7e0bf870489e0bb16bec39b0b8650cd61e6106c15d4cee70132e085c9d36db72

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
Size 2.9MB
Sample261011-2bae8a113r
SHA256 7e0bf870489e0bb16bec39b0b8650cd61e6106c15d4cee70132e085c9d36db72
MD5 9016471cbb96cbbe062e50663a24a6cd
SHA1 65708e333b57929971ec77f42bdbf95ffe262f5b
SHA512 1d43785d91d26af6feaddeabdee86f227a75f4f3b791f90c37416850479a56e719f0800bac62e4427af5497c6cac15bcab16b5677418fc19853a67ede45bb695
SSDEEP 49152:bcmCvBaNZR5BOiE+jcGjttSDbT0vWf5xW2zlXg8B+98mg5Uv6H4cy8Lq8hnSxq8h:b7qBeR5B7E8jSDbT0vi5xW2zl3mg5I6Q
TLSH
T197E5C0217A9080B7C23E3570494EA7BEF3B9E5304E75464763A09F3D6E319925A3932F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution exploit upx

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
3600	takeown.exe
3828	icacls.exe

Executes dropped EXE 3 IoCs

pid	Process
3920	xz.exe
5732	auto.exe
5608	ganran.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3600	takeown.exe
3828	icacls.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ole.dll	xz.exe
File created	C:\Windows\SysWOW64\imm32.dll.log	xz.exe
File opened for modification	C:\Windows\SysWOW64\imm32.dll.log	xz.exe
File created	C:\Windows\SysWOW64\imm32.dll	xz.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000023885-4.dat	upx
behavioral1/memory/3920-5-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3920-21-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\xz.exe	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
File created	C:\Program Files\auto.exe	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
File created	C:\Program Files\ganran.exe	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5416	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	auto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3920	xz.exe
3920	xz.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	xz.exe
Token: SeTakeOwnershipPrivilege	3600	takeown.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
5404	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
5404	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
3920	xz.exe
3920	xz.exe
5732	auto.exe
5732	auto.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5404 wrote to memory of 3920	5404	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe	86
PID 3920 wrote to memory of 3600	3920	xz.exe	87
PID 5404 wrote to memory of 5732	5404	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe	92
PID 5404 wrote to memory of 5608	5404	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe	93
PID 3920 wrote to memory of 3828	3920	xz.exe	98
PID 3920 wrote to memory of 5416	3920	xz.exe	104

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5404
- C:\Program Files\xz.exe
  "C:\Program Files\xz.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F C:\Windows\system32\imm32.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3600
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\system32\imm32.dll /grant administrators:f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3828
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\dele595c20.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5416
- C:\Program Files\auto.exe
  "C:\Program Files\auto.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5732
- C:\Program Files\ganran.exe
  "C:\Program Files\ganran.exe"
  2⤵
  - Executes dropped EXE
  PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

auto.exe

Path C:\Program Files\auto.exe
Size 1.7MB
SHA256 507375356de3fdfccad25208add92c4fa90877873bf88fbf31e545ccd36e36a4
MD5 a44308b9d2681001437d7dded4b6cfa5
SHA1 19b395522c867d09738033ba1b2c4ff4d0ac7600
SHA512 2fc23ac428791a27f28b93f36e50586eed5a588f07806fdd5b5bb5046f2a059cdd734d0eef7b25edd709a7421b3b30c1890730c1d425e5d1795e18d6364ae5ce
SSDEEP 49152:iNZR5BOiE+jcGjttSDbT0vWf5xW2zlXg8B+98mg5Uv6H4cy8Lq8hn:WR5B7E8jSDbT0vi5xW2zl3mg5I6H4cym
TLSH
T1CA859E313E908077C23F3570854EA7BDE2AAA5308D755247A6A01F3D6F359A25A2C37F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ganran.exe

Path C:\Program Files\ganran.exe
Size 600KB
SHA256 adb59f8e5ddf551c3fc3f45ebfba516d9caa3dc7bd9ca3c6a07aa3453e6bf0b3
MD5 7c621d0aed5235ca3d78762aded7eed5
SHA1 0b8c5cd23f592a8ff02e0473caa81b6e672e4769
SHA512 4a625db6c29d814ddc072255f9af063d408ee8f4629951a15842c633f31259706d06364ad50deb1e18c59ed099bfe24a69dd300aaada0ed7e0f16596001e8065
SSDEEP 12288:AKuW/pR/mnWLRNTE6b//wJ17e0UwCvtYYg54preK/QUtBr2D:Lx/S8ngS0UdnreKocC
TLSH
T148D4232E32A0DD51E6D4BCBBD90A9EF694C9CC2BA578C32ADB0811752B548171F93DF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xz.exe

Path C:\Program Files\xz.exe
Size 31KB
SHA256 d5c02f8f0b03a7c3e9881640702ffd0515dad1851e44843563bc555e51e18d76
MD5 5ac5312066000291e5d23d788630d2ee
SHA1 258bad01382371e766857643384ee0c4d00f63f9
SHA512 99eb107e71efb80cc897d63675bddc5545b40284667b2b3b9b88a5d274d0b54a7ab7973d18cb28ed0657a717055fa694bbd0f8dacbf58f84cf22c904f9ea8ff1
SSDEEP 768:HKrhUGBn8CR4H0NX7SwF+EQuDU/udjhmjUuA:HKri8nLdrSmzlFuA
TLSH
T1F3E2E1CE9F3DCA13ECAB723917773B13A35EA3007558C35BC9B849C698251846968E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

txt.com

Path C:\Users\Admin\AppData\Local\Temp\txt.com
Size 143KB
SHA256 02a77fbea9d7099eab38d1142aca2a98f1b69205bfddec5855b834ff9afdfc37
MD5 e7a158c2d33988b8527f11e7c4ff00b5
SHA1 06214e73c960d21481ec90953ac3e6abab0e8d1c
SHA512 18eb858e5ccabc3f3de8921580d5ac4e3b999e1567d80f168a348767b4c4a46453e031f7ae7d99c63add9b680a7019408f63e4bd945ac68e2b5447031a7bf8d9
SSDEEP 3072:dfO+/BD8Gf2AeZJhJirgq/e6ryRorncmDH2ejupbs6mh2m5sHhko5s:wZJAg16rYo7cdG+bJmh2m5sH+
TLSH
T1C2E36D00B74414B9C5DD54B0104AAA7A15AFAD1347E84EF712E88EAA79627C3FF3D12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dele595c20.bat

Path \??\c:\dele595c20.bat
Size 113B
SHA256 3fde2927d70a59bd80a52a5f73fa8d9e7803c2ac2e8acd6f533c472c9bda21f4
MD5 86851bec52a9cf8b58586c937dbaf8b2
SHA1 74ee70e3e2cdbc3e6a38f4354aba7adc403b4e3a
SHA512 1e01db31cb1d4e962f1febb86d02a33c2ef1a57f1b655b3eb4b2fb896d425c020f1138b39599c32560b88cb1bae2b0b989b9f04c60aa76c1de475a4b6f172fff
TLSH
T1B5B092628800D2C2784950820BD838099209D5E8E20E4416B2D64A8BF093938113F4D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3920-5-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3920-21-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/3920-22-0x0000000077260000-0x0000000077285000-memory.dmp

Download

memory/5404-24-0x0000000077260000-0x0000000077285000-memory.dmp

Download

memory/5732-25-0x0000000077260000-0x0000000077285000-memory.dmp

Download