Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/09/2026, 03:15
General
- Target jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.exe
- Size 13.5MB
- Sample260912-dr286scc62
- SHA256 e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4
Malware Config
Extracted
-
hijackloader
-
directory
%ALLUSERSPROFILE%\d51901c26227fb29
-
inject_dll
%windir%\SysWOW64\pla.dll
Extracted
-
acreed
-
telemetryapi.live
-
block
latest
-
call_obj
{"to":"0xD13Fa758d18aCff16648D35a657DF929341dc6c1","data":"0x24c12bf6"}
-
header
Content-Type: application/json
-
host
https://data-seed-prebsc-1-s1.binance.org:8545
-
method
eth_call
-
version
2.0
Signatures
- Family: Acreed
Acreed is an information stealer.
- Family: HijackLoader, IDAT loader, Ghostulse,
HijackLoader is a multi-stage loader, first seen in 2023.
- Detects Acreed Stealer 4 IoCs
- Detects HijackLoader (aka IDAT Loader) 1 IoCs
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 15 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 5 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JA5TD.tmp\jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.tmp"C:\Users\Admin\AppData\Local\Temp\is-JA5TD.tmp\jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.tmp" /SL5="$401C2,6915730,822272,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.exe" /VERYSILENT3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PTO2A.tmp\jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.tmp"C:\Users\Admin\AppData\Local\Temp\is-PTO2A.tmp\jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.tmp" /SL5="$501C2,6915730,822272,C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\{450304A3-7C83-4808-BF14-F5D13DF263B1}\EnergyInject16.exe"C:\Users\Admin\AppData\Roaming\{450304A3-7C83-4808-BF14-F5D13DF263B1}\EnergyInject16.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\d51901c26227fb29\EnergyInject16.exeC:\ProgramData\d51901c26227fb29\EnergyInject16.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\SManager128.exeC:\Users\Admin\SManager128.exe7⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\ProgramData\d51901c26227fb29\XPFix.exe"C:\ProgramData\d51901c26227fb29\XPFix.exe" "C:\ProgramData\d51901c26227fb29\XPFix.exe" /u7⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
-
-
-
C:\ProgramData\d51901c26227fb29\EnergyInject16.exeC:\ProgramData\d51901c26227fb29\EnergyInject16.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
XPFix.exe
413D75D.tmp
908ACFF.tmp
908ACFF.tmp
jaffacakes118_e9c01cbcefd682be349b6ff9f91e3685a9c5a379e8417b00753d5021223603c4.tmp
_isdecmp.dll
AppState.json
EnergyInject16.exe
MSVCP110.dll
MSVCR110.dll
Peeckklunddried.zyj
Sebteatclil.db
mfc110u.dll
SManager128.exe
memory/1108-13-0x00000000005D0000-0x0000000000935000-memory.dmp
memory/1108-6-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/2120-29-0x0000000000160000-0x00000000004C5000-memory.dmp
memory/2120-51-0x0000000000160000-0x00000000004C5000-memory.dmp
memory/2120-30-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
memory/2120-21-0x0000000002EB0000-0x0000000002EB1000-memory.dmp
memory/2668-75-0x00007FFEF5D80000-0x00007FFEF5FE3000-memory.dmp
memory/2668-76-0x0000000000620000-0x000000000082B000-memory.dmp
memory/2668-117-0x0000000000620000-0x000000000082B000-memory.dmp
memory/2668-70-0x0000000000620000-0x000000000082B000-memory.dmp
memory/2668-93-0x0000000000620000-0x000000000082B000-memory.dmp
memory/2860-17-0x00000000006A0000-0x0000000000778000-memory.dmp
memory/2860-0-0x00000000006A0000-0x0000000000778000-memory.dmp
memory/3732-56-0x00007FFEDA560000-0x00007FFEDA6EE000-memory.dmp
memory/4348-95-0x00000000749A0000-0x0000000074B28000-memory.dmp
memory/4348-94-0x00007FFEF5D80000-0x00007FFEF5FE3000-memory.dmp
memory/4596-114-0x00007FFEDA560000-0x00007FFEDA6EE000-memory.dmp
memory/4972-28-0x00000000006A0000-0x0000000000778000-memory.dmp
memory/4972-14-0x00000000006A0000-0x0000000000778000-memory.dmp
memory/4972-52-0x00000000006A0000-0x0000000000778000-memory.dmp
memory/5704-64-0x00007FFEDA560000-0x00007FFEDA6EE000-memory.dmp
memory/5704-62-0x00007FFEDA560000-0x00007FFEDA6EE000-memory.dmp
memory/5704-68-0x00007FFEDA560000-0x00007FFEDA6EE000-memory.dmp