Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 06:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Backdoor.Win32.Wabot.a.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Backdoor.Win32.Wabot.a.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target jaffacakes118_Backdoor.Win32.Wabot.a.exe
- Size 1017KB
- Sample261014-gwev8aeg55
- SHA256 9a95235a33d53dde3fd24ed2d748944f6f215b3b27adf07754bf0e4a49ba9177
- MD5 bafd61c6c66b9715776b929b4162b2cb
- SHA1 e22e44990c2e65a2d3ef4fc2364f795549c80c6d
- SHA512 2282ee173a966ce47a62adaaae34e3153e9a89b2c272d0d389384a77c43ca34a4078c86fd9ee4ba228d732825e6662c5dbf8a29ab20be75705a46ededf2f1018
- SSDEEP 24576:xsIgXQJZ3Z5Sh4Ynw9w8+jvJYQr/8wIDyoF:JT3Z564Yn/DJRQwIDyC
- TLSH T18025330D9B816657D250AC7B533FB64A830623AF7C8EF49AC9D5F02E77B9065205C2EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Wabot worm 15 IoCs
resource yara_rule behavioral2/memory/1428-8-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-9-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-45-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-46-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-47-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-48-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-49-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-50-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-51-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-52-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-53-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-54-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-55-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-56-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/1428-57-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" jaffacakes118_Backdoor.Win32.Wabot.a.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\LICLUA.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\createdump.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jar.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jarsigner.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7z.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\os_update_handler.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX63E3.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\createdump.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iexplore.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX63A3.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ExtExport.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\chrome.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX63C3.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\initial_prefere.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\sIRC4.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\initial_prefere.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX6383.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\msinfo32.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\dotnet.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\extcheck.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\ieinstal.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\appletviewer.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\extcheck.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\ielowutil.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\elevated_tracing_service.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Backdoor.Win32.Wabot.a.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\DC++ Share\appletviewer.exe
- Size 67KB
- SHA256 2860b45fe7724c35130563f6fcd17df299da6fdaa6aa2b8e5ec64866f26ac3b8
- MD5 6a0fb21f6158ecf400277ae2ea0692ce
- SHA1 94d9674f4cb868e72fdffd1ccc1443440c6eb578
- SHA512 07006703d2d9f2d2a1d63532e3ac0e1a7b7a3a06a911a8dd1a0a956758b4bc879cae4318d9ed155a7e6302597da6464a8024aa0913f4e30b038a61a341ebb9fd
- SSDEEP 1536:r7tscn9dWDOHcwucvokwhtj8Oe2NVy8jU+e0IK9vHc:HthvOQc4vTwJtVxjU+ASv8
- TLSH T10C63F14D650EC195D103663983CB80E126BC2C26F95F25DCCEBD7F7E2EF69009A949D8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe
- Size 4.1MB
- SHA256 bbc280fea96b7cbe946b074ccfc82fffe8a79803fa58b841d9b24626c167d23c
- MD5 6459c83869e1e1766fca97896b69ef7c
- SHA1 10bbaffd0ec7ba862fdc66a45259f5cfb6c671cd
- SHA512 d74cc9fd9f089f9c54cf3eaabb8b61c9258944178cc1eec419f34c0db835b7bb829ed90e55d46f72df6bcd2c764e55038e93c5ef08c2182040c805dea16bb046
- SSDEEP 98304:N3f64wdRQwIRZouBXuhQozpUKtJZmsLzZOK2+FQDTD8I:JjZwkZ1B4QouKtJZjNxnFCt
- TLSH T1D716330C3F8D693AC059107ED3AF114FE6262A73A18636D6EED6D267CD2C079544C2FA
- MD5 SHA1 SHA512 SSDEEP TLSH