6ebcc47c6fd348c9f17fb53985afca4cfe6300c0cc4d393c0755f60a59d0fdfb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_ICQ Spammer.exe
Size 919KB
Sample260910-errywafc89
SHA256 6ebcc47c6fd348c9f17fb53985afca4cfe6300c0cc4d393c0755f60a59d0fdfb
MD5 5339ea33da9368d0cd8f73d2e993b5a4
SHA1 f3783c228b2660b0082be3304f360836f17ceb5b
SHA512 113da2f500d7f79787916278dc8bbbddfdd64a3f7b83173a30cddd7db4eeabcd67579154b39ccaac896b1555d78b6008de0cab8616088de6a7dac0263150d0a3
SSDEEP 12288:Y1xLKqGCW2MjxYUCoUsRcF1uLl672UvXnHyMujJdrwBOX:OVNPfsRy1F7NHiXswX
TLSH
T13915CFDED16E44D2CC053FF9A8241AC75B2487728A74005839BFBD498F774FA805EEA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

collection discovery spyware stealer upx

Malware Config

Signatures

Detected Nirsoft tools 19 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/files/0x000800000002449e-20.dat	Nirsoft
behavioral1/memory/1884-26-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1884-27-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral1/memory/1468-36-0x0000000000400000-0x000000000041D000-memory.dmp	Nirsoft
behavioral1/memory/2072-41-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral1/memory/3488-48-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral1/memory/2072-44-0x0000000000400000-0x0000000000416000-memory.dmp	Nirsoft
behavioral1/memory/3488-49-0x0000000000400000-0x0000000000418000-memory.dmp	Nirsoft
behavioral1/memory/1468-33-0x0000000000400000-0x000000000041D000-memory.dmp	Nirsoft
behavioral1/memory/3436-60-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft
behavioral1/memory/2896-63-0x0000000000400000-0x0000000000410000-memory.dmp	Nirsoft
behavioral1/memory/3396-81-0x0000000000400000-0x000000000041A000-memory.dmp	Nirsoft
behavioral1/memory/3396-84-0x0000000000400000-0x000000000041A000-memory.dmp	Nirsoft
behavioral1/memory/3396-80-0x0000000000400000-0x000000000041A000-memory.dmp	Nirsoft
behavioral1/memory/1216-75-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft
behavioral1/memory/1216-71-0x0000000000400000-0x0000000000419000-memory.dmp	Nirsoft
behavioral1/memory/2896-66-0x0000000000400000-0x0000000000410000-memory.dmp	Nirsoft
behavioral1/memory/2896-65-0x0000000000400000-0x0000000000410000-memory.dmp	Nirsoft
behavioral1/memory/3436-61-0x0000000000400000-0x000000000041C000-memory.dmp	Nirsoft

NirSoft MailPassView 3 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral1/files/0x000800000002449e-20.dat	MailPassView
behavioral1/memory/1468-36-0x0000000000400000-0x000000000041D000-memory.dmp	MailPassView
behavioral1/memory/1468-33-0x0000000000400000-0x000000000041D000-memory.dmp	MailPassView

Executes dropped EXE 10 IoCs

pid	Process
4572	664433.exe
1884	664433.exe
1468	664433.exe
2072	664433.exe
3488	664433.exe
3436	664433.exe
2896	664433.exe
1216	664433.exe
3396	664433.exe
3896	664433.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	664433.exe

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 4572 set thread context of 1884	4572	664433.exe	85
PID 4572 set thread context of 1468	4572	664433.exe	86
PID 4572 set thread context of 2072	4572	664433.exe	87
PID 4572 set thread context of 3488	4572	664433.exe	88
PID 4572 set thread context of 3436	4572	664433.exe	93
PID 4572 set thread context of 2896	4572	664433.exe	94
PID 4572 set thread context of 1216	4572	664433.exe	95
PID 4572 set thread context of 3396	4572	664433.exe	96
PID 4572 set thread context of 3896	4572	664433.exe	97

UPX packed file 29 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1884-25-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/1884-26-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/1884-22-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/1884-27-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/1468-32-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1468-36-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2072-41-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/3488-48-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/3488-47-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/3488-45-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/2072-44-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/3488-49-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral1/memory/2072-40-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/2072-37-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/1468-33-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1468-29-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/3436-56-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3436-59-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3436-60-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3396-81-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/3396-79-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/3396-84-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/3396-80-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/3396-77-0x0000000000400000-0x000000000041A000-memory.dmp	upx
behavioral1/memory/1216-75-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1216-71-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1216-70-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/1216-68-0x0000000000400000-0x0000000000419000-memory.dmp	upx
behavioral1/memory/3436-61-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	664433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	664433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	664433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	664433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	664433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	664433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	664433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	664433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	664433.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1884	664433.exe
1884	664433.exe
1216	664433.exe
1216	664433.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1884	664433.exe
Token: SeDebugPrivilege	2072	664433.exe
Token: SeDebugPrivilege	1216	664433.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 4572	816	jaffacakes118_ICQ Spammer.exe	84
PID 4572 wrote to memory of 1884	4572	664433.exe	85
PID 4572 wrote to memory of 1884	4572	664433.exe	85
PID 4572 wrote to memory of 1884	4572	664433.exe	85
PID 4572 wrote to memory of 1884	4572	664433.exe	85
PID 4572 wrote to memory of 1468	4572	664433.exe	86
PID 4572 wrote to memory of 1468	4572	664433.exe	86
PID 4572 wrote to memory of 1468	4572	664433.exe	86
PID 4572 wrote to memory of 1468	4572	664433.exe	86
PID 4572 wrote to memory of 2072	4572	664433.exe	87
PID 4572 wrote to memory of 2072	4572	664433.exe	87
PID 4572 wrote to memory of 2072	4572	664433.exe	87
PID 4572 wrote to memory of 2072	4572	664433.exe	87
PID 4572 wrote to memory of 3488	4572	664433.exe	88
PID 4572 wrote to memory of 3488	4572	664433.exe	88
PID 4572 wrote to memory of 3488	4572	664433.exe	88
PID 4572 wrote to memory of 3488	4572	664433.exe	88
PID 4572 wrote to memory of 3436	4572	664433.exe	93
PID 4572 wrote to memory of 3436	4572	664433.exe	93
PID 4572 wrote to memory of 3436	4572	664433.exe	93
PID 4572 wrote to memory of 3436	4572	664433.exe	93
PID 4572 wrote to memory of 2896	4572	664433.exe	94
PID 4572 wrote to memory of 2896	4572	664433.exe	94
PID 4572 wrote to memory of 2896	4572	664433.exe	94
PID 4572 wrote to memory of 2896	4572	664433.exe	94
PID 4572 wrote to memory of 2896	4572	664433.exe	94
PID 4572 wrote to memory of 2896	4572	664433.exe	94
PID 4572 wrote to memory of 1216	4572	664433.exe	95
PID 4572 wrote to memory of 1216	4572	664433.exe	95
PID 4572 wrote to memory of 1216	4572	664433.exe	95
PID 4572 wrote to memory of 1216	4572	664433.exe	95
PID 4572 wrote to memory of 3396	4572	664433.exe	96
PID 4572 wrote to memory of 3396	4572	664433.exe	96
PID 4572 wrote to memory of 3396	4572	664433.exe	96
PID 4572 wrote to memory of 3396	4572	664433.exe	96
PID 4572 wrote to memory of 3896	4572	664433.exe	97
PID 4572 wrote to memory of 3896	4572	664433.exe	97
PID 4572 wrote to memory of 3896	4572	664433.exe	97
PID 4572 wrote to memory of 3896	4572	664433.exe	97
PID 4572 wrote to memory of 3896	4572	664433.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ICQ Spammer.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_ICQ Spammer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Admin\AppData\Local\Temp\664433.exe
  C:\Users\Admin\AppData\Local\Temp\664433.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Users\Admin\AppData\Local\Temp\664433.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\664433.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook accounts
    - System Location Discovery: System Language Discovery
    PID:1468
- - C:\Users\Admin\AppData\Local\Temp\664433.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2072
- - C:\Users\Admin\AppData\Local\Temp\664433.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3488
- - C:\Users\Admin\AppData\Local\Temp\664433.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3436
- - C:\Users\Admin\AppData\Local\Temp\664433.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2896
- - C:\Users\Admin\AppData\Local\Temp\664433.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\664433.exe
    /stext C:\Users\Admin\AppData\Local\Temp\temp.txt
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3396
- - C:\Users\Admin\AppData\Local\Temp\664433.exe
    "C:\Users\Admin\AppData\Local\Temp\664433.exe"
    3⤵
    - Executes dropped EXE
    PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

