Analysis

  • user interaction
    yes
  • max time kernel
    20s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    13/08/2026, 06:06

General

  • Target
    [Kimochi] ei-chan/ei_chan_1_2.exe
  • Size 92.2MB
  • Sample260813-gt67pacl21
  • SHA256 852cc60d05debedf34909beca0704d80f381642d81af24ec52be252179f2a0d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

  • Modifies registry class 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[Kimochi] ei-chan\ei_chan_1_2.exe
    "C:\Users\Admin\AppData\Local\Temp\[Kimochi] ei-chan\ei_chan_1_2.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:5696

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        087916079fba7c625e62b0c2cca570e0fb87c99a.d3d12.cache

        • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\ei_chan\shader_cache\CanvasShaderRD\8f73ea59600218c7f4a72f38f0a825d4b9edae392f00688807259ea2faf43974\087916079fba7c625e62b0c2cca570e0fb87c99a.d3d12.cache
        • Size 102KB
        • SHA256 dbebdf7b09901dccc1cd5b5f545141dc8686ffda795f26b31f408ee3db61e2bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bd33586e5b4ab43d0ed44449bea9999213fbb45e.d3d12.cache

        • Path C:\Users\Admin\AppData\Roaming\Godot\app_userdata\ei_chan\shader_cache\CanvasShaderRD\8f73ea59600218c7f4a72f38f0a825d4b9edae392f00688807259ea2faf43974\bd33586e5b4ab43d0ed44449bea9999213fbb45e.d3d12.cache
        • Size 102KB
        • SHA256 87d440204b7dbeff395924a7bda3a79366682b675b901c9596f0670388b36211
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/5696-2-0x0000023DFE4B0000-0x0000023DFE4B1000-memory.dmp

        memory/5696-0-0x0000023DFE4B0000-0x0000023DFE4B1000-memory.dmp

        memory/5696-1-0x0000023DFE4B0000-0x0000023DFE4B1000-memory.dmp

        memory/5696-70-0x00007FF716DD0000-0x00007FF71CB69000-memory.dmp