496a7914e46d85c1480a012d7a6966ed368d6c49942e4090052307679e0421a8

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 06:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Backdoor.Win32.Rbot.gen.exe
Size 152KB
Sample261014-gty63szthy
SHA256 496a7914e46d85c1480a012d7a6966ed368d6c49942e4090052307679e0421a8
MD5 96be4aeb54e6cc9768c6f147ccd1bcd8
SHA1 2566018da744b207a78f3d4b888c61ffe7fef0d6
SHA512 f5f6c6e7674bd97362633cc18bb1497de02377af6803b7ab65969fa2d50b42f2f158f7b9ac566e9de1ae1501fe695c0b441a9062ef7c461b2d720700b785ccff
SSDEEP 3072:N0Rt+2j003GyW3zzMX4FcWry35ElUOXZouOSKGLEPwTa9Eo6:WRtnry3zzTFVry35mVXx9PLEkaQ
TLSH
T181E302027CD7893EC498727F4EE99E4E7665F1108D4AE5433E99CFFE28A2B4948104BD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 20 IoCs

pid	Process
1620	MSAOL32dll.exe
2704	C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
1272	MSAOL32dll.exe
1868	C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
4868	MSAOL32dll.exe
1940	C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
6132	MSAOL32dll.exe
2812	C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
3680	MSAOL32dll.exe
4196	C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
2916	MSAOL32dll.exe
4448	C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
5036	MSAOL32dll.exe
4416	C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
5028	MSAOL32dll.exe
1068	C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
1008	MSAOL32dll.exe
3012	C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
4052	MSAOL32dll.exe
4700	C27D8FEF-D7AE-42c0-82E6-F30598265639.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File created	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File opened for modification	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File created	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File opened for modification	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File opened for modification	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File opened for modification	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File created	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File created	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File opened for modification	C:\Windows\SysWOW64\MSAOL32dll.exe	jaffacakes118_Backdoor.Win32.Rbot.gen.exe
File created	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File opened for modification	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File created	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File created	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File opened for modification	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File opened for modification	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File opened for modification	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File created	C:\Windows\SysWOW64\MSAOL32dll.exe	jaffacakes118_Backdoor.Win32.Rbot.gen.exe
File created	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File created	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File opened for modification	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe
File created	C:\Windows\SysWOW64\MSAOL32dll.exe	MSAOL32dll.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSAOL32dll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSAOL32dll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSAOL32dll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSAOL32dll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSAOL32dll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSAOL32dll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSAOL32dll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSAOL32dll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Backdoor.Win32.Rbot.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSAOL32dll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C27D8FEF-D7AE-42c0-82E6-F30598265639.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 1620	5240	jaffacakes118_Backdoor.Win32.Rbot.gen.exe	89
PID 5240 wrote to memory of 2704	5240	jaffacakes118_Backdoor.Win32.Rbot.gen.exe	90
PID 1620 wrote to memory of 1272	1620	MSAOL32dll.exe	91
PID 1620 wrote to memory of 1868	1620	MSAOL32dll.exe	92
PID 1272 wrote to memory of 4868	1272	MSAOL32dll.exe	94
PID 1272 wrote to memory of 1940	1272	MSAOL32dll.exe	95
PID 4868 wrote to memory of 6132	4868	MSAOL32dll.exe	96
PID 4868 wrote to memory of 2812	4868	MSAOL32dll.exe	97
PID 6132 wrote to memory of 3680	6132	MSAOL32dll.exe	98
PID 6132 wrote to memory of 4196	6132	MSAOL32dll.exe	99
PID 3680 wrote to memory of 2916	3680	MSAOL32dll.exe	100
PID 3680 wrote to memory of 4448	3680	MSAOL32dll.exe	101
PID 2916 wrote to memory of 5036	2916	MSAOL32dll.exe	102
PID 2916 wrote to memory of 4416	2916	MSAOL32dll.exe	103
PID 5036 wrote to memory of 5028	5036	MSAOL32dll.exe	104
PID 5036 wrote to memory of 1068	5036	MSAOL32dll.exe	105
PID 5028 wrote to memory of 1008	5028	MSAOL32dll.exe	106
PID 5028 wrote to memory of 3012	5028	MSAOL32dll.exe	107
PID 1008 wrote to memory of 4052	1008	MSAOL32dll.exe	108
PID 1008 wrote to memory of 4700	1008	MSAOL32dll.exe	109