664433.exe

Path C:\Users\Admin\AppData\Local\Temp\664433.exe
Size 443KB
SHA256 8d2915c203bc05d8479d6160d5dcbc0828d6b8e52be5e987bcae357ab8600f17
MD5 ecde0067cc525052fd1542d7df853264
SHA1 d5847eed2e0e7e72835b9ffcb531f910e768691e
SHA512 ec858b2d4b880193ed600e24568a4a77dcb75707b573f44d09f3872bfd903058f973db98443d21047772f62b5b14ae222f10701b52f5e8800e800cc0a298ddd9
SSDEEP 12288:79d4qI+imdk+kUgp/BmJ4e52AopF7tQiRHFqr:r40i+knpJmJ4e52AeFJHFm
TLSH
T18DA4CF17F7C185B6C4E74831011B16765AB4FA32C6215BABABD01D1EEE312D6FE3834A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp.txt

Path C:\Users\Admin\AppData\Local\Temp\temp.txt
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

temp.txt

Path C:\Users\Admin\AppData\Local\Temp\temp.txt
Size 316B
SHA256 e47e076c4615f876786297e5827671b8cf46d263a81acb06e1a41cba6d721450
MD5 fac3a37c75e20445b03890263cd1a5ca
SHA1 93ff05147ad76e0b1a3d7c265895b8565a0ba66d
SHA512 f4a3d4ecccbb32be3d3662c2e5c686d1f3c2956ce232a23ba85a3b3395fadd03a08539f1a09a073b51bfa06cab8454ddba5c62ad8f80d5ee98b7208a9532c236
TLSH
T10FE02B0802C44E770890B3FA1100C130FDCAEE061C0B2004389C30D81F3FB8A31E005F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/816-21-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-14-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-5-0x0000000000D50000-0x0000000000D58000-memory.dmp

Download

memory/816-6-0x000000001C000000-0x000000001C04C000-memory.dmp

Download

memory/816-7-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-8-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-9-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-10-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-11-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-12-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-13-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-88-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-15-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-17-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-3-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-51-0x00007FFE38CE0000-0x00007FFE39681000-memory.dmp

Download

memory/816-4-0x000000001BEA0000-0x000000001BF3C000-memory.dmp

Download

memory/816-50-0x00007FFE38F95000-0x00007FFE38F96000-memory.dmp

Download

memory/816-1-0x000000001B320000-0x000000001B3C6000-memory.dmp

Download

memory/816-0-0x00007FFE38F95000-0x00007FFE38F96000-memory.dmp

Download

memory/816-2-0x000000001B8D0000-0x000000001BD9E000-memory.dmp

Download

memory/1216-75-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1216-68-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1216-70-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1216-71-0x0000000000400000-0x0000000000419000-memory.dmp

Download

memory/1468-36-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1468-32-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1468-33-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1468-29-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1884-22-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1884-27-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1884-25-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1884-26-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2072-40-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2072-44-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2072-37-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2072-41-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/2896-66-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2896-63-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2896-65-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3396-80-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3396-79-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3396-84-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3396-81-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3396-77-0x0000000000400000-0x000000000041A000-memory.dmp

Download

memory/3436-60-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3436-61-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3436-59-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3436-56-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3488-49-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/3488-45-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/3488-47-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/3488-48-0x0000000000400000-0x0000000000418000-memory.dmp

Download

memory/3896-85-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3896-89-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/3896-91-0x0000000000400000-0x0000000000410544-memory.dmp

Download

memory/3896-90-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/4572-93-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/4572-97-0x0000000010000000-0x0000000010006000-memory.dmp

Download