Analysis
- max time kernel
149s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 22:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe
- Size 24KB
- Sample261011-18b5msaa42
- SHA256 6b6a83e167c1290e13243897b9abfc448d7859fbd9a75542ba3c1b3436092d3b
- MD5 ba355a7fb0739556728bcf16d302627d
- SHA1 20413bcdbeaf13691eb7eed344c19f5ce68a3a80
- SHA512 74fef3541441ee8a1434616afe495cc895c79d8ee7fbf90782932fe6997d2ae852c31dfdec2217fe5ce85ff81bb0faba619d41f37b06ba1ff22093f0475c2905
- SSDEEP 384:NgQgmt8e+bSyX77lr1pMrm+wdebvuqG6PrKu8/KIAxJxCHwFSADQTMQr:qmtB+bPLph+rx5+x/ivCQRyr
- TLSH T1E2B2D1F0C6D90015CB841FFE2CA3C9355699BF2256959937F9B5717E0C31B892D02E78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\explorer.exe jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe File created C:\Windows\SysWOW64\adll.dll jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe 5092 jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Nilage.adq.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5092
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\adll.dll
- Size 36KB
- SHA256 434c2b7cc73b59141d80f76bf4663bc407cca8f662e5eb61cee9255f519f30e1
- MD5 8d07a49f97ec2b4da3b1eb600f252a96
- SHA1 7c4f81a754729ec3e5aad7b33dba207f5bbdb6ca
- SHA512 e50552e9bed099782c5a6171216bfbf95422b1c80408a8fe07756af5f18fa50b7a2d491631172b5b194043d9575e123f26b00c1809dfe1d4c0506f49e323dfa8
- SSDEEP 768:AyUqviQ40226ln/yLTgKbcfaYMV+r2zET1E:XUqaQ6Zl6LWCTzD
- TLSH T16FF24C7BF6C1C832C01099FCDD6ED1E9AA2F36302DA515BB75A60FCDDC79285660D08A
- MD5 SHA1 SHA512 SSDEEP TLSH