6356-5-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/6356-6-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/6356-7-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/6356-8-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/6356-9-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/6356-10-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/6356-11-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/6356-12-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/6356-13-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/6356-14-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/6356-15-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/6356-18-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp
memory/6356-17-0x00007FFCEE400000-0x00007FFCEEDA4000-memory.dmp