citadel | 98799ef930c1987b97321d1759eca78625741979896888a546ab338690093e0b

Analysis

max time kernel
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/09/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_e702962387fe4e66af5bc2531a96e07d_JaffaCakes118.exe
Size 225KB
Sample260915-vb22xayte1
SHA256 98799ef930c1987b97321d1759eca78625741979896888a546ab338690093e0b
MD5 e702962387fe4e66af5bc2531a96e07d
SHA1 24bf6d15c162122491534bd04ae3c45d474892d2
SHA512 c92f824e02aedc1a7ec8920b9222d3b1a0f1f43fd662d53ac499657bc5b28af53c2b897d8d6b740516ef7bd7a27db3a069105f4ee5252c73323f458f8eca0dbd
SSDEEP 6144:35gLQbhytZsxEPWupfrCuGmJiF91uOlsna:35gLQbCZsxEPW4fwWCD4a
TLSH
T15D3401553790C077F862A5B444F4C2A116BB3832B2B7C487BBB869652FE43D0972A377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery citadel trojan

Malware Config

Signatures

Family: Citadel
Citadel is a trojan and botnet written in C.
trojan botnet citadel

Detects Citadel payload 2 IoCs

resource	yara_rule
behavioral1/memory/4772-2-0x0000000000400000-0x000000000043A000-memory.dmp	family_citadel
behavioral1/memory/4772-6-0x0000000000400000-0x000000000043A000-memory.dmp	family_citadel

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4876	4772	WerFault.exe	82
1208	4772	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_e702962387fe4e66af5bc2531a96e07d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e702962387fe4e66af5bc2531a96e07d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_e702962387fe4e66af5bc2531a96e07d_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 676
  2⤵
  - Program crash
  PID:4876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 696
  2⤵
  - Program crash
  PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4772 -ip 4772
1⤵
PID:4716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4772 -ip 4772
1⤵
PID:3792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4772-1-0x0000000002420000-0x0000000002446000-memory.dmp

Download

memory/4772-2-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/4772-6-0x0000000000400000-0x000000000043A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads