poisonivy | 64d286a519b4e59e7ac214cf19c370c01da2ae4ae0898c84279677a09e2277fc

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.FC.a.exe
Size 149KB
Sample261009-xbbk3astbx
SHA256 64d286a519b4e59e7ac214cf19c370c01da2ae4ae0898c84279677a09e2277fc
MD5 4e0a1a2370f74d19f7823ff0acf670a0
SHA1 6842ed6ff2ab9d7059bc1c5ede317aa7e4c793f0
SHA512 78a38466de9aeea86097a840cfbb9540e2f57a3211a891924e31b4d774a82cb857f15c2009ec45be776c57aba2c57ede48e0f8737bbdc0a7c0b9fbb38c44cd32
SSDEEP 1536:4zrJ0F8MEuG3J0tT0gb0kGOgl80zrJ0F8MEuG3J0tT0gb0kGOgl8E:M+zEuGitb7GOg+4+zEuGitb7GOg+E
TLSH
T1DDE39D65B7A0673EE1B1447B68A5C7326761BE30230F0AC3258C396D5C306D9AFBA34D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery poisonivy rat

Malware Config

Signatures

Family: PoisonIvy
PoisonIvy is a remote access trojan used by many threat actor groups, first seen in 2005.
rat poisonivy

Detects PoisonIvy RAT 2 IoCs

resource	yara_rule
behavioral2/memory/4632-21-0x0000000000400000-0x0000000000402000-memory.dmp	family_poisonivy
behavioral2/memory/4632-24-0x0000000000400000-0x0000000000401C00-memory.dmp	family_poisonivy

Executes dropped EXE 4 IoCs

pid	Process
4120	file2.exe
3264	file1.exe
4632	file2.exe
1120	file1.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4120 set thread context of 4632	4120	file2.exe	91
PID 3264 set thread context of 1120	3264	file1.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.FC.a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4120	file2.exe
3264	file1.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 4120	2928	jaffacakes118_Trojan-Dropper.Win32.FC.a.exe	89
PID 2928 wrote to memory of 3264	2928	jaffacakes118_Trojan-Dropper.Win32.FC.a.exe	90
PID 4120 wrote to memory of 4632	4120	file2.exe	91
PID 4120 wrote to memory of 4632	4120	file2.exe	91
PID 4120 wrote to memory of 4632	4120	file2.exe	91
PID 4120 wrote to memory of 4632	4120	file2.exe	91
PID 3264 wrote to memory of 1120	3264	file1.exe	92
PID 3264 wrote to memory of 1120	3264	file1.exe	92
PID 3264 wrote to memory of 1120	3264	file1.exe	92
PID 3264 wrote to memory of 1120	3264	file1.exe	92

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.FC.a.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.FC.a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\file2.exe
  "C:\Users\Admin\AppData\Local\Temp\file2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Users\Admin\AppData\Local\Temp\file2.exe
    C:\Users\Admin\AppData\Local\Temp\file2.exe
    3⤵
    - Executes dropped EXE
    PID:4632
- C:\Users\Admin\AppData\Local\Temp\file1.exe
  "C:\Users\Admin\AppData\Local\Temp\file1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Users\Admin\AppData\Local\Temp\file1.exe
    C:\Users\Admin\AppData\Local\Temp\file1.exe
    3⤵
    - Executes dropped EXE
    PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

file2.exe

Path C:\Users\Admin\AppData\Local\Temp\file2.exe
Size 72KB
SHA256 afb511bed7ec0d91b52667f37077c9e00353fd0ccb178564d7248b51756df527
MD5 a6c0010ae225e6409202085294b3ee8f
SHA1 71d40516b0f3b112fe86646666dba3054f7bba58
SHA512 48871ec98f866757bae5a1c93cbf49e1cfe7dbcb5613d7f76e70959d2955d9fcc3f9d1c0c96b7446d4f0328c82a5185072fc6da0fde7e2cc28f1dd1f64037c5d
SSDEEP 768:xF8Erq94qnArqF8MOjcaIG3JuttTmxPFTDPFEUQbxi+1GOehl8O:nzrJ0F8MEuG3J0tT0gb0kGOgl8O
TLSH
T133739D65B7B0673EE1B2447B68A5C7326760BE30630F4AC3258C396C5C345D9AFBA349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2928-0-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/2928-23-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/3264-28-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3264-34-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4120-17-0x0000000000401000-0x0000000000407000-memory.dmp

Download

memory/4120-25-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4632-21-0x0000000000400000-0x0000000000402000-memory.dmp

Download

memory/4632-24-0x0000000000400000-0x0000000000401C00-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads