Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
18/10/2026, 19:08
General
- Target jaffacakes118_Trojan.Win32.Genome.ukmz.exe
- Size 3.2MB
- Sample261018-xtjpdshy41
- SHA256 2b5aec0667a79234f359b47ece4fbf50a4c0831946e1b8d08004c4efe2e7b17d
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 7 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 19 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Genome.ukmz.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Genome.ukmz.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AGENTRES.EXE"C:\Users\Admin\AppData\Local\Temp\AGENTRES.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-B5ND1.tmp\is-DMI1C.tmp"C:\Users\Admin\AppData\Local\Temp\is-B5ND1.tmp\is-DMI1C.tmp" /SL4 $90216 "C:\Users\Admin\AppData\Local\Temp\AGENTRES.EXE" 1590340 522243⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop NMEmployeesAgent4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop NMEmployeesAgent5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Network LookOut\Net Monitor for Employees Professional\bin\NLSAgentSvc.exe"C:\Program Files (x86)\Network LookOut\Net Monitor for Employees Professional\bin\NLSAgentSvc.exe" /SILENT /UNINSTALL4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Network LookOut\Net Monitor for Employees Professional\bin\NLSAgtConfig.exe"C:\Program Files (x86)\Network LookOut\Net Monitor for Employees Professional\bin\NLSAgtConfig.exe" INSTALL /encryption:Y4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Network LookOut\Net Monitor for Employees Professional\bin\NLSAgent.exe"C:\Program Files (x86)\Network LookOut\Net Monitor for Employees Professional\bin\NLSAgent.exe" "Admin"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\CONSOLERES.EXE"C:\Users\Admin\AppData\Local\Temp\CONSOLERES.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AE3KS.tmp\is-MA4F9.tmp"C:\Users\Admin\AppData\Local\Temp\is-AE3KS.tmp\is-MA4F9.tmp" /SL4 $40208 "C:\Users\Admin\AppData\Local\Temp\CONSOLERES.EXE" 2086779 522243⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
README_PRO.TXT
NLSAgent.exe
NLSAgentSvc.exe
NLSupervisorPro.exe
NMEmployeesPro.hlp
is-87TUD.tmp
is-BA8T9.tmp
nlmg.exe
ebuynow.url
eweb.url
unins000.exe
AGENTRES.EXE
CONSOLERES.EXE
is-DMI1C.tmp
_shfoldr.dll
memory/2188-33-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2188-30-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2188-149-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2188-55-0x0000000000400000-0x0000000000413000-memory.dmp
memory/2668-153-0x0000000000400000-0x0000000000529000-memory.dmp
memory/2668-181-0x0000000000400000-0x0000000000529000-memory.dmp
memory/2668-169-0x0000000000400000-0x0000000000529000-memory.dmp
memory/2668-163-0x0000000000400000-0x0000000000529000-memory.dmp
memory/2668-160-0x0000000000400000-0x0000000000529000-memory.dmp
memory/2668-156-0x0000000000400000-0x0000000000529000-memory.dmp
memory/2668-172-0x0000000000400000-0x0000000000529000-memory.dmp
memory/2668-150-0x0000000000400000-0x0000000000529000-memory.dmp
memory/2668-185-0x0000000000400000-0x0000000000529000-memory.dmp
memory/2668-184-0x0000000000400000-0x0000000000529000-memory.dmp
memory/2668-175-0x0000000000400000-0x0000000000529000-memory.dmp
memory/2668-178-0x0000000000400000-0x0000000000529000-memory.dmp
memory/3516-46-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/3516-147-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/3516-39-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/3516-58-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/3516-63-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/3516-59-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/4604-26-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4604-18-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4604-54-0x0000000000400000-0x0000000000413000-memory.dmp
memory/4908-148-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/4908-60-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/4908-64-0x0000000000400000-0x00000000004CF000-memory.dmp
memory/5584-141-0x0000000000400000-0x00000000004F7000-memory.dmp
memory/5812-168-0x0000000000400000-0x0000000000501000-memory.dmp
memory/6084-0-0x0000000000400000-0x00000000008C6000-memory.dmp
memory/6084-1-0x00000000008C5000-0x00000000008C6000-memory.dmp
memory/6084-2-0x0000000000400000-0x00000000008C6000-memory.dmp
memory/6084-3-0x0000000000400000-0x00000000008C6000-memory.dmp
memory/6084-25-0x0000000000400000-0x00000000008C6000-memory.dmp
memory/6084-38-0x0000000000400000-0x00000000008C6000-memory.dmp
memory/6084-49-0x0000000000400000-0x00000000008C6000-memory.dmp