Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/09/2026, 03:45
General
- Target jaffacakes118_MSN UND ICQ SPY GUCK DIR DIE WEBCAM VON ANDEREN AN!!.exe
- Size 1.4MB
- Sample260910-ebapnafb58
- SHA256 018e2aec30af49d6f6d34342781087f4b41ddcf24f3bf32253c6c57be68ff93b
Malware Config
Signatures
- Detected Nirsoft tools 4 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_MSN UND ICQ SPY GUCK DIR DIE WEBCAM VON ANDEREN AN!!.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_MSN UND ICQ SPY GUCK DIR DIE WEBCAM VON ANDEREN AN!!.exe"1⤵
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_MSN UND ICQ SPY GUCK DIR DIE WEBCAM VON ANDEREN AN!!.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_MSN UND ICQ SPY GUCK DIR DIE WEBCAM VON ANDEREN AN!!.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_MSN UND ICQ SPY GUCK DIR DIE WEBCAM VON ANDEREN AN!!.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_MSN UND ICQ SPY GUCK DIR DIE WEBCAM VON ANDEREN AN!!.exe/stext C:\Users\Admin\AppData\Local\Temp\temp.txt2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4216-39-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4216-37-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4216-36-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4216-38-0x0000000000400000-0x0000000000419000-memory.dmp
memory/4536-51-0x0000000000400000-0x0000000000418000-memory.dmp
memory/4536-48-0x0000000000400000-0x0000000000418000-memory.dmp
memory/4536-49-0x0000000000400000-0x0000000000418000-memory.dmp
memory/4536-50-0x0000000000400000-0x0000000000418000-memory.dmp
memory/4900-13-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4900-72-0x0000000004970000-0x0000000004971000-memory.dmp
memory/4900-0-0x0000000000400000-0x00000000006BE000-memory.dmp
memory/4900-12-0x00000000046D0000-0x00000000046F7000-memory.dmp
memory/4900-80-0x0000000000400000-0x00000000006BE000-memory.dmp
memory/4900-79-0x0000000000400000-0x00000000006BE000-memory.dmp
memory/4900-78-0x0000000000400000-0x00000000006BE000-memory.dmp
memory/4900-77-0x0000000010000000-0x000000001001F000-memory.dmp
memory/4900-18-0x0000000004700000-0x000000000470A000-memory.dmp
memory/4900-1-0x0000000004960000-0x0000000004961000-memory.dmp
memory/4900-2-0x0000000004950000-0x0000000004951000-memory.dmp
memory/4900-5-0x00000000048C0000-0x00000000048C1000-memory.dmp
memory/4900-6-0x0000000004910000-0x0000000004911000-memory.dmp
memory/4900-8-0x0000000004920000-0x0000000004921000-memory.dmp
memory/4900-9-0x0000000004980000-0x0000000004981000-memory.dmp
memory/4900-7-0x0000000004940000-0x0000000004941000-memory.dmp
memory/4900-4-0x0000000004930000-0x0000000004931000-memory.dmp
memory/4900-76-0x0000000000400000-0x00000000006BE000-memory.dmp
memory/4900-75-0x0000000010000000-0x000000001003E000-memory.dmp
memory/4900-74-0x0000000000400000-0x00000000006BE000-memory.dmp
memory/4900-3-0x00000000048D0000-0x00000000048D1000-memory.dmp
memory/4900-66-0x0000000010000000-0x000000001001F000-memory.dmp
memory/4900-70-0x0000000010000000-0x000000001001F000-memory.dmp
memory/4900-69-0x0000000010000000-0x000000001001F000-memory.dmp
memory/4900-68-0x0000000010000000-0x000000001001F000-memory.dmp
memory/5896-62-0x0000000000400000-0x0000000000412000-memory.dmp
memory/5896-60-0x0000000000400000-0x0000000000412000-memory.dmp
memory/5896-63-0x0000000000400000-0x0000000000412000-memory.dmp
memory/5896-61-0x0000000000400000-0x0000000000412000-memory.dmp
memory/6032-24-0x0000000000400000-0x000000000041F000-memory.dmp
memory/6032-25-0x0000000000400000-0x000000000041F000-memory.dmp
memory/6032-26-0x0000000000400000-0x000000000041F000-memory.dmp
memory/6032-27-0x0000000000400000-0x000000000041F000-memory.dmp