dorkbot | bf01a02f0eb15b8fae9767b3c847f6cc5005f3174186beb9d5edb1b49d2d5de1

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Size 251KB
Sample261014-depsbaft6q
SHA256 bf01a02f0eb15b8fae9767b3c847f6cc5005f3174186beb9d5edb1b49d2d5de1
MD5 4cfc84e6eb27b6db38ea102f05ac114a
SHA1 1aefbc27086e9c0ca7175b472948bc0bddc4ce70
SHA512 7e03419a83fb1a419ef388ef17fe99d0c0de144f85af8077f24c8a3a368a031be52292539da2c259a1d3f1cfadd2316bece13d344872b5d66cfd9629b7630452
SSDEEP 3072:G1h7CaMP7nKJiJ7r+q+IcsMQRHcCceE1JzQs0uJF2dDRxhPrAPTO2LRptH6Xq8eE:G1w/3L+Icuil0GkDRbkPTRztHD8eS
TLSH
T1A944BF11A1E1C23AC11318F98805D7B898797C632527ED8B6FE509B8DB5CBC9DB1938F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery dorkbot worm

Malware Config

Signatures

Family: Dorkbot
Dorkbot is a worm written in C++.
worm dorkbot

Detects Dorkbot worm 1 IoCs

resource	yara_rule
behavioral2/memory/6112-0-0x0000000000400000-0x000000000044E000-memory.dmp	family_dorkbot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2316 set thread context of 6112	2316	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_HEUR.Trojan.Win32.Generic.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 6112	2316	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 2316 wrote to memory of 6112	2316	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 2316 wrote to memory of 6112	2316	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 2316 wrote to memory of 6112	2316	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 2316 wrote to memory of 6112	2316	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89
PID 2316 wrote to memory of 6112	2316	jaffacakes118_HEUR.Trojan.Win32.Generic.exe	89

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"
  2⤵
  PID:6112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/6112-0-0x0000000000400000-0x000000000044E000-memory.dmp

Download