Analysis
- max time kernel
150s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/10/2026, 16:48
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe
- Size 128KB
- Sample261006-vbfhxasscs
- SHA256 13821405ed277eb223f4c9c342a4f6cd683acb1483e3c72db25247b3fec4a4d0
- MD5 557630532800168a023b508eed7d5344
- SHA1 f45560d9d484b633edfe41289694046a2fe9dfb4
- SHA512 cf739d0ed00105c2d5ec81a10d132a42023a8c42ea09b39e87b8fb4d8c213eb196739a56755d0968c45ddaf1b2e9b8523faae3dfc2e6dcda4f1d7381ad50115c
- SSDEEP 3072:XEQj0XLXcCS2MRczZK8/y4pE2IybZuwFQ1PMIpqJ:XEbDMGJyE51ZuwCBv
- TLSH T1D5D36C01FD8401F9F5A5253C24AF7B76E73FB4648A4D6F87A768EA560872140BE23287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 4 IoCs
resource yara_rule behavioral2/memory/3292-0-0x0000000000400000-0x0000000000424000-memory.dmp family_gh0strat behavioral2/files/0x000a00000001b880-3.dat family_gh0strat behavioral2/files/0x001100000001c58b-10.dat family_gh0strat behavioral2/memory/3292-11-0x0000000000400000-0x0000000000424000-memory.dmp family_gh0strat - Deletes itself 1 TTPs 1 IoCs
pid Process 6016 svchost.exe - Loads dropped DLL 2 IoCs
pid Process 3292 jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe 6016 svchost.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Ocya\Uiswcnejh.bmp jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe File created C:\Program Files (x86)\Ocya\Uiswcnejh.bmp jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe 6016 svchost.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 3292 jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe Token: SeRestorePrivilege 3292 jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe Token: SeBackupPrivilege 3292 jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe Token: SeRestorePrivilege 3292 jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe Token: SeBackupPrivilege 3292 jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe Token: SeRestorePrivilege 3292 jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe Token: SeBackupPrivilege 3292 jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe Token: SeRestorePrivilege 3292 jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.tzdh.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3292
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6016
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k imgsvc1⤵PID:244
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\1127600.dll
- Size 105KB
- SHA256 58eb2a401c993f02dded4ed4ee309e25b8760a633f18c6d0fa3f31a16808bc30
- MD5 e2126c66343c71690f557de030155dd2
- SHA1 5f8c21455dcbb4c243129bd192feffbc6554cf83
- SHA512 558527a6fc00a4d112f5d588b392c9e65fa80b4298807e1ff8a9a407a081edf09f473c73c05b4e0bfdb3577032197f68fdef9868cf667c079930605769e6320c
- SSDEEP 3072:SQj0XLXcCS2MRczZK8/y4pE2IybZuwFQ1PM:ubDMGJyE51ZuwCB
- TLSH T199B35C01FD8501F9EAA5253C24AF7B76D63FB4648B4D7F83A768EA550462140BE2338B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\NT_Path.jpg
- Size 102B
- SHA256 9067eaa9c1c7ede4e5b0d3b3e348b02e7eb1f5d81f8f696b4e6b0b532c9389e5
- MD5 5c51de49fdffabb817d600bc33f00b95
- SHA1 d5f2905acb76881a50dde6064eb2bdf47fe88437
- SHA512 4018d750767a8f87ab528653c058cbb40ac4f5207171a84695ba2168e227ed3549958f7fcd2401dd3850033c744b507aacc29057661f6d1db6c4429a257f64ff
- TLSH T129B012815292491A2601C8374478DAAF94710E0D37D93B308736D145157029BB98131C
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\program files (x86)\ocya\uiswcnejh.bmp
- Size 11.3MB
- SHA256 65b36c04320c71f4caf4f4490dbb4e656c5accad57c2645c0de52f586f1b9fc4
- MD5 d1c61e214a90b3e764167c9f5e4e055e
- SHA1 5a36d3bd02c6f7971c26ad402f33247529b6c298
- SHA512 9b183affad3dc200b8581259fda0f2f2bde75d37d88e28108e699d3c59c911cd08651b1c77fe22365059d643f03eb4f3305c6ff190da9e6b9e5c98da52149fa1
- SSDEEP 3072:SQj0XLXcCS2MRczZK8/y4pE2IybZuwFQ1PMh666666666666666666666666666t:ubDMGJyE51ZuwCB9
- TLSH T15FC6C08D6938BD615B2152E6BA5C383F34233DB44B9B64139129CA9F5473DBA810B0FF
- MD5 SHA1 SHA512 SSDEEP TLSH
