92ae6b6011faaa78cbc29dded6eed087bc10b160ce994a813eafeacbbf12c568

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Backdoor.Win32.Rbot.gen.exe
Size 51KB
Sample261009-tm2d3szvbz
SHA256 92ae6b6011faaa78cbc29dded6eed087bc10b160ce994a813eafeacbbf12c568
MD5 862bc726810392bfe827f41823482d37
SHA1 434960f302113a9014ce968d84bb6a5dd3bc5cb9
SHA512 72ad8f8f1aefc4c54820a3e81055d612064b60d0303179b87daf3846ed7add88de69c64df3454cb8be9a2fb68d3faaed0a81d46537224713b1a1263eb0019bc2
SSDEEP 1536:djDGo+X+Ew9uW1GyKFgrxK3715lWL6L4:dyoQ+E0ON1mLU
TLSH
T1CD33F1B54FC67CC7DEC5C2B9180752687C607BB3D246689E354F41A9EECD2A807EB082
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
3744	phqghum.exe
496	phqghum.exe
3120	phqghum.exe
5260	phqghum.exe
5580	phqghum.exe
5816	phqghum.exe
1288	phqghum.exe
4512	phqghum.exe
2676	phqghum.exe
4548	phqghum.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File created	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File opened for modification	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File opened for modification	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File opened for modification	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File created	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File opened for modification	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File opened for modification	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File created	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File opened for modification	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File created	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File opened for modification	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File opened for modification	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File created	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File created	C:\Windows\SysWOW64\phqghum.exe	jaffacakes118_Backdoor.Win32.Rbot.gen.exe
File opened for modification	C:\Windows\SysWOW64\phqghum.exe	jaffacakes118_Backdoor.Win32.Rbot.gen.exe
File opened for modification	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File created	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File created	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File created	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File opened for modification	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe
File created	C:\Windows\SysWOW64\phqghum.exe	phqghum.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1492-0-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/files/0x000600000001b892-1.dat	upx
behavioral2/memory/1492-3-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/3744-4-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/496-7-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/3120-10-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/5260-13-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/5580-16-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/5816-19-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/1288-22-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/4512-25-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/2676-28-0x0000000000400000-0x000000000044C000-memory.dmp	upx
behavioral2/memory/4548-31-0x0000000000400000-0x000000000044C000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Backdoor.Win32.Rbot.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phqghum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phqghum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phqghum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phqghum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phqghum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phqghum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phqghum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phqghum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phqghum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	phqghum.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 3744	1492	jaffacakes118_Backdoor.Win32.Rbot.gen.exe	89
PID 3744 wrote to memory of 496	3744	phqghum.exe	90
PID 496 wrote to memory of 3120	496	phqghum.exe	91
PID 3120 wrote to memory of 5260	3120	phqghum.exe	92
PID 5260 wrote to memory of 5580	5260	phqghum.exe	93
PID 5580 wrote to memory of 5816	5580	phqghum.exe	94
PID 5816 wrote to memory of 1288	5816	phqghum.exe	95
PID 1288 wrote to memory of 4512	1288	phqghum.exe	96
PID 4512 wrote to memory of 2676	4512	phqghum.exe	97
PID 2676 wrote to memory of 4548	2676	phqghum.exe	98

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Rbot.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Rbot.gen.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\phqghum.exe
  C:\Windows\system32\phqghum.exe 1248 "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Rbot.gen.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Windows\SysWOW64\phqghum.exe
    C:\Windows\system32\phqghum.exe 1244 "C:\Windows\SysWOW64\phqghum.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:496
  - - C:\Windows\SysWOW64\phqghum.exe
      C:\Windows\system32\phqghum.exe 1212 "C:\Windows\SysWOW64\phqghum.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3120
    - - C:\Windows\SysWOW64\phqghum.exe
        
        C:\Windows\system32\phqghum.exe 1216 "C:\Windows\SysWOW64\phqghum.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5260
      - C:\Windows\SysWOW64\phqghum.exe
        
        C:\Windows\system32\phqghum.exe 1220 "C:\Windows\SysWOW64\phqghum.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5580
        
        C:\Windows\SysWOW64\phqghum.exe
        
        C:\Windows\system32\phqghum.exe 1224 "C:\Windows\SysWOW64\phqghum.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5816
        
        C:\Windows\SysWOW64\phqghum.exe
        
        C:\Windows\system32\phqghum.exe 1228 "C:\Windows\SysWOW64\phqghum.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1288
        
        C:\Windows\SysWOW64\phqghum.exe
        
        C:\Windows\system32\phqghum.exe 1232 "C:\Windows\SysWOW64\phqghum.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\phqghum.exe
        
        C:\Windows\system32\phqghum.exe 1236 "C:\Windows\SysWOW64\phqghum.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\phqghum.exe
        
        C:\Windows\system32\phqghum.exe 1240 "C:\Windows\SysWOW64\phqghum.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

phqghum.exe

Path C:\Windows\SysWOW64\phqghum.exe
Size 51KB
SHA256 92ae6b6011faaa78cbc29dded6eed087bc10b160ce994a813eafeacbbf12c568
MD5 862bc726810392bfe827f41823482d37
SHA1 434960f302113a9014ce968d84bb6a5dd3bc5cb9
SHA512 72ad8f8f1aefc4c54820a3e81055d612064b60d0303179b87daf3846ed7add88de69c64df3454cb8be9a2fb68d3faaed0a81d46537224713b1a1263eb0019bc2
SSDEEP 1536:djDGo+X+Ew9uW1GyKFgrxK3715lWL6L4:dyoQ+E0ON1mLU
TLSH
T1CD33F1B54FC67CC7DEC5C2B9180752687C607BB3D246689E354F41A9EECD2A807EB082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/496-7-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1288-22-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1492-3-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/1492-0-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/2676-28-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3120-10-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/3744-4-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4512-25-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/4548-31-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/5260-13-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/5580-16-0x0000000000400000-0x000000000044C000-memory.dmp

Download

memory/5816-19-0x0000000000400000-0x000000000044C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads