Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
18/10/2026, 20:54
General
- Target jaffacakes118_Trojan.Win32.Dovs.ous.exe
- Size 317KB
- Sample261018-zqcssahs4m
- SHA256 c040ac4054c4b454cbd442a1950e797859addf8f22e2bd8dc7e2e0451dbd8d95
Malware Config
Signatures
- Family: Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Drops file in System32 directory 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 3 IoCs
- Suspicious behavior: EnumeratesProcesses 34 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Dovs.ous.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Dovs.ous.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Dovs.ous.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Dovs.ous.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
-
C:\Windows\SysWOW64\vsgdsquare.exe"C:\Windows\SysWOW64\vsgdsquare.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vsgdsquare.exe"C:\Windows\SysWOW64\vsgdsquare.exe"2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2100-8-0x00000000008F0000-0x00000000008FD000-memory.dmp
memory/2100-36-0x00000000005B0000-0x00000000005BD000-memory.dmp
memory/2100-35-0x0000000000400000-0x0000000000453000-memory.dmp
memory/2100-13-0x00000000005B0000-0x00000000005BD000-memory.dmp
memory/2100-14-0x0000000000900000-0x0000000000910000-memory.dmp
memory/2100-12-0x00000000008F0000-0x00000000008FD000-memory.dmp
memory/2628-29-0x00000000007F0000-0x00000000007FD000-memory.dmp
memory/2628-25-0x00000000007F0000-0x00000000007FD000-memory.dmp
memory/2628-38-0x0000000000400000-0x0000000000453000-memory.dmp
memory/2628-37-0x00000000007E0000-0x00000000007ED000-memory.dmp
memory/2628-31-0x0000000000800000-0x0000000000810000-memory.dmp
memory/2628-30-0x00000000007E0000-0x00000000007ED000-memory.dmp
memory/2788-33-0x0000000000510000-0x000000000051D000-memory.dmp
memory/2788-18-0x0000000000510000-0x000000000051D000-memory.dmp
memory/2788-24-0x0000000000530000-0x0000000000540000-memory.dmp
memory/2788-32-0x0000000000400000-0x0000000000453000-memory.dmp
memory/2864-0-0x0000000000400000-0x0000000000453000-memory.dmp
memory/2864-7-0x0000000000530000-0x0000000000540000-memory.dmp
memory/2864-15-0x0000000000400000-0x0000000000453000-memory.dmp
memory/2864-2-0x0000000000520000-0x000000000052D000-memory.dmp
memory/2864-1-0x0000000000500000-0x000000000050D000-memory.dmp
memory/2864-16-0x0000000000500000-0x000000000050D000-memory.dmp
memory/2864-6-0x0000000000520000-0x000000000052D000-memory.dmp