Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 06:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Backdoor.Win32.Wabot.a.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Backdoor.Win32.Wabot.a.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target jaffacakes118_Backdoor.Win32.Wabot.a.exe
- Size 2.2MB
- Sample261014-gwp17azvcs
- SHA256 60f8e7d64546f00ed95a69b7b3b151c616820ffa47f8ebd8a2d4f50d4f31d364
- MD5 cd95ea10b48f62639fe7961620f1bf1a
- SHA1 058451c22f023f7feaa115262a1e937fad3efdcd
- SHA512 0aaa5f2f422a6994238d3561c504a68c836164e24be62a5e92a58e776399b2487903f35d3716dfd82000f72a30f5e66f6be421fac9ca506a170d6ce45b6a0fba
- SSDEEP 49152:hJLKTsWxtTOJDZ9iU7WxOnae2zut18GGwIbTiXQP0:bitTOdlL2z418GGXbT2
- TLSH T14AB5339AAE01B685FA0B0F3B87288D715F7A0846E566491A095E7F0FF14EF50BF17183
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Detects Wabot worm 15 IoCs
resource yara_rule behavioral2/memory/5444-15-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-16-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-47-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-48-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-49-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-50-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-51-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-52-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-53-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-54-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-55-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-56-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-57-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-58-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot behavioral2/memory/5444-59-0x0000000000400000-0x0000000000419000-memory.dmp family_wabot - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe" jaffacakes118_Backdoor.Win32.Wabot.a.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\elevation_service.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\setup.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX3F35.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\7zG.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\TabTip.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\java-rmi.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\7zFM.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\OSE.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\jarsigner.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\javadoc.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\7zFM.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\dotnet.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\os_update_handler.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\setup.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\initial_prefere.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\ieinstal.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\sIRC4.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\chrmstp.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX3EE5.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\jabswitch.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javac.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\LICLUA.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\ExtExport.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\javac.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javadoc.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\xdccPrograms\MavInject32.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\TabTip.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\elevated_tracing_service.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\notification_helper.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\java.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\appletviewer.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\createdump.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\idlj.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\java-rmi.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\msinfo32.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\msinfo32.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\elevated_tracing_service.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\notification_helper.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\7z.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\iexplore.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\RCX3ED4.tmp jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File opened for modification C:\Windows\SysWOW64\DC++ Share\iexplore.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\idlj.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe File created C:\Windows\SysWOW64\DC++ Share\jar.exe jaffacakes118_Backdoor.Win32.Wabot.a.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Backdoor.Win32.Wabot.a.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\DC++ Share\idlj.exe
- Size 66KB
- SHA256 63f8ec29c4992dae4fc5b9b6ca8ca526169cd033a81d15db53b72bee562292de
- MD5 35c159b01c9ac9e8be5bfe1910492d4d
- SHA1 62afa115cc8fa6617c88f894f755c7ed91c7128c
- SHA512 80a57cb045383a93667caf666d84dec4891da0b12cff20a12e77f65e0a10aa13aff761cfd38da5a7aa566c88a269568cc2decc0dcfc6538c9c8e1f7355260579
- SSDEEP 1536:r7tscn9dWDOHcwucvokwhGuEwLb3xcyUL7yz4i0U:HthvOQc4vTwrEwZUL2z8U
- TLSH T13C63F158B21CC1F2D84B5675BB9A62E1263C3C22AA5571CCCAF53F7F1DF1500C2988EA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe
- Size 2.2MB
- SHA256 4b8fc07ac41964d6cebef78ad72d20f9e0ba9589237113c22831023cebaa78f1
- MD5 e1b39b77f5c7a1e63d914040eae808d3
- SHA1 8e16a3904396ab7f536b89e59849636e04a83b27
- SHA512 453602d08f9d301e33160b6e38548892ba68df56dd101d6a5a82889785757939c288a789b556ef1c30ce54f644de32369b8873a165a0c9e54f9880646c11ba66
- SSDEEP 49152:hJLKTsWxtTOJDZ9iU7WxOnae2zut18GGwIbTiXQPD1:bitTOdlL2z418GGXbTz
- TLSH T19DB5339AAF01B685FA0B0F7B87288E615F7A0446E56A451A095E7F0FF10EF50BF17183
- MD5 SHA1 SHA512 SSDEEP TLSH