a87ec0be45f54dc0ce0a1da3a339873c4c0ba44a2ac82726dc0a651760695b28

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 12:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Backdoor.Win32.Rbot.gen.exe
Size 87KB
Sample261015-paktcatvbt
SHA256 a87ec0be45f54dc0ce0a1da3a339873c4c0ba44a2ac82726dc0a651760695b28
MD5 3edafdcc502fb8c578d29b6a967d63e7
SHA1 e92092c98b787eb5c7c0d9750ffb46dec1e59e20
SHA512 fec483e2217201fdf011f0a53dd91a7449a13d3469ed5e7c1206bfbdcfaeea595e5ed6713081e7605614687a84b8443ff61c8324b782eb6c6b273225635dd3d8
SSDEEP 1536:bAOaKC8IcenFpZrRHHVGG4lBNXooT4Q5Y2RoetVb6R7PwIXF19JYYWf19CFflLP:bTIcMZrdg97VT4kYaoetE9PwIXFJYIf9
TLSH
T1A09312A63B9165F5C4EA69F3920E8EC5AF0933552EC403136B1FDC5F9C760B423A5493
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4680	wuraclt.exe
6028	wuraclt.exe
2616	wuraclt.exe
4300	wuraclt.exe
4484	wuraclt.exe
3244	wuraclt.exe
5808	wuraclt.exe
6076	wuraclt.exe
416	wuraclt.exe
3680	wuraclt.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File opened for modification	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File created	C:\Windows\SysWOW64\wuraclt.exe	jaffacakes118_Backdoor.Win32.Rbot.gen.exe
File created	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File opened for modification	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File opened for modification	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File created	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File created	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File created	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File opened for modification	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File opened for modification	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File opened for modification	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File opened for modification	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File created	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File created	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File created	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File opened for modification	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File opened for modification	C:\Windows\SysWOW64\wuraclt.exe	jaffacakes118_Backdoor.Win32.Rbot.gen.exe
File opened for modification	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File created	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File opened for modification	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe
File created	C:\Windows\SysWOW64\wuraclt.exe	wuraclt.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Backdoor.Win32.Rbot.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuraclt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuraclt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuraclt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuraclt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuraclt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuraclt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuraclt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuraclt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuraclt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuraclt.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 4680	2016	jaffacakes118_Backdoor.Win32.Rbot.gen.exe	89
PID 4680 wrote to memory of 6028	4680	wuraclt.exe	90
PID 6028 wrote to memory of 2616	6028	wuraclt.exe	91
PID 2616 wrote to memory of 4300	2616	wuraclt.exe	92
PID 4300 wrote to memory of 4484	4300	wuraclt.exe	93
PID 4484 wrote to memory of 3244	4484	wuraclt.exe	94
PID 3244 wrote to memory of 5808	3244	wuraclt.exe	95
PID 5808 wrote to memory of 6076	5808	wuraclt.exe	96
PID 6076 wrote to memory of 416	6076	wuraclt.exe	97
PID 416 wrote to memory of 3680	416	wuraclt.exe	98

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Rbot.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Rbot.gen.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\wuraclt.exe
  C:\Windows\system32\wuraclt.exe 1136 "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Backdoor.Win32.Rbot.gen.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\wuraclt.exe
    C:\Windows\system32\wuraclt.exe 1252 "C:\Windows\SysWOW64\wuraclt.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6028
  - - C:\Windows\SysWOW64\wuraclt.exe
      C:\Windows\system32\wuraclt.exe 1216 "C:\Windows\SysWOW64\wuraclt.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Windows\SysWOW64\wuraclt.exe
        
        C:\Windows\system32\wuraclt.exe 1220 "C:\Windows\SysWOW64\wuraclt.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4300
      - C:\Windows\SysWOW64\wuraclt.exe
        
        C:\Windows\system32\wuraclt.exe 1224 "C:\Windows\SysWOW64\wuraclt.exe"
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4484
        
        C:\Windows\SysWOW64\wuraclt.exe
        
        C:\Windows\system32\wuraclt.exe 1228 "C:\Windows\SysWOW64\wuraclt.exe"
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Windows\SysWOW64\wuraclt.exe
        
        C:\Windows\system32\wuraclt.exe 1232 "C:\Windows\SysWOW64\wuraclt.exe"
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5808
        
        C:\Windows\SysWOW64\wuraclt.exe
        
        C:\Windows\system32\wuraclt.exe 1236 "C:\Windows\SysWOW64\wuraclt.exe"
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6076
        
        C:\Windows\SysWOW64\wuraclt.exe
        
        C:\Windows\system32\wuraclt.exe 1244 "C:\Windows\SysWOW64\wuraclt.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:416
        
        C:\Windows\SysWOW64\wuraclt.exe
        
        C:\Windows\system32\wuraclt.exe 1084 "C:\Windows\SysWOW64\wuraclt.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wuraclt.exe

Path C:\Windows\SysWOW64\wuraclt.exe
Size 87KB
SHA256 a87ec0be45f54dc0ce0a1da3a339873c4c0ba44a2ac82726dc0a651760695b28
MD5 3edafdcc502fb8c578d29b6a967d63e7
SHA1 e92092c98b787eb5c7c0d9750ffb46dec1e59e20
SHA512 fec483e2217201fdf011f0a53dd91a7449a13d3469ed5e7c1206bfbdcfaeea595e5ed6713081e7605614687a84b8443ff61c8324b782eb6c6b273225635dd3d8
SSDEEP 1536:bAOaKC8IcenFpZrRHHVGG4lBNXooT4Q5Y2RoetVb6R7PwIXF19JYYWf19CFflLP:bTIcMZrdg97VT4kYaoetE9PwIXFJYIf9
TLSH
T1A09312A63B9165F5C4EA69F3920E8EC5AF0933552EC403136B1FDC5F9C760B423A5493
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/416-30-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/2016-3-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/2016-0-0x0000000000610000-0x0000000000611000-memory.dmp

Download

memory/2616-12-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/3244-21-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/3680-33-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4300-15-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4484-18-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4680-4-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/4680-5-0x0000000000610000-0x0000000000611000-memory.dmp

Download

memory/4680-2-0x0000000000610000-0x0000000000611000-memory.dmp

Download

memory/5808-24-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/6028-9-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

memory/6028-7-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/6076-27-0x0000000000400000-0x00000000004CC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads