7e0bf870489e0bb16bec39b0b8650cd61e6106c15d4cee70132e085c9d36db72

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
Size 2.9MB
Sample261011-2bae8a113r
SHA256 7e0bf870489e0bb16bec39b0b8650cd61e6106c15d4cee70132e085c9d36db72
MD5 9016471cbb96cbbe062e50663a24a6cd
SHA1 65708e333b57929971ec77f42bdbf95ffe262f5b
SHA512 1d43785d91d26af6feaddeabdee86f227a75f4f3b791f90c37416850479a56e719f0800bac62e4427af5497c6cac15bcab16b5677418fc19853a67ede45bb695
SSDEEP 49152:bcmCvBaNZR5BOiE+jcGjttSDbT0vWf5xW2zlXg8B+98mg5Uv6H4cy8Lq8hnSxq8h:b7qBeR5B7E8jSDbT0vi5xW2zl3mg5I6Q
TLSH
T197E5C0217A9080B7C23E3570494EA7BEF3B9E5304E75464763A09F3D6E319925A3932F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution exploit upx

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1004	takeown.exe
2820	icacls.exe

Executes dropped EXE 3 IoCs

pid	Process
4460	xz.exe
6084	auto.exe
4944	ganran.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2820	icacls.exe
1004	takeown.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ole.dll	xz.exe
File created	C:\Windows\SysWOW64\imm32.dll.log	xz.exe
File created	C:\Windows\SysWOW64\imm32.dll	xz.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b00000001b871-5.dat	upx
behavioral2/memory/4460-6-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/4460-21-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\xz.exe	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
File created	C:\Program Files\auto.exe	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
File created	C:\Program Files\ganran.exe	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5972	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	auto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xz.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4460	xz.exe
4460	xz.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	xz.exe
Token: SeTakeOwnershipPrivilege	1004	takeown.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2332	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
2332	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
4460	xz.exe
4460	xz.exe
6084	auto.exe
6084	auto.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 4460	2332	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe	89
PID 4460 wrote to memory of 1004	4460	xz.exe	90
PID 2332 wrote to memory of 6084	2332	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe	92
PID 2332 wrote to memory of 4944	2332	jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe	93
PID 4460 wrote to memory of 2820	4460	xz.exe	94
PID 4460 wrote to memory of 5972	4460	xz.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Nilage.hqk.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files\xz.exe
  "C:\Program Files\xz.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Windows\SysWOW64\takeown.exe
    takeown /F C:\Windows\system32\imm32.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1004
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\system32\imm32.dll /grant administrators:f
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c c:\dele592486.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5972
- C:\Program Files\auto.exe
  "C:\Program Files\auto.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:6084
- C:\Program Files\ganran.exe
  "C:\Program Files\ganran.exe"
  2⤵
  - Executes dropped EXE
  PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

auto.exe

Path C:\Program Files\auto.exe
Size 1.7MB
SHA256 507375356de3fdfccad25208add92c4fa90877873bf88fbf31e545ccd36e36a4
MD5 a44308b9d2681001437d7dded4b6cfa5
SHA1 19b395522c867d09738033ba1b2c4ff4d0ac7600
SHA512 2fc23ac428791a27f28b93f36e50586eed5a588f07806fdd5b5bb5046f2a059cdd734d0eef7b25edd709a7421b3b30c1890730c1d425e5d1795e18d6364ae5ce
SSDEEP 49152:iNZR5BOiE+jcGjttSDbT0vWf5xW2zlXg8B+98mg5Uv6H4cy8Lq8hn:WR5B7E8jSDbT0vi5xW2zl3mg5I6H4cym
TLSH
T1CA859E313E908077C23F3570854EA7BDE2AAA5308D755247A6A01F3D6F359A25A2C37F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ganran.exe

Path C:\Program Files\ganran.exe
Size 600KB
SHA256 adb59f8e5ddf551c3fc3f45ebfba516d9caa3dc7bd9ca3c6a07aa3453e6bf0b3
MD5 7c621d0aed5235ca3d78762aded7eed5
SHA1 0b8c5cd23f592a8ff02e0473caa81b6e672e4769
SHA512 4a625db6c29d814ddc072255f9af063d408ee8f4629951a15842c633f31259706d06364ad50deb1e18c59ed099bfe24a69dd300aaada0ed7e0f16596001e8065
SSDEEP 12288:AKuW/pR/mnWLRNTE6b//wJ17e0UwCvtYYg54preK/QUtBr2D:Lx/S8ngS0UdnreKocC
TLSH
T148D4232E32A0DD51E6D4BCBBD90A9EF694C9CC2BA578C32ADB0811752B548171F93DF0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xz.exe

Path C:\Program Files\xz.exe
Size 31KB
SHA256 d5c02f8f0b03a7c3e9881640702ffd0515dad1851e44843563bc555e51e18d76
MD5 5ac5312066000291e5d23d788630d2ee
SHA1 258bad01382371e766857643384ee0c4d00f63f9
SHA512 99eb107e71efb80cc897d63675bddc5545b40284667b2b3b9b88a5d274d0b54a7ab7973d18cb28ed0657a717055fa694bbd0f8dacbf58f84cf22c904f9ea8ff1
SSDEEP 768:HKrhUGBn8CR4H0NX7SwF+EQuDU/udjhmjUuA:HKri8nLdrSmzlFuA
TLSH
T1F3E2E1CE9F3DCA13ECAB723917773B13A35EA3007558C35BC9B849C698251846968E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dele592486.bat

Path \??\c:\dele592486.bat
Size 113B
SHA256 7ba9c487cfeec91d2a6a0554c4e7297d85a79ae4d3defec81b002ba37e4c67b3
MD5 62aaf1b67a27c350f322decab6f5952d
SHA1 27c94f9c94238758abdb7e070f6351f1fcce6cd1
SHA512 14eefd18fd23e2fbc19a3c82ea3fdf858d62300d83006825c229b80ea4e0d29437708330dbe92e40246ab4c75d18fe515c9fd007c96a4af01bccaa4cd3518be6
TLSH
T176B092768900D2C2388950820BA838095209C5E8E20A0416B2D68BCBF193968103B598
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2332-24-0x0000000076A30000-0x0000000076A55000-memory.dmp

Download

memory/4460-6-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4460-21-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4460-22-0x0000000076A30000-0x0000000076A55000-memory.dmp

Download

memory/6084-25-0x0000000076A30000-0x0000000076A55000-memory.dmp

Download