Analysis
- max time kernel
165s - max time network
177s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 02:31
General
- Target undercover agent reverse train otome unsafe/otomi-games.com_OMVCTOAA/女潜入捜査官の変態痴�.exe
- Size 30.6MB
- Sample260910-czpsdawxbs
- SHA256 6b5ec621e8c4c936db96095fe4db0bd86252a622aebe11c16fc6d56a0f88e74f
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\undercover agent reverse train otome unsafe\otomi-games.com_OMVCTOAA\女潜入捜査官の変態痴�.exe"C:\Users\Admin\AppData\Local\Temp\undercover agent reverse train otome unsafe\otomi-games.com_OMVCTOAA\女潜入捜査官の変態痴�.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\undercover agent reverse train otome unsafe\otomi-games.com_OMVCTOAA\女潜入捜査官の変態痴�.exe"C:\Users\Admin\AppData\Local\Temp\undercover agent reverse train otome unsafe\otomi-games.com_OMVCTOAA\女潜入捜査官の変態痴�.exe" --type=renderer --enable-experimental-web-platform-features --no-sandbox --lang=en-US --nodejs --working-directory="C:\Users\Admin\AppData\Local\Temp\undercover agent reverse train otome unsafe\otomi-games.com_OMVCTOAA" --disable-webgl --disable-pepper-3d --disable-gl-multisampling --disable-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-video-decode --channel="2336.0.1388230226\1751524054" /prefetch:6731311512⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
00000000
memory/2332-37-0x000000003C800000-0x000000003C801000-memory.dmp
memory/2332-48-0x00000000003F0000-0x0000000003490000-memory.dmp
memory/2332-46-0x00000000003F0000-0x0000000003490000-memory.dmp
memory/2332-38-0x0000000010000000-0x0000000010024000-memory.dmp
memory/2332-32-0x000000002F700000-0x000000002F701000-memory.dmp
memory/2332-33-0x000000000F200000-0x000000000F201000-memory.dmp
memory/2332-34-0x000000003C000000-0x000000003C001000-memory.dmp
memory/2332-35-0x0000000036C00000-0x0000000036C01000-memory.dmp
memory/2332-36-0x0000000024E00000-0x0000000024E01000-memory.dmp
memory/2336-11-0x00000000031BF000-0x00000000031C0000-memory.dmp
memory/2336-44-0x00000000003F0000-0x0000000003490000-memory.dmp
memory/2336-17-0x00000000003F0000-0x0000000003490000-memory.dmp
memory/2336-0-0x00000000003F0000-0x0000000003490000-memory.dmp
memory/2336-15-0x0000000007930000-0x0000000007D01000-memory.dmp
memory/2336-12-0x000000004AD00000-0x000000004B681000-memory.dmp
memory/2336-1-0x0000000077668000-0x0000000077669000-memory.dmp
memory/2336-22-0x00000000003F0000-0x0000000003490000-memory.dmp
memory/2336-45-0x00000000003F0000-0x0000000003490000-memory.dmp
memory/2336-2-0x0000000077669000-0x000000007766A000-memory.dmp
memory/2336-47-0x00000000FF350000-0x00000000FF721000-memory.dmp
memory/2336-3-0x00000000FF350000-0x00000000FF721000-memory.dmp
memory/2336-49-0x00000000003F0000-0x0000000003490000-memory.dmp
memory/2336-50-0x00000000003F0000-0x0000000003490000-memory.dmp