f375e170bcd5af7785f0d5e0e6333c7a96ada5c2905bb8c9c22e3e30f3e93664

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Dapato.pcjp.exe
Size 454KB
Sample261009-we78rssy8p
SHA256 f375e170bcd5af7785f0d5e0e6333c7a96ada5c2905bb8c9c22e3e30f3e93664
MD5 5987254c459b68cd1b54a1e5fa69f2e2
SHA1 8f8aaed490879b00c0f2fcaace1fe889bac72f5f
SHA512 664c83a57f8d7039d27a94d295e1e049a6395384b4af226842aa1defa6f25bd0225f7e67226255b74f518166bcb6b820eacf3878c21b31d4d7139c00e5ce736b
SSDEEP 12288:ARWNcr8oxna+rSapvaxeoXisvqclDt5jlc:jNBIa01EFysvqcVO
TLSH
T105A4F16275D1C072E92314708DEE97B1F978E83A1765998BFBD00B2D7F219A2C726343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
2856	service_monitor.exe
4596	update.exe
2820	Nuoceahhbagc.exe
4612	Nuoceahhahad.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Nuoceahhbagc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Nuoceahhbagc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Dapato.pcjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	service_monitor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nuoceahhbagc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nuoceahhahad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2820	Nuoceahhbagc.exe
2820	Nuoceahhbagc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2856	2372	jaffacakes118_Trojan-Dropper.Win32.Dapato.pcjp.exe	88
PID 2372 wrote to memory of 4596	2372	jaffacakes118_Trojan-Dropper.Win32.Dapato.pcjp.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Dapato.pcjp.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Dapato.pcjp.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\service_monitor.exe
  "C:\Users\Admin\AppData\Local\Temp\service_monitor.exe" -install "Aisino Deamon Services" "OpenFastAssist"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2856
- C:\Users\Admin\AppData\Local\Temp\update.exe
  "C:\Users\Admin\AppData\Local\Temp\update.exe" -install
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4596

C:\Users\Admin\AppData\Roaming\Nuoceahhbagc.exe
C:\Users\Admin\AppData\Roaming\Nuoceahhbagc.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2820

C:\Users\Admin\AppData\Roaming\Nuoceahhahad.exe
"C:\Users\Admin\AppData\Roaming\Nuoceahhahad.exe" -svc "Aisino Deamon Services" "OpenFastAssist"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

service_monitor.exe

Path C:\Users\Admin\AppData\Local\Temp\service_monitor.exe
Size 101KB
SHA256 69aecadb8ecd550157995321ebf6de258cf51bf5e635f94395e8b9f52eb2ec49
MD5 053ea54cb38e74bb84066ba2fd58fa02
SHA1 a45c9e7f4522200bdfbc3411dd5c9919b89f95c2
SHA512 f9d44d3d98623ac914b5ab249c6eb37a6a21ac1f62ac5bc7553f2d38c0c1522a1fed19a08441af873108bc0a0f5063fad9ecf69df16756aa96c0070d2cf6f7d0
SSDEEP 1536:bsRn0ehC6tNCpwcorkKaNVcwUQ8crFM5sWjcdP+P1TwoJOALB:4pCFp8rkzFMGP+NwoJOALB
TLSH
T158A36C0276D0C0B1E5B3073608B59B520A7EFE794BB58A9B7398018E4EB45D15F37B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.exe

Path C:\Users\Admin\AppData\Local\Temp\update.exe
Size 480KB
SHA256 571b2e59af9d6801e5ba6e685eeaca80defea4ef4d1dc23648b3260a6a23e16c
MD5 08f6cc5b3cdc01cfdf606d09c8659a3f
SHA1 8075d4d999d39229c98a5f6ede66a3d9b71b5d6b
SHA512 c5fd5faafe89bdeaa3ddb38513a203f093f1f6e47721df2e58ea5bdd5543254588c9a1109621e527a3d143b8dccd4f85e44f3b939aabddc371d52180f0f74624
SSDEEP 12288:rufqApEJZXVB9PFztkaq3OSsd67DsYt/a:CfmXRFzSaq3OR4Ft/
TLSH
T178A49CA1B9A1D133E6D240B297BD9B735C3D6930072954E7F3D008A91A701E2B73EB67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download