0db0ae529a0606fd62a0eae9ec6cd96c456f6378d3a263bef575bca7e0f58fb4

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/10/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-GameThief.Win32.Magania.ebqf.dll
Size 16KB
Sample261006-t244hsdv5p
SHA256 0db0ae529a0606fd62a0eae9ec6cd96c456f6378d3a263bef575bca7e0f58fb4
MD5 650c4bcf4159c09ffdf01720f063da70
SHA1 8a368a3ddf1b48833d1c4649a66fdb2a9c3eae6c
SHA512 9707d1640569d1a59a8aadb12d93299f7c84ff55138f3feb2d4bd49fc04e69cb8d0e99e7f1dd5279c915040ba531b93916814301c18b3c31bbbc32b3e0439418
SSDEEP 384:Yy/JVuEjkJakRPWOgDOjNgmUCTtXjKy99HOIi:vxAGkJzR5g4NgORjKuOIi
TLSH
T1DD722B36DD8910F2E3063379319B673A86272A549556BC979B93DDE0183B320FE35783
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4356	8	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 8	2308	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.ebqf.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.ebqf.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 512
    3⤵
    - Program crash
    PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 8 -ip 8
1⤵
PID:1392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads