Overview
overview
3Static
static
3[Kimochi] ...ly.dll
windows10-2004-x64
3[Kimochi] ...ly.dll
windows11-ltsc_2024-x64
3[Kimochi] ...do.exe
windows10-2004-x64
3[Kimochi] ...do.exe
windows11-ltsc_2024-x64
3[Kimochi] ...ed.dll
windows10-2004-x64
3[Kimochi] ...ed.dll
windows11-ltsc_2024-x64
3[Kimochi] ...er.dll
windows10-2004-x64
3[Kimochi] ...er.dll
windows11-ltsc_2024-x64
3[Kimochi] ...ib.dll
windows10-2004-x64
3[Kimochi] ...ib.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
21/08/2026, 17:34
Static task
static1
Behavioral task
behavioral1
Sample
[Kimochi] RJ01535674/GameAssembly.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
[Kimochi] RJ01535674/GameAssembly.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
[Kimochi] RJ01535674/Kendo.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
[Kimochi] RJ01535674/Kendo.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
[Kimochi] RJ01535674/Kendo_Data/Plugins/x86/lib_burst_generated.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
[Kimochi] RJ01535674/Kendo_Data/Plugins/x86/lib_burst_generated.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
[Kimochi] RJ01535674/UnityPlayer.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
[Kimochi] RJ01535674/UnityPlayer.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
[Kimochi] RJ01535674/baselib.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
[Kimochi] RJ01535674/baselib.dll
Resource
win11ltsc2024-20260709-en
General
- Target [Kimochi] RJ01535674/GameAssembly.dll
- Size 28.0MB
- Sample260821-v5pcxaythy
- SHA256 961b2f21940bd89c53d737f1afc11184b045a1928d0bbb9143a82520b0ddc30c
- MD5 158fd3da29d8d080f85bfd6d128a6d53
- SHA1 6cb937269f1ede427cf7270dcaaaf7fa40b7f256
- SHA512 97bea76172c87b783a3add7c2123c4bcf659a06107aa9d6e214a99d9a8aa03040470716e61f24af469fc55cab3a23c6532f3e3ef3fcf81878165c19737c32844
- SSDEEP 393216:0ES5faJoce5vpmYALtOIoEtPrQMmJ7CHYYCJ:xOeebKLtOIoENEXJ7QYYCJ
- TLSH T1ED578E25F6719611EEB410FAA57D3EFFAD2E49002F3D40D739E406FD85B41E220BA25A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4904 wrote to memory of 4648 4904 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\[Kimochi] RJ01535674\GameAssembly.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\[Kimochi] RJ01535674\GameAssembly.dll",#12⤵
- System Location Discovery: System Language Discovery
PID:4648
-