Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 16:13
Behavioral task
behavioral1
Sample
jaffacakes118_Backdoor.Win32.Wabot.a.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Backdoor.Win32.Wabot.a.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target jaffacakes118_Backdoor.Win32.Wabot.a.exe
- Size 1.7MB
- Sample261009-tpbw7sbv2x
- SHA256 805fffdeb5b4bdfede31f10219e8ffc8a54a7fd96fae25b0f7b08b8839d7d06a
- MD5 df6015fb601bc7bef9aa7db6e70ad88e
- SHA1 4a88812d6ded665607dbdfe8db8d76dd78b6affc
- SHA512 967649e207c308ce0c104d5ef6bc76882ec21534ecfefa3df2b4d40298b69b779e058a3b5378897ca74530ca4b00ce23fe9f44d5ff1b9502933b153fb51ed474
- SSDEEP 24576:V1bjxBZehYE8k6A5i28liKQ8/FV/sNgh1HoE6mtECVm9qkDGnuxu5tAG0RkojeKa:VnUYE8RA5i2exFVENd/DGnbkG0OjKoxB
- TLSH T15D85331F99C67F75DB702B785E2240BCEAE92B30CC6D502D3C9EA64F57E49C4086868D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Wabot worm 17 IoCs
resource yara_rule behavioral2/files/0x000d00000001c439-5.dat family_wabot behavioral2/memory/1028-12-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/files/0x000d00000001c463-28.dat family_wabot behavioral2/memory/1028-54-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/1028-55-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/1028-56-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/1028-57-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/1028-58-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/1028-59-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/1028-60-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/1028-61-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/1028-62-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/1028-63-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/1028-64-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/1028-65-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/1028-66-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/1028-67-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" jaffacakes118_Backdoor.Win32.Wabot.a.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\DC++ Share\javac.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\LICLUA.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\createdump.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\initial_prefere.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\jabswitch.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5BE5.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5C05.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevation_service.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5C25.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\os_update_handler.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\os_update_handler.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrmstp.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\sIRC4.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5B93.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5BC4.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX5BA4.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\OSE.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSE.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\elevated_tracing_service.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ielowutil.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Backdoor.Win32.Wabot.a.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\DC++ Share\appletviewer.exe
- Size 94KB
- SHA256 9f69374c6109d4e9741b44ca6d74824d9bc2766b4d863958316d20f1bf089461
- MD5 9b3ec20ab3484c290645a59c4da19f2d
- SHA1 eb83b23d1717baad9c445434c5ec805e21dedd10
- SHA512 659c864da767465ba660d39550086b9489496be7c2c6ef7b5b0d489f2eff889adda70d87e326de87a458716c6e7d134a34f10036e27b3aaed6c8c5ad4e5e4bf8
- SSDEEP 1536:IaiqH1s+kCtrA2UMT0mTFibDKa1XohwkH7Anv67Vfvp8NXjcU:p1B31bdBob2QXomkH7Avwhp8NwU
- TLSH T136938C4FA981BF73CE2189B84C1656FD6DEA3F31EC29D4AEBE9C1F1E17E02850528115
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe
- Size 1.7MB
- SHA256 cc0af4b453dd28aaad8d642a6264fba98f477ad4134b416d0b424cc707fba437
- MD5 e6c0dd0312993a1d02798bf08e3b2980
- SHA1 afcf8c8d92db065aa8615c7fb0115dddc97d22ad
- SHA512 91a668f8f77906c5e5397c2aacd8121c2f18a860a45cd533e67de673c72c9f22db7e8612d318d2528ac16d621aa0f6ff05f003028018888d17e4d28428669cdf
- SSDEEP 49152:VnUYE8RA5i2exFVENd/DGnbkG0OjKoxGN/:9hA5i2erVENVyOsxg/
- TLSH T17485331F99C67E71DB752F785E2240BCEAE92B30CC69502D3C9EA64F67E49C4086858C
- MD5 SHA1 SHA512 SSDEEP TLSH