citadel | 6816ab9bdd78256021f2b85d7e976edb41f2ce3d1838d642c66bf975e54eda9d

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/10/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Spy.Win32.Zbot.wlqb.exe
Size 503KB
Sample261016-dgd4lafd38
SHA256 6816ab9bdd78256021f2b85d7e976edb41f2ce3d1838d642c66bf975e54eda9d
MD5 7e55aa955ed7a413e9e26c90d09bdd80
SHA1 e01bf5e5dfd6dcbaa072dc6d29d63f58e91c5f48
SHA512 b78f1157fc3428fa399f39a7bd240e6fb7d64d9c8ca583b5063b901114d37702b2f6662191e6995ff14efc84cd5a043412720d29e682b99301f44930126e2ef6
SSDEEP 6144:ojbeimG54aK79y4lghfx9bnKDXcRN+r860dMPgUeax3ea3CtN/Gum8bcH0VTiiwb:ouW/4lgdbTEc20dygUPx3tyWN6305fj
TLSH
T13CB4122296E5967BE0E433F15DF511A32BBDBCA46EB4936B824640C96D352C07A3C31F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery citadel persistence trojan upx

Malware Config

Signatures

Family: Citadel
Citadel is a trojan and botnet written in C.
trojan botnet citadel

Detects Citadel payload 2 IoCs

resource	yara_rule
behavioral2/memory/6120-17-0x0000000000400000-0x000000000043B000-memory.dmp	family_citadel
behavioral2/memory/6120-14-0x0000000000400000-0x0000000001B0C000-memory.dmp	family_citadel

Executes dropped EXE 2 IoCs

pid	Process
4528	M.exe
6120	M.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	jaffacakes118_Trojan-Spy.Win32.Zbot.wlqb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4528 set thread context of 6120	4528	M.exe	90

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000f00000001c53d-5.dat	upx
behavioral2/memory/4528-7-0x0000000000400000-0x00000000004A4000-memory.dmp	upx
behavioral2/memory/4528-11-0x0000000000400000-0x00000000004A4000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	M.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Spy.Win32.Zbot.wlqb.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4528	M.exe
4528	M.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4528	M.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4528	3576	jaffacakes118_Trojan-Spy.Win32.Zbot.wlqb.exe	89
PID 4528 wrote to memory of 6120	4528	M.exe	90
PID 4528 wrote to memory of 6120	4528	M.exe	90
PID 4528 wrote to memory of 6120	4528	M.exe	90
PID 4528 wrote to memory of 6120	4528	M.exe	90
PID 4528 wrote to memory of 6120	4528	M.exe	90
PID 4528 wrote to memory of 6120	4528	M.exe	90
PID 4528 wrote to memory of 6120	4528	M.exe	90
PID 4528 wrote to memory of 6120	4528	M.exe	90

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Zbot.wlqb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.Zbot.wlqb.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
    3⤵
    - Executes dropped EXE
    PID:6120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

M.ex_

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.ex_
Size 263KB
SHA256 0cf3a31477c914cff3cdbbab54134c1196ff23a669ccfd2999ae4c1fc80a741e
MD5 7c78f1b17cf786b8ebd717ae0f4f2906
SHA1 22ae733c812976c018c056cba75b9885fa9f8d5b
SHA512 2175e9793b9a7f1b1034807d1ae29264627d6ae9055995e14d9bd92b26f8a2142b4dba102d0c2b104aeb27aafb681f0274b17465e58f6e899ce5ee7c4b803808
SSDEEP 6144:qFPtUeax3ex3CtX/Gum8bcH0VpiiHfK6Fwyj3ljQNfncdLw:qdtUPx6VyoKb3lyf7
TLSH
T1F844225256E3FBE5621CD8FAF9D1F467FBEA55262EEC9003C393C401B05A482BA3D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

M.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\M.exe
Size 179KB
SHA256 4720dda6594096e2ecfbd009056f12d61013858feb91e3023212e842f8adeab7
MD5 aca242c694fc12b25c4b9bebf57a1696
SHA1 f6961f2c8da3f8403c519bd676521ff8f4d24dc8
SHA512 f274e868172a94ab544846bad3f1288e59965636d4bbf0b5e819ef7f9d2f6ed85a2eae9deb4b2c29feb5d31f98b05b67b75d51766f1a25c2fa91d017bc8225be
SSDEEP 3072:qOgDvO/LOZAOhpW0usAGIZc1zYsLD1k1FdBSPGLWy1NpQEZmVBWbXclBcydO12C:gDo0AOnzqc1HwFdBTnbQEZmKbXUBVov
TLSH
T12604122319FC0E7AC966057711472E19308EE5BCC3D05F96DCA6812EA83BE7588A8DDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4528-7-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/4528-9-0x00000000004A3000-0x00000000004A4000-memory.dmp

Download

memory/4528-11-0x0000000000400000-0x00000000004A4000-memory.dmp

Download

memory/6120-17-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/6120-14-0x0000000000400000-0x0000000001B0C000-memory.dmp

Download