Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/09/2026, 11:06
Behavioral task
behavioral1
Sample
jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe
- Size 154KB
- Sample260923-m7mm4ascpg
- SHA256 d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3
- MD5 5be7c9afb890620a56465e3134541b0c
- SHA1 1513e54a91a36710a39af08ab83e3dbe67c5cb8a
- SHA512 793ea30d7e223560c60970629d8e634fc57f6c848d807000e8571a14de0b39bf4c071e727950253152d826d3b492c27e006830c57073efe08b5a4b4906b83918
- SSDEEP 3072:1Az8NTKhn6s5Yv4BAalyeMV4PMAkZz3JQf1CkNE66hc5Jeqovh:1E8NCev4BLyeq5z5fkuXcJeqo
- TLSH T12DF37D12F7C443FEF554163030AB7B769A36AD64DA094A4BA75AFDA10C332D1B632387
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Gh0st RAT payload 8 IoCs
resource yara_rule behavioral2/memory/2988-0-0x0000000000400000-0x0000000000428000-memory.dmp family_gh0strat behavioral2/files/0x001d00000000696b-3.dat family_gh0strat behavioral2/memory/2988-5-0x0000000010000000-0x0000000010021000-memory.dmp family_gh0strat behavioral2/files/0x001400000001c42a-11.dat family_gh0strat behavioral2/memory/2988-13-0x0000000010000000-0x0000000010021000-memory.dmp family_gh0strat behavioral2/memory/2988-12-0x0000000000400000-0x0000000000428000-memory.dmp family_gh0strat behavioral2/memory/4992-15-0x0000000010000000-0x0000000010021000-memory.dmp family_gh0strat behavioral2/memory/4992-19-0x0000000010000000-0x0000000010021000-memory.dmp family_gh0strat - Deletes itself 1 IoCs
pid Process 4992 svchost.exe - Loads dropped DLL 2 IoCs
pid Process 2988 jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe 4992 svchost.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Iefg\Nefghijkl.pic jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe File created C:\Program Files (x86)\Iefg\Nefghijkl.pic jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2988 jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe 2988 jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe 4992 svchost.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2988 jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe Token: SeRestorePrivilege 2988 jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe Token: SeBackupPrivilege 2988 jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe Token: SeRestorePrivilege 2988 jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe Token: SeBackupPrivilege 2988 jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe Token: SeRestorePrivilege 2988 jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe Token: SeBackupPrivilege 2988 jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe Token: SeRestorePrivilege 2988 jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_d1a066d63a70b99ded3198592349c95397f304599d0473aafe5b670df21c0fc3.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4992
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k imgsvc1⤵PID:5836
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\54000.dll
- Size 122KB
- SHA256 89ed0feb8ef3284da4b5556a47b46912bc3812bb44eeec9440f835aa9e9b2079
- MD5 af2311352d8102b71f38da6a7d8c01e7
- SHA1 77797a6de736b6098bdfc1cb2be97018069a34c4
- SHA512 15c33a8c658cf2b96adc44ebfadf7535d85ba1013cac84e6dc626afaf6da8af3cc27e99ca7406a75fa5883b2b56d4eecaa9adde854ff80315251401146791cef
- SSDEEP 3072:sz8NTKhn6s5Yv4BAalyeMV4PMAkZz3JQf1CkNE66hc5:A8NCev4BLyeq5z5fkuXc
- TLSH T10DC37D01FB8543FEF515263030AF3B769A39AD648A494A9F775BDDE008331A1B636387
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\NT_Path.jpg
- Size 129B
- SHA256 19c11dba39067998d451232fc3aec83ba3c33dbeee98fc89f0c14413ebef8598
- MD5 ecdc3f6723503f010f636732135fd297
- SHA1 2dde3589889982f3daa9597c61256f9ce90ca4c9
- SHA512 e41ea6e21f0932eb4550ce5c4187c74894b7b66f20f36a97764677a32d7566f2cc453a6a3e6fb74b76ee18b26767c79b17d12098652b40b716c841a288b1aa7f
- TLSH T123B02BD40303C0509544500BD43153CFC0F0340806BF1F004333CE04007502CF5D1206
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\program files (x86)\iefg\nefghijkl.pic
- Size 12.4MB
- SHA256 f7ac95643d4bf4e5fb7a764c69d7ffd3f3293e12f38d9f07ecdbd497a7786d23
- MD5 bdbb89ca6544ac9c2e47ae6f5494d639
- SHA1 4c8cfd0aef9e281fe635970149804c568e9f6c0b
- SHA512 9f372858db7b934997ea40b99b315c07e76a86686ce0295eb3be4f60fe3c01bcc9259588e5da232b492d6b1d13e57631d4532cf902ba96ed172b7402f122d976
- SSDEEP 196608:YZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZj:K
- TLSH T150D6D0B87B3954B1A599D41D1EB73E48FDB0278FE075A34AFE46833B487008B1DC265A
- MD5 SHA1 SHA512 SSDEEP TLSH