Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/10/2026, 19:13
Behavioral task
behavioral1
Sample
jaffacakes118_Backdoor.Win32.Wabot.a.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Backdoor.Win32.Wabot.a.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target jaffacakes118_Backdoor.Win32.Wabot.a.exe
- Size 3.4MB
- Sample261013-xw9zcsssaz
- SHA256 7f5c5a4df294b290fc0ad3f4d4d217eeaea62025b58af3a0823d7d7564f553b8
- MD5 b8a1302de68f39fdb737f8c03ef15380
- SHA1 d514cc566bf483ca80a91e1e102c52a273a439f7
- SHA512 20996b7e80d529975b9b7deb8e626510ea5b19b4c965189510922917222cd32e93c820a840783f72c7b20f0dd8dea293eb4a1cc75d11bee53eaf358fc23aa86f
- SSDEEP 98304:zDGMHxGscHgsx1F+ihdv3m5yXGc4JlVjLVKluT4LwpdzxbpLB/UaaW:zJxGscHjuEZ3aWGR71LIwPzrOU
- TLSH T185F5334378817EF5EE2815320C58F7FDB4ED5A348A62D61DBD8E1ACD23D27E4B968840
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Wabot worm 16 IoCs
resource yara_rule behavioral2/files/0x000c00000001c633-5.dat family_wabot behavioral2/memory/4100-17-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/files/0x000c00000001c657-29.dat family_wabot behavioral2/memory/4100-47-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/4100-48-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/4100-49-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/4100-50-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/4100-51-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/4100-52-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/4100-53-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/4100-54-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/4100-55-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/4100-56-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/4100-57-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/4100-58-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot behavioral2/memory/4100-59-0x0000000000400000-0x0000000000416000-memory.dmp family_wabot - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" jaffacakes118_Backdoor.Win32.Wabot.a.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DC++ Share\notification_helper.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\initial_prefere.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\LICLUA.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevated_tracing_service.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\os_update_handler.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\os_update_handler.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\dotnet.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX7249.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zG.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\createdump.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OSE.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX7229.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\OSE.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\dotnet.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX7299.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\sIRC4.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\elevated_tracing_service.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX7269.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\LICLUA.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Backdoor.Win32.Wabot.a.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\DC++ Share\idlj.exe
- Size 82KB
- SHA256 33983a2d34ff7d98aa8ef6a1b277e5ff377529ad1d0f2012b778c74f38ffae2d
- MD5 078a4e2ddb15592e3833593df5ebf54f
- SHA1 ca8109cdfbd1decb21850bd20891256da3859a4c
- SHA512 ab57f7c341975b4dfaaf93df7323b809905efca0d7b3a4137b554dbc986c3842eb5ff394672fce991623e37184918e734c5d15642ab6bf687b82a7c0e9c5c2d1
- SSDEEP 1536:IaiqH1s+kCtrA2UMT0mTFibDKa1Xoh2X+vfamunh8Qg41Tm:p1B31bdBob2QXoke9uh3Bk
- TLSH T123836B5FA980FEB3DE244AB84D0641BC6DAA7F30E928D49EBE9C2F0D17F52C2152D151
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe
- Size 3.4MB
- SHA256 6b10fdea37eaa83d9a4628c82db4bf217bdd0b68305d30d1bf0a1cf254100b93
- MD5 9fe207ec2952936949918633ac12c41f
- SHA1 c519b762264baf673a56bd2f0408253d1b117c3c
- SHA512 2b04c72d25cf92e64d2fab20b4346677c59a233a678503e299fee1e2bfe86ebed63b528d02d331483e2bba0b1846b4403fda5f4b612e93da85c9a859e252d5e5
- SSDEEP 98304:zDGMHxGscHgsx1F+ihdv3m5yXGc4JlVjLVKluT4LwpdzxbpLB/Uaa5:zJxGscHjuEZ3aWGR71LIwPzrOL
- TLSH T160F5334378817EF5EE2815320C58F6FDB4ED5A348A62D61DBD8E1ACD23D27E4B968840
- MD5 SHA1 SHA512 SSDEEP TLSH