Analysis
- user interaction
yes - max time kernel
160s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
24/08/2026, 23:26
General
- Target setup_living_with_sister_monochrome_fantasy_v4_(en_1.03_cn_1.02)_(72163).exe
- Size 430.8MB
- Sample260824-3fca2szzaw
- SHA256 006a2d4b48f33355285511b267e020d4cc3357e046192d350aeaa6c6f0f19ba5
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 10 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 6 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_living_with_sister_monochrome_fantasy_v4_(en_1.03_cn_1.02)_(72163).exe"C:\Users\Admin\AppData\Local\Temp\setup_living_with_sister_monochrome_fantasy_v4_(en_1.03_cn_1.02)_(72163).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8U2VT.tmp\setup_living_with_sister_monochrome_fantasy_v4_(en_1.03_cn_1.02)_(72163).tmp"C:\Users\Admin\AppData\Local\Temp\is-8U2VT.tmp\setup_living_with_sister_monochrome_fantasy_v4_(en_1.03_cn_1.02)_(72163).tmp" /SL5="$6023A,451140714,192512,C:\Users\Admin\AppData\Local\Temp\setup_living_with_sister_monochrome_fantasy_v4_(en_1.03_cn_1.02)_(72163).exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\GOG Games\Living With Sister Monochrome Fantasy\__redist\ISI\scriptInterpreter.exe"C:\GOG Games\Living With Sister Monochrome Fantasy\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\Living With Sister Monochrome Fantasy\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Living With Sister Monochrome Fantasy" /productId="1694890072" /buildId="57424828285860088" /versionName="v4 (EN 1.03, CN 1.02)" /Language="English" /LANG="english"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-BBGR0.tmp\scriptInterpreter.tmp"C:\Users\Admin\AppData\Local\Temp\is-BBGR0.tmp\scriptInterpreter.tmp" /SL5="$B0240,662929,192512,C:\GOG Games\Living With Sister Monochrome Fantasy\__redist\ISI\scriptInterpreter.exe" /verysilent /supportDir="C:\GOG Games\Living With Sister Monochrome Fantasy\__support" /SUPPRESSMSGBOXES /NORESTART /DIR="C:\GOG Games\Living With Sister Monochrome Fantasy" /productId="1694890072" /buildId="57424828285860088" /versionName="v4 (EN 1.03, CN 1.02)" /Language="English" /LANG="english"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
-
C:\GOG Games\Living With Sister Monochrome Fantasy\Game.exe"C:\GOG Games\Living With Sister Monochrome Fantasy\Game.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1.4.0.wolf
BalloonBase_CafeLatte.wolf
BasicData.wolf
CharaChip.wolf
DLC_data.wolf
EnemyGraphic.wolf
FIcon.wolf
Fog_BackGround.wolf
Kagura.wolf
MapChip.wolf
MapData.wolf
Picture.wolf
SE.wolf
SystemFile.wolf
SystemGraphic.wolf
cg.wolf
cutin.wolf
scene.wolf
word.wolf
Game.exe
GuruguruSMF4.dll
scriptinterpreter.exe
goggame-1694890072.info
unins000.dat
unins000.exe
setup_living_with_sister_monochrome_fantasy_v4_(en_1.03_cn_1.02)_(72163).tmp
scriptInterpreter.tmp
1207664603_english.jpg
1445249983_english.jpg
1448275717_english.jpg
1448617555_english.jpg
BigOK.png
EULAAccepted.png
EULAShow.png
GOG_new.png
background.jpg
botva2.dll
btn_md5.png
crcdll.dll
error.png
error_icon.png
innocallback.dll
ok.png
progress_center.png
progress_left.png
progress_right.png
slideshow.ini
track_center.png
track_left.png
track_right.png
uninstall.dll
idp.dll
uninstall.dll
memory/564-156-0x0000000000350000-0x0000000000389000-memory.dmp
memory/564-0-0x0000000000350000-0x0000000000389000-memory.dmp
memory/564-537-0x0000000000350000-0x0000000000389000-memory.dmp
memory/2100-487-0x0000000000600000-0x0000000000752000-memory.dmp
memory/3312-445-0x0000000000EE0000-0x0000000000F19000-memory.dmp
memory/3312-488-0x0000000000EE0000-0x0000000000F19000-memory.dmp
memory/3800-263-0x0000000000B90000-0x0000000000CE2000-memory.dmp
memory/3800-245-0x00000000032F0000-0x00000000033F0000-memory.dmp
memory/3800-514-0x0000000000B90000-0x0000000000CE2000-memory.dmp
memory/3800-396-0x00000000032F0000-0x00000000033F0000-memory.dmp
memory/3800-494-0x00000000032F0000-0x00000000033F0000-memory.dmp
memory/3800-344-0x00000000032F0000-0x00000000033F0000-memory.dmp
memory/3800-328-0x00000000032F0000-0x00000000033F0000-memory.dmp
memory/3800-301-0x00000000032F0000-0x00000000033F0000-memory.dmp
memory/3800-269-0x00000000032F0000-0x00000000033F0000-memory.dmp
memory/3800-457-0x00000000032F0000-0x00000000033F0000-memory.dmp
memory/3800-264-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3800-265-0x0000000005730000-0x00000000057E7000-memory.dmp
memory/3800-266-0x0000000005B70000-0x0000000005B7E000-memory.dmp
memory/3800-404-0x00000000032F0000-0x00000000033F0000-memory.dmp
memory/3800-157-0x0000000000B90000-0x0000000000CE2000-memory.dmp
memory/3800-158-0x0000000000400000-0x0000000000415000-memory.dmp
memory/3800-159-0x0000000005730000-0x00000000057E7000-memory.dmp
memory/3800-160-0x0000000005B70000-0x0000000005B7E000-memory.dmp
memory/3800-161-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/3800-480-0x00000000032F0000-0x00000000033F0000-memory.dmp
memory/3800-155-0x00000000033F0000-0x00000000033F1000-memory.dmp
memory/3800-59-0x0000000005B70000-0x0000000005B7E000-memory.dmp
memory/3800-14-0x0000000005730000-0x00000000057E7000-memory.dmp
memory/3800-5-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/4380-541-0x0000000024340000-0x0000000024365000-memory.dmp