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Rbot.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Rbot.gen.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Windows\SysWOW64\MSAOL32dll.exe
  C:\Windows\system32\MSAOL32dll.exe 1112 "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Rbot.gen.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\MSAOL32dll.exe
    C:\Windows\system32\MSAOL32dll.exe 1236 "C:\Windows\SysWOW64\MSAOL32dll.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\SysWOW64\MSAOL32dll.exe
      C:\Windows\system32\MSAOL32dll.exe 1132 "C:\Windows\SysWOW64\MSAOL32dll.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4868
    - - C:\Windows\SysWOW64\MSAOL32dll.exe
        
        C:\Windows\system32\MSAOL32dll.exe 1204 "C:\Windows\SysWOW64\MSAOL32dll.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6132
      - C:\Windows\SysWOW64\MSAOL32dll.exe
        
        C:\Windows\system32\MSAOL32dll.exe 1208 "C:\Windows\SysWOW64\MSAOL32dll.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Windows\SysWOW64\MSAOL32dll.exe
        
        C:\Windows\system32\MSAOL32dll.exe 1212 "C:\Windows\SysWOW64\MSAOL32dll.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2916
        
        C:\Windows\SysWOW64\MSAOL32dll.exe
        
        C:\Windows\system32\MSAOL32dll.exe 1216 "C:\Windows\SysWOW64\MSAOL32dll.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\MSAOL32dll.exe
        
        C:\Windows\system32\MSAOL32dll.exe 1220 "C:\Windows\SysWOW64\MSAOL32dll.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\MSAOL32dll.exe
        
        C:\Windows\system32\MSAOL32dll.exe 1224 "C:\Windows\SysWOW64\MSAOL32dll.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1008
        
        C:\Windows\SysWOW64\MSAOL32dll.exe
        
        C:\Windows\system32\MSAOL32dll.exe 1228 "C:\Windows\SysWOW64\MSAOL32dll.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
        
        "C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe"
        11⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
        
        "C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe"
        10⤵
        Executes dropped EXE
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
        
        "C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe"
        9⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
        
        "C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe"
        8⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
        
        "C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe"
        7⤵
        Executes dropped EXE
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
        
        "C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe"
        6⤵
        Executes dropped EXE
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
        
        "C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe"
        5⤵
        Executes dropped EXE
        
        PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
      "C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe"
      4⤵
      Executes dropped EXE
      PID:1940
- - C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
    "C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe"
    3⤵
    - Executes dropped EXE
    PID:1868
- C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
  "C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C27D8FEF-D7AE-42c0-82E6-F30598265639.exe

Path C:\Users\Admin\AppData\Local\Temp\C27D8FEF-D7AE-42c0-82E6-F30598265639.exe
Size 3KB
SHA256 ff09e05ee41167c091d35664a44a4af4dd0790fe3f71994a5063f23ca3746a02
MD5 7152446fd31220dd1038b6f7d95ab8a3
SHA1 355b3bfae2ff8bf09a040834adae611f85820b02
SHA512 daa5a6f68231bac1a8ac4f6edfac53e85ccd3c4fbc6a1b6c0e9f63f6f7f34f5051e1fe7e4372b1154638b654d7fdc7ed6d6eec26ba967c11224d7f4b525231be
TLSH
T17071C847BD60D1B2C284CB312BB754DD99BB09310269C4DCEB8F16C9E8F66C21155576
MD5 SHA1 SHA512 TLSH

Submit Download

MSAOL32dll.exe

Path C:\Windows\SysWOW64\MSAOL32dll.exe
Size 152KB
SHA256 496a7914e46d85c1480a012d7a6966ed368d6c49942e4090052307679e0421a8
MD5 96be4aeb54e6cc9768c6f147ccd1bcd8
SHA1 2566018da744b207a78f3d4b888c61ffe7fef0d6
SHA512 f5f6c6e7674bd97362633cc18bb1497de02377af6803b7ab65969fa2d50b42f2f158f7b9ac566e9de1ae1501fe695c0b441a9062ef7c461b2d720700b785ccff
SSDEEP 3072:N0Rt+2j003GyW3zzMX4FcWry35ElUOXZouOSKGLEPwTa9Eo6:WRtnry3zzTFVry35mVXx9PLEkaQ
TLSH
T181E302027CD7893EC498727F4EE99E4E7665F1108D4AE5433E99CFFE28A2B4948104BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1008-81-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/1008-74-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/1272-25-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/1272-12-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/1272-18-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/1620-3-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/1620-10-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/1620-17-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/2916-57-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/2916-50-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/3680-42-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/3680-49-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/4052-82-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/4868-26-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/4868-33-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5028-73-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5028-66-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5036-65-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5036-58-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5240-0-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5240-8-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/5240-1-0x0000000000495000-0x0000000000496000-memory.dmp

Download

memory/6132-41-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

memory/6132-34-0x0000000000400000-0x00000000004AF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads