Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 16:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe
- Size 58KB
- Sample261006-t2fe6afe92
- SHA256 71bc6e01753546596936d0877376273f126a63ad0d08de3d12eeedf45f8373ef
- MD5 7ab9807de1232c33592292dec5cca737
- SHA1 a0afe981d57a73b2e04554d08e377427620c06bd
- SHA512 30870c21adcbf0fe998cffadde1a857bca736c696aafffef932d44a99c793dcc83b8779ca2c7545990c4060d76703951733a3cb521acaaa251e25ccdb280f116
- SSDEEP 768:UeNmYh5ZxGND3kb17gfCKBmZCPRJBcCns+8ZV74vqWkvxkANshi4mUjlzy+wcQD7:UeZ5iND3k5DaiK9ydpSlm5cQwrjS
- TLSH T1D243023033395725D25FADBC5A394E01C6088E235114727858ABBBFF2E83FD53978994
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\svchost.exe," jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe - Executes dropped EXE 1 IoCs
pid Process 3104 svchost.exe - Loads dropped DLL 2 IoCs
pid Process 3104 svchost.exe 3104 svchost.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\PDLL.dll svchost.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\svchost.exe jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3104 svchost.exe 3104 svchost.exe 3104 svchost.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5328 wrote to memory of 3104 5328 jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.dt.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\svchost.exeC:\Windows\svchost.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3104
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\PDLL.dll
- Size 117KB
- SHA256 358fdf749ce6f3e0b4ca2ba59395d68b2129b34149cb91f0784afec9aa3f95f7
- MD5 a5b20a99465051988c7693784f36a161
- SHA1 876704a67cfe3d0330e1cee36db3736ca50bf9a1
- SHA512 9392533389116fd3ec5cdc3c87579fa0a04076b73f561821515cac4654f60c6414ed5a77e994268074f18e131e62a937fbeb6d11331108c1ea65b851cd963e0f
- SSDEEP 3072:eOPybHttITnx91LS1g50QFKE3NU3VdyooNy:zet0nx91CgN0E3NU3V4
- TLSH T121C32AB6F2C0E871D0A51A7C8C1DE6D0A82AFD702D382A6773DD4B5D8B79281197D2C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\svchost.exe
- Size 58KB
- SHA256 71bc6e01753546596936d0877376273f126a63ad0d08de3d12eeedf45f8373ef
- MD5 7ab9807de1232c33592292dec5cca737
- SHA1 a0afe981d57a73b2e04554d08e377427620c06bd
- SHA512 30870c21adcbf0fe998cffadde1a857bca736c696aafffef932d44a99c793dcc83b8779ca2c7545990c4060d76703951733a3cb521acaaa251e25ccdb280f116
- SSDEEP 768:UeNmYh5ZxGND3kb17gfCKBmZCPRJBcCns+8ZV74vqWkvxkANshi4mUjlzy+wcQD7:UeZ5iND3k5DaiK9ydpSlm5cQwrjS
- TLSH T1D243023033395725D25FADBC5A394E01C6088E235114727858ABBBFF2E83FD53978994
- MD5 SHA1 SHA512 SSDEEP TLSH