Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 22:13
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-GameThief.Win32.Magania.ualj.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target jaffacakes118_Trojan-GameThief.Win32.Magania.ualj.dll
- Size 140KB
- Sample261011-15fzeshh77
- SHA256 44ba5431d31dd92d2beefe9741d1b235880f996781b26db084364d51719b124c
- MD5 20a94d41d1bdb84729b4080f5adc2780
- SHA1 ae6f44aac3beef00e6a1fbf95ac8cc16c40e8fc6
- SHA512 6b25dc39b318d7866257832f89eefbc65fa5ed89ecc5d84f5abc2ad40317ef68867d3b852832d764b086033825e0bddde42013b13c13a290ebe0fa09beda0b47
- SSDEEP 3072:PKIO+FY3VDkdrIPizmawGB9HFkJEa1QmqIpkuoZWRvkd:jY3Y0PqgKpqEOzqOWZWp
- TLSH T113E33A91BE9712FCF658123C0CAB2B3E512F6DDB07467A53B61CDA1104D3A70DA2762B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x001200000001c5c3-2.dat family_gh0strat - Loads dropped DLL 1 IoCs
pid Process 2908 svchost.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg rundll32.exe File created C:\Windows\FileName.jpg rundll32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe 2908 svchost.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 3228 rundll32.exe Token: SeRestorePrivilege 3228 rundll32.exe Token: SeBackupPrivilege 3228 rundll32.exe Token: SeRestorePrivilege 3228 rundll32.exe Token: SeBackupPrivilege 3228 rundll32.exe Token: SeRestorePrivilege 3228 rundll32.exe Token: SeBackupPrivilege 3228 rundll32.exe Token: SeRestorePrivilege 3228 rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4176 wrote to memory of 3228 4176 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.ualj.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Magania.ualj.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2908
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k imgsvc1⤵PID:5764
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path \??\c:\windows\filename.jpg
- Size 1.7MB
- SHA256 3a0ca836ce7cdafe9c5e31c0d134e8aa724b4bd24bb9e31e5d32637811dc00fd
- MD5 d17a32d2ce404ab8406e4676390dab56
- SHA1 df2ce5c139cc1e3499eafe8a59dcc06a38f3c5b0
- SHA512 2706811e5f86091b0c8d521abefaa1f1c9c5d07f6c16282e39f18257e3b5211976a2ccaa582722a01d016eea449c7627e960627359ec77033ba6240ca18e9b30
- SSDEEP 6144:jY3Y0PqgKpqEOzqOWZWp2QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQg:l0PSAG3O
- TLSH T116852B1AC5D15DF7E8DBD7E1A241943A4B03068AE82C5B32F86FD53229F2F149D61B0B
- MD5 SHA1 SHA512 SSDEEP TLSH
