Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
18/10/2026, 23:41
General
- Target jaffacakes118_Trojan.Win32.Buzus.iexg.exe
- Size 172KB
- Sample261018-3pgbcsbz3z
- SHA256 4e7454141f5e8c9949d3f992ede4d29017ade403f346588cc590abbe743c365d
Malware Config
Signatures
- Family: PoisonIvy
PoisonIvy is a remote access trojan used by many threat actor groups, first seen in 2005.
- Detects PoisonIvy RAT 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Buzus.iexg.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Buzus.iexg.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Buzus.iexg.exeC:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Buzus.iexg.exe2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5984-84-0x0000000000400000-0x0000000000402000-memory.dmp
memory/5984-88-0x0000000000400000-0x0000000000401E00-memory.dmp
memory/5984-85-0x0000000000400000-0x0000000000402000-memory.dmp
memory/5992-0-0x0000000000400000-0x0000000000430000-memory.dmp
memory/5992-1-0x0000000002210000-0x0000000002253000-memory.dmp
memory/5992-5-0x00000000023A0000-0x00000000023A1000-memory.dmp
memory/5992-3-0x00000000021D0000-0x00000000021D1000-memory.dmp
memory/5992-2-0x00000000023E0000-0x00000000023E1000-memory.dmp
memory/5992-9-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/5992-12-0x0000000002B90000-0x0000000002B94000-memory.dmp
memory/5992-11-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/5992-10-0x0000000002260000-0x0000000002261000-memory.dmp
memory/5992-13-0x0000000002B80000-0x0000000002B82000-memory.dmp
memory/5992-8-0x00000000021E0000-0x00000000021E1000-memory.dmp
memory/5992-7-0x0000000002380000-0x0000000002381000-memory.dmp
memory/5992-6-0x0000000002390000-0x0000000002391000-memory.dmp
memory/5992-4-0x00000000021C0000-0x00000000021C1000-memory.dmp
memory/5992-14-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/5992-15-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
memory/5992-29-0x0000000003CD0000-0x0000000003CD1000-memory.dmp
memory/5992-28-0x0000000002C90000-0x0000000002C91000-memory.dmp
memory/5992-27-0x0000000002CA0000-0x0000000002CA1000-memory.dmp
memory/5992-26-0x0000000002C70000-0x0000000002C71000-memory.dmp
memory/5992-25-0x0000000002C80000-0x0000000002C81000-memory.dmp
memory/5992-24-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/5992-23-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
memory/5992-22-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/5992-21-0x0000000002B70000-0x0000000002B71000-memory.dmp
memory/5992-20-0x0000000002B60000-0x0000000002B61000-memory.dmp
memory/5992-19-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/5992-18-0x0000000000400000-0x0000000000430000-memory.dmp
memory/5992-37-0x0000000002210000-0x0000000002253000-memory.dmp
memory/5992-60-0x0000000003FB0000-0x0000000003FB1000-memory.dmp
memory/5992-63-0x0000000003FC0000-0x0000000003FC1000-memory.dmp
memory/5992-62-0x0000000003FD0000-0x0000000003FD1000-memory.dmp
memory/5992-59-0x0000000003F80000-0x0000000003F81000-memory.dmp
memory/5992-58-0x0000000003F90000-0x0000000003F91000-memory.dmp
memory/5992-57-0x0000000003F60000-0x0000000003F61000-memory.dmp
memory/5992-56-0x0000000003F70000-0x0000000003F71000-memory.dmp
memory/5992-55-0x0000000003F40000-0x0000000003F41000-memory.dmp
memory/5992-54-0x0000000003F50000-0x0000000003F51000-memory.dmp
memory/5992-53-0x0000000003F20000-0x0000000003F21000-memory.dmp
memory/5992-52-0x0000000003F30000-0x0000000003F31000-memory.dmp
memory/5992-51-0x0000000003F00000-0x0000000003F01000-memory.dmp
memory/5992-50-0x0000000003F10000-0x0000000003F11000-memory.dmp
memory/5992-49-0x0000000003EE0000-0x0000000003EE1000-memory.dmp
memory/5992-48-0x0000000003EF0000-0x0000000003EF1000-memory.dmp
memory/5992-47-0x0000000003EC0000-0x0000000003EC1000-memory.dmp
memory/5992-46-0x0000000003ED0000-0x0000000003ED1000-memory.dmp
memory/5992-45-0x0000000003EA0000-0x0000000003EA1000-memory.dmp
memory/5992-44-0x0000000003EB0000-0x0000000003EB1000-memory.dmp
memory/5992-43-0x0000000003D80000-0x0000000003D81000-memory.dmp
memory/5992-42-0x0000000003D90000-0x0000000003D91000-memory.dmp
memory/5992-41-0x0000000003D60000-0x0000000003D61000-memory.dmp
memory/5992-40-0x0000000003D70000-0x0000000003D71000-memory.dmp
memory/5992-39-0x0000000003D40000-0x0000000003D41000-memory.dmp
memory/5992-38-0x0000000003D50000-0x0000000003D51000-memory.dmp
memory/5992-61-0x0000000003FA0000-0x0000000003FA1000-memory.dmp
memory/5992-36-0x0000000003D20000-0x0000000003D21000-memory.dmp
memory/5992-35-0x0000000003D30000-0x0000000003D31000-memory.dmp
memory/5992-34-0x0000000003D00000-0x0000000003D01000-memory.dmp
memory/5992-33-0x0000000003D10000-0x0000000003D11000-memory.dmp
memory/5992-32-0x0000000003CE0000-0x0000000003CE1000-memory.dmp
memory/5992-31-0x0000000003CF0000-0x0000000003CF1000-memory.dmp
memory/5992-30-0x0000000003CC0000-0x0000000003CC1000-memory.dmp
memory/5992-74-0x0000000004080000-0x0000000004081000-memory.dmp
memory/5992-73-0x0000000004090000-0x0000000004091000-memory.dmp
memory/5992-68-0x0000000004030000-0x0000000004031000-memory.dmp
memory/5992-67-0x0000000004000000-0x0000000004001000-memory.dmp
memory/5992-66-0x0000000004010000-0x0000000004011000-memory.dmp
memory/5992-64-0x0000000003FF0000-0x0000000003FF1000-memory.dmp
memory/5992-75-0x0000000004070000-0x0000000004071000-memory.dmp
memory/5992-72-0x0000000004060000-0x0000000004061000-memory.dmp
memory/5992-71-0x0000000004040000-0x0000000004041000-memory.dmp
memory/5992-70-0x0000000004050000-0x0000000004051000-memory.dmp
memory/5992-69-0x0000000004020000-0x0000000004021000-memory.dmp
memory/5992-65-0x0000000003FE0000-0x0000000003FE1000-memory.dmp
memory/5992-76-0x00000000040B0000-0x00000000040B1000-memory.dmp
memory/5992-82-0x00000000040F0000-0x00000000040F1000-memory.dmp
memory/5992-78-0x00000000040C0000-0x00000000040C1000-memory.dmp
memory/5992-80-0x0000000004110000-0x0000000004111000-memory.dmp
memory/5992-79-0x00000000040E0000-0x00000000040E1000-memory.dmp
memory/5992-77-0x00000000040A0000-0x00000000040A1000-memory.dmp
memory/5992-81-0x00000000040D0000-0x00000000040D1000-memory.dmp
memory/5992-83-0x0000000004100000-0x0000000004101000-memory.dmp
memory/5992-99-0x00000000041D0000-0x00000000041D1000-memory.dmp
memory/5992-102-0x00000000041E0000-0x00000000041E1000-memory.dmp
memory/5992-100-0x00000000041C0000-0x00000000041C1000-memory.dmp
memory/5992-98-0x00000000041A0000-0x00000000041A1000-memory.dmp
memory/5992-97-0x00000000041B0000-0x00000000041B1000-memory.dmp
memory/5992-95-0x0000000004190000-0x0000000004191000-memory.dmp
memory/5992-94-0x0000000004160000-0x0000000004161000-memory.dmp
memory/5992-93-0x0000000004170000-0x0000000004171000-memory.dmp
memory/5992-92-0x0000000004140000-0x0000000004141000-memory.dmp
memory/5992-91-0x0000000004150000-0x0000000004151000-memory.dmp
memory/5992-101-0x00000000041F0000-0x00000000041F1000-memory.dmp
memory/5992-90-0x0000000004120000-0x0000000004121000-memory.dmp
memory/5992-89-0x0000000004130000-0x0000000004131000-memory.dmp
memory/5992-96-0x0000000004180000-0x0000000004181000-memory.dmp