Analysis
- max time kernel
150s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/10/2026, 22:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe
- Size 98KB
- Sample261011-183ycsdv21
- SHA256 6a1cce0a7a94e47789700dfdfa6c867fa5b75b3d57e6861c2f5eb4f5b805f4e2
- MD5 18e668982ee75ee7403e3d9306e6fbb5
- SHA1 e0b0db80d4916bdd109550c90756f39b39958dae
- SHA512 eb04f0ba00bb5bd44bad5e4ee35b38c9f58ecb9b99b1b7f121617a70cf2bb9e3e37c011b0aee81193783c449ebf9f77d340e3319ef7ba8e300b0f71fcc294c86
- SSDEEP 3072:YsNHMw8y2k8W7jaIFca/k8W7jaIFccFoIUYO:YeMwx2hQE+hQE+o
- TLSH T124A3019A93E386DCDDA2C23486AFB3539A78D9B10D665B360E837A533DB50540F34C1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4212 svhost32.exe - Loads dropped DLL 4 IoCs
pid Process 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 4212 svhost32.exe 4212 svhost32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xy = "C:\\Windows\\Download\\svhost32.exe" jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\xydll.dll svhost32.exe File created C:\Windows\SysWOW64\xydll.dll jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Download\svhost32.exe jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe File opened for modification C:\Windows\Download\svhost32.exe jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svhost32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 4212 svhost32.exe 4212 svhost32.exe 4212 svhost32.exe 4212 svhost32.exe 4212 svhost32.exe 4212 svhost32.exe 4212 svhost32.exe 4212 svhost32.exe 4212 svhost32.exe 4212 svhost32.exe 4212 svhost32.exe 4212 svhost32.exe 4212 svhost32.exe 4212 svhost32.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 3816 jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe 4212 svhost32.exe 4212 svhost32.exe 4212 svhost32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Nilage.akl.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3816
-
C:\Windows\Download\svhost32.exeC:\Windows\Download\svhost32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4212
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Download\svhost32.exe
- Size 98KB
- SHA256 6a1cce0a7a94e47789700dfdfa6c867fa5b75b3d57e6861c2f5eb4f5b805f4e2
- MD5 18e668982ee75ee7403e3d9306e6fbb5
- SHA1 e0b0db80d4916bdd109550c90756f39b39958dae
- SHA512 eb04f0ba00bb5bd44bad5e4ee35b38c9f58ecb9b99b1b7f121617a70cf2bb9e3e37c011b0aee81193783c449ebf9f77d340e3319ef7ba8e300b0f71fcc294c86
- SSDEEP 3072:YsNHMw8y2k8W7jaIFca/k8W7jaIFccFoIUYO:YeMwx2hQE+hQE+o
- TLSH T124A3019A93E386DCDDA2C23486AFB3539A78D9B10D665B360E837A533DB50540F34C1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\xydll.dll
- Size 38KB
- SHA256 3541bb97fe2db677ceafc3fe0c681c0cd0f87a42c50f20e75b25ed888fe60db9
- MD5 000f945a8e7ffcadf0e24b099f4e8237
- SHA1 21547416bb84bd34e5d9e67f9b02fa105eaab460
- SHA512 7518aa2a32d5ec07661f301faa877ebb7cda8613676fa629debc337ca594424d46c8d6097e5aa5ceadc5ad3873fdf8a0b90bb70db2e8a89e816cb3c5af5531b4
- SSDEEP 768:AyIqvQsMy6M0Ps/ln+18eHgULSpycXmgLlwm+AyVK7wj5YR08Eh1tB:XIqvQm6M/ZFULWyrClwBNVwCZ8E7tB
- TLSH T130033B7AF5D2C472C0508AFC9CA9D2D9762F3A302D7815BBB5E60FCDD8BA382551C086
- MD5 SHA1 SHA512 SSDEEP TLSH