Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/09/2026, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118__97e0ddcb4d161aa1917e7671e3344ae0.dll
Resource
win10v2004-20260911-en
3 signatures
150 seconds
General
- Target jaffacakes118__97e0ddcb4d161aa1917e7671e3344ae0.dll
- Size 62KB
- Sample260919-reqw9sstcw
- SHA256 33ce7080798d9c67ac289ebb05506f3e825c0bd4d0fbd1887ff01dc1414452c3
- MD5 97e0ddcb4d161aa1917e7671e3344ae0
- SHA1 5046f1007c6bf7e941866f923546cc40008dd358
- SHA512 2933a3a1369f08a3e5c84217a6014c7d94722f6190619e8f3875fcc21a5b7defa24814ad8cb178c4a6fb428cc75d825fe40d048b0222d66f20d30ec38747a84a
- SSDEEP 1536:1RpwMx9Zr0ILlV7Py0uLJGB/5U9GEtD0WDf:1FZrrvPy0ugNPEtD0WDf
- TLSH T18B53BF12B6D681F3D1A7853944C59B126B7FF80807F58AC70FA4231DBE222E4BB79356
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5620-0-0x00000000010F0000-0x00000000010FE000-memory.dmp upx behavioral2/memory/5620-4-0x00000000010F0000-0x00000000010FE000-memory.dmp upx behavioral2/memory/5620-6-0x00000000010F0000-0x00000000010FE000-memory.dmp upx behavioral2/memory/5620-3-0x00000000010F0000-0x00000000010FE000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2976 wrote to memory of 5620 2976 rundll32.exe 88
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__97e0ddcb4d161aa1917e7671e3344ae0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118__97e0ddcb4d161aa1917e7671e3344ae0.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:5620
-