Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 22:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe
Resource
win7-20240705-en
6 signatures
150 seconds
General
-
Target
0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe
-
Size
75KB
-
MD5
0174b93ab08c055273c5e126421e18ee
-
SHA1
52a91934614d6e07925b0cb8c4fde5bb831b25ce
-
SHA256
a1d88bfc96adeae6cc6430ac63b3482d035d859010b64c765b73617b22901ca9
-
SHA512
165ea6925e7baf2a7529e5fca13c29bd008883bbf404dc93160fb03342bfaaa4a5c938d9e6dfa006ec3b34708a4ad94178fa3741ad27c82940510012d04254de
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfotGpSy5wAP:ymb3NkkiQ3mdBjFWXkj7afowp7DP
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/3820-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/784-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 440 rlrrxfx.exe 860 bnnhnt.exe 3616 1jddd.exe 2924 xffxlfl.exe 4252 btnnbt.exe 1736 vpjdd.exe 4076 fxlrffl.exe 2404 7hbttb.exe 784 jdvdp.exe 4524 xllrlrr.exe 4312 bbbbbb.exe 116 ttnntn.exe 4740 vvddv.exe 1980 lxxxrrr.exe 3484 ntnbnh.exe 3348 3pppp.exe 4556 vvddd.exe 3012 frlrllx.exe 2496 xfrlllf.exe 4412 tbhbbb.exe 3232 vjjdp.exe 4180 xxlrrlr.exe 1424 bnbthh.exe 3940 hhhbbh.exe 3608 jpjpv.exe 3624 lfrrrff.exe 2064 1nbbbb.exe 1792 tnbbbt.exe 3480 vpddv.exe 4712 ffxxllx.exe 4436 rrllrll.exe 3216 hbbnhn.exe 2732 vjvvd.exe 4724 9rlfxfr.exe 4540 bbhhbb.exe 4352 ddvdd.exe 4288 9lrxrxf.exe 4804 lrffxxx.exe 5036 bhnnnt.exe 4860 vppvv.exe 4044 rfffxxx.exe 4848 hntnhh.exe 4904 5jjjv.exe 216 jddvj.exe 2420 7rrlxfx.exe 1748 nnhtnt.exe 3880 btbtnn.exe 1320 dpppp.exe 4228 pvjdp.exe 1900 xfffrrl.exe 4084 tbbbhh.exe 4300 hbtbhh.exe 2168 vddvj.exe 1664 fxxrlff.exe 2208 nbbbbh.exe 4224 nnnnhh.exe 3576 pvdvv.exe 4560 dvdvp.exe 2496 3xfxrrr.exe 3960 9xfrrxf.exe 2864 3tnhbt.exe 3356 5hhbnt.exe 5008 jjpvp.exe 4008 rrfxxrl.exe -
resource yara_rule behavioral2/memory/3820-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/784-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3820 wrote to memory of 440 3820 0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe 84 PID 3820 wrote to memory of 440 3820 0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe 84 PID 3820 wrote to memory of 440 3820 0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe 84 PID 440 wrote to memory of 860 440 rlrrxfx.exe 85 PID 440 wrote to memory of 860 440 rlrrxfx.exe 85 PID 440 wrote to memory of 860 440 rlrrxfx.exe 85 PID 860 wrote to memory of 3616 860 bnnhnt.exe 86 PID 860 wrote to memory of 3616 860 bnnhnt.exe 86 PID 860 wrote to memory of 3616 860 bnnhnt.exe 86 PID 3616 wrote to memory of 2924 3616 1jddd.exe 87 PID 3616 wrote to memory of 2924 3616 1jddd.exe 87 PID 3616 wrote to memory of 2924 3616 1jddd.exe 87 PID 2924 wrote to memory of 4252 2924 xffxlfl.exe 88 PID 2924 wrote to memory of 4252 2924 xffxlfl.exe 88 PID 2924 wrote to memory of 4252 2924 xffxlfl.exe 88 PID 4252 wrote to memory of 1736 4252 btnnbt.exe 90 PID 4252 wrote to memory of 1736 4252 btnnbt.exe 90 PID 4252 wrote to memory of 1736 4252 btnnbt.exe 90 PID 1736 wrote to memory of 4076 1736 vpjdd.exe 91 PID 1736 wrote to memory of 4076 1736 vpjdd.exe 91 PID 1736 wrote to memory of 4076 1736 vpjdd.exe 91 PID 4076 wrote to memory of 2404 4076 fxlrffl.exe 92 PID 4076 wrote to memory of 2404 4076 fxlrffl.exe 92 PID 4076 wrote to memory of 2404 4076 fxlrffl.exe 92 PID 2404 wrote to memory of 784 2404 7hbttb.exe 93 PID 2404 wrote to memory of 784 2404 7hbttb.exe 93 PID 2404 wrote to memory of 784 2404 7hbttb.exe 93 PID 784 wrote to memory of 4524 784 jdvdp.exe 94 PID 784 wrote to memory of 4524 784 jdvdp.exe 94 PID 784 wrote to memory of 4524 784 jdvdp.exe 94 PID 4524 wrote to memory of 4312 4524 xllrlrr.exe 95 PID 4524 wrote to memory of 4312 4524 xllrlrr.exe 95 PID 4524 wrote to memory of 4312 4524 xllrlrr.exe 95 PID 4312 wrote to memory of 116 4312 bbbbbb.exe 96 PID 4312 wrote to memory of 116 4312 bbbbbb.exe 96 PID 4312 wrote to memory of 116 4312 bbbbbb.exe 96 PID 116 wrote to memory of 4740 116 ttnntn.exe 97 PID 116 wrote to memory of 4740 116 ttnntn.exe 97 PID 116 wrote to memory of 4740 116 ttnntn.exe 97 PID 4740 wrote to memory of 1980 4740 vvddv.exe 98 PID 4740 wrote to memory of 1980 4740 vvddv.exe 98 PID 4740 wrote to memory of 1980 4740 vvddv.exe 98 PID 1980 wrote to memory of 3484 1980 lxxxrrr.exe 100 PID 1980 wrote to memory of 3484 1980 lxxxrrr.exe 100 PID 1980 wrote to memory of 3484 1980 lxxxrrr.exe 100 PID 3484 wrote to memory of 3348 3484 ntnbnh.exe 101 PID 3484 wrote to memory of 3348 3484 ntnbnh.exe 101 PID 3484 wrote to memory of 3348 3484 ntnbnh.exe 101 PID 3348 wrote to memory of 4556 3348 3pppp.exe 102 PID 3348 wrote to memory of 4556 3348 3pppp.exe 102 PID 3348 wrote to memory of 4556 3348 3pppp.exe 102 PID 4556 wrote to memory of 3012 4556 vvddd.exe 103 PID 4556 wrote to memory of 3012 4556 vvddd.exe 103 PID 4556 wrote to memory of 3012 4556 vvddd.exe 103 PID 3012 wrote to memory of 2496 3012 frlrllx.exe 105 PID 3012 wrote to memory of 2496 3012 frlrllx.exe 105 PID 3012 wrote to memory of 2496 3012 frlrllx.exe 105 PID 2496 wrote to memory of 4412 2496 xfrlllf.exe 106 PID 2496 wrote to memory of 4412 2496 xfrlllf.exe 106 PID 2496 wrote to memory of 4412 2496 xfrlllf.exe 106 PID 4412 wrote to memory of 3232 4412 tbhbbb.exe 107 PID 4412 wrote to memory of 3232 4412 tbhbbb.exe 107 PID 4412 wrote to memory of 3232 4412 tbhbbb.exe 107 PID 3232 wrote to memory of 4180 3232 vjjdp.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0174b93ab08c055273c5e126421e18ee_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\rlrrxfx.exec:\rlrrxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\bnnhnt.exec:\bnnhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\1jddd.exec:\1jddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\xffxlfl.exec:\xffxlfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\btnnbt.exec:\btnnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\vpjdd.exec:\vpjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\fxlrffl.exec:\fxlrffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\7hbttb.exec:\7hbttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\jdvdp.exec:\jdvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\xllrlrr.exec:\xllrlrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\bbbbbb.exec:\bbbbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\ttnntn.exec:\ttnntn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\vvddv.exec:\vvddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\ntnbnh.exec:\ntnbnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\3pppp.exec:\3pppp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\vvddd.exec:\vvddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\frlrllx.exec:\frlrllx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\xfrlllf.exec:\xfrlllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\tbhbbb.exec:\tbhbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\vjjdp.exec:\vjjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\xxlrrlr.exec:\xxlrrlr.exe23⤵
- Executes dropped EXE
PID:4180 -
\??\c:\bnbthh.exec:\bnbthh.exe24⤵
- Executes dropped EXE
PID:1424 -
\??\c:\hhhbbh.exec:\hhhbbh.exe25⤵
- Executes dropped EXE
PID:3940 -
\??\c:\jpjpv.exec:\jpjpv.exe26⤵
- Executes dropped EXE
PID:3608 -
\??\c:\lfrrrff.exec:\lfrrrff.exe27⤵
- Executes dropped EXE
PID:3624 -
\??\c:\1nbbbb.exec:\1nbbbb.exe28⤵
- Executes dropped EXE
PID:2064 -
\??\c:\tnbbbt.exec:\tnbbbt.exe29⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vpddv.exec:\vpddv.exe30⤵
- Executes dropped EXE
PID:3480 -
\??\c:\ffxxllx.exec:\ffxxllx.exe31⤵
- Executes dropped EXE
PID:4712 -
\??\c:\rrllrll.exec:\rrllrll.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4436 -
\??\c:\hbbnhn.exec:\hbbnhn.exe33⤵
- Executes dropped EXE
PID:3216 -
\??\c:\vjvvd.exec:\vjvvd.exe34⤵
- Executes dropped EXE
PID:2732 -
\??\c:\9rlfxfr.exec:\9rlfxfr.exe35⤵
- Executes dropped EXE
PID:4724 -
\??\c:\bbhhbb.exec:\bbhhbb.exe36⤵
- Executes dropped EXE
PID:4540 -
\??\c:\ddvdd.exec:\ddvdd.exe37⤵
- Executes dropped EXE
PID:4352 -
\??\c:\9lrxrxf.exec:\9lrxrxf.exe38⤵
- Executes dropped EXE
PID:4288 -
\??\c:\lrffxxx.exec:\lrffxxx.exe39⤵
- Executes dropped EXE
PID:4804 -
\??\c:\bhnnnt.exec:\bhnnnt.exe40⤵
- Executes dropped EXE
PID:5036 -
\??\c:\vppvv.exec:\vppvv.exe41⤵
- Executes dropped EXE
PID:4860 -
\??\c:\rfffxxx.exec:\rfffxxx.exe42⤵
- Executes dropped EXE
PID:4044 -
\??\c:\hntnhh.exec:\hntnhh.exe43⤵
- Executes dropped EXE
PID:4848 -
\??\c:\5jjjv.exec:\5jjjv.exe44⤵
- Executes dropped EXE
PID:4904 -
\??\c:\jddvj.exec:\jddvj.exe45⤵
- Executes dropped EXE
PID:216 -
\??\c:\7rrlxfx.exec:\7rrlxfx.exe46⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nnhtnt.exec:\nnhtnt.exe47⤵
- Executes dropped EXE
PID:1748 -
\??\c:\btbtnn.exec:\btbtnn.exe48⤵
- Executes dropped EXE
PID:3880 -
\??\c:\dpppp.exec:\dpppp.exe49⤵
- Executes dropped EXE
PID:1320 -
\??\c:\pvjdp.exec:\pvjdp.exe50⤵
- Executes dropped EXE
PID:4228 -
\??\c:\xfffrrl.exec:\xfffrrl.exe51⤵
- Executes dropped EXE
PID:1900 -
\??\c:\tbbbhh.exec:\tbbbhh.exe52⤵
- Executes dropped EXE
PID:4084 -
\??\c:\hbtbhh.exec:\hbtbhh.exe53⤵
- Executes dropped EXE
PID:4300 -
\??\c:\vddvj.exec:\vddvj.exe54⤵
- Executes dropped EXE
PID:2168 -
\??\c:\fxxrlff.exec:\fxxrlff.exe55⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nbbbbh.exec:\nbbbbh.exe56⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nnnnhh.exec:\nnnnhh.exe57⤵
- Executes dropped EXE
PID:4224 -
\??\c:\pvdvv.exec:\pvdvv.exe58⤵
- Executes dropped EXE
PID:3576 -
\??\c:\dvdvp.exec:\dvdvp.exe59⤵
- Executes dropped EXE
PID:4560 -
\??\c:\3xfxrrr.exec:\3xfxrrr.exe60⤵
- Executes dropped EXE
PID:2496 -
\??\c:\9xfrrxf.exec:\9xfrrxf.exe61⤵
- Executes dropped EXE
PID:3960 -
\??\c:\3tnhbt.exec:\3tnhbt.exe62⤵
- Executes dropped EXE
PID:2864 -
\??\c:\5hhbnt.exec:\5hhbnt.exe63⤵
- Executes dropped EXE
PID:3356 -
\??\c:\jjpvp.exec:\jjpvp.exe64⤵
- Executes dropped EXE
PID:5008 -
\??\c:\rrfxxrl.exec:\rrfxxrl.exe65⤵
- Executes dropped EXE
PID:4008 -
\??\c:\lrrflrx.exec:\lrrflrx.exe66⤵PID:3056
-
\??\c:\9bnhhb.exec:\9bnhhb.exe67⤵PID:4372
-
\??\c:\nhhbtt.exec:\nhhbtt.exe68⤵PID:3608
-
\??\c:\5vdvj.exec:\5vdvj.exe69⤵PID:4640
-
\??\c:\lxffxfl.exec:\lxffxfl.exe70⤵PID:3624
-
\??\c:\rllxfrf.exec:\rllxfrf.exe71⤵PID:512
-
\??\c:\htntbn.exec:\htntbn.exe72⤵PID:4736
-
\??\c:\hnnhbt.exec:\hnnhbt.exe73⤵PID:1924
-
\??\c:\dvvpd.exec:\dvvpd.exe74⤵PID:1416
-
\??\c:\jvvvj.exec:\jvvvj.exe75⤵PID:4080
-
\??\c:\5llfllf.exec:\5llfllf.exe76⤵PID:3320
-
\??\c:\flrrllf.exec:\flrrllf.exe77⤵PID:3964
-
\??\c:\btnhbt.exec:\btnhbt.exe78⤵PID:3644
-
\??\c:\nbbnhb.exec:\nbbnhb.exe79⤵PID:2520
-
\??\c:\9jvpj.exec:\9jvpj.exe80⤵PID:4336
-
\??\c:\3dpjd.exec:\3dpjd.exe81⤵PID:3672
-
\??\c:\3lfxxfl.exec:\3lfxxfl.exe82⤵PID:4288
-
\??\c:\bthhbt.exec:\bthhbt.exe83⤵PID:4804
-
\??\c:\hhbbnt.exec:\hhbbnt.exe84⤵PID:2924
-
\??\c:\djjjv.exec:\djjjv.exe85⤵PID:2244
-
\??\c:\vvpdp.exec:\vvpdp.exe86⤵PID:3824
-
\??\c:\fxfxxll.exec:\fxfxxll.exe87⤵PID:4688
-
\??\c:\hbnhhh.exec:\hbnhhh.exe88⤵PID:4076
-
\??\c:\5ththt.exec:\5ththt.exe89⤵PID:4800
-
\??\c:\jdvpj.exec:\jdvpj.exe90⤵PID:4948
-
\??\c:\jjdjd.exec:\jjdjd.exe91⤵PID:4780
-
\??\c:\lrflxrx.exec:\lrflxrx.exe92⤵PID:5108
-
\??\c:\rrlfrlf.exec:\rrlfrlf.exe93⤵PID:2764
-
\??\c:\7tbnbb.exec:\7tbnbb.exe94⤵PID:2580
-
\??\c:\vvdvj.exec:\vvdvj.exe95⤵PID:4228
-
\??\c:\7ddvp.exec:\7ddvp.exe96⤵PID:1900
-
\??\c:\xxxlfff.exec:\xxxlfff.exe97⤵PID:4084
-
\??\c:\xfrfrxl.exec:\xfrfrxl.exe98⤵PID:2796
-
\??\c:\nbthbn.exec:\nbthbn.exe99⤵PID:3744
-
\??\c:\pjdvj.exec:\pjdvj.exe100⤵PID:3812
-
\??\c:\ppjjd.exec:\ppjjd.exe101⤵PID:2996
-
\??\c:\rfxrrrl.exec:\rfxrrrl.exe102⤵PID:396
-
\??\c:\xrxlrxr.exec:\xrxlrxr.exe103⤵PID:4072
-
\??\c:\bnnbtn.exec:\bnnbtn.exe104⤵PID:1488
-
\??\c:\pvjvp.exec:\pvjvp.exe105⤵PID:3272
-
\??\c:\lxxlxrf.exec:\lxxlxrf.exe106⤵PID:1624
-
\??\c:\3xfxrrl.exec:\3xfxrrl.exe107⤵PID:2864
-
\??\c:\1jdvp.exec:\1jdvp.exe108⤵PID:3356
-
\??\c:\xrxxrlf.exec:\xrxxrlf.exe109⤵PID:1316
-
\??\c:\7xrlffx.exec:\7xrlffx.exe110⤵PID:3940
-
\??\c:\3tttnt.exec:\3tttnt.exe111⤵PID:3056
-
\??\c:\jvddv.exec:\jvddv.exe112⤵
- System Location Discovery: System Language Discovery
PID:3840 -
\??\c:\llfxrfx.exec:\llfxrfx.exe113⤵PID:1544
-
\??\c:\hbbttt.exec:\hbbttt.exe114⤵PID:4536
-
\??\c:\pdpdj.exec:\pdpdj.exe115⤵PID:4432
-
\??\c:\vjjjj.exec:\vjjjj.exe116⤵PID:868
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe117⤵PID:400
-
\??\c:\nhhbtt.exec:\nhhbtt.exe118⤵PID:3264
-
\??\c:\nnnhbb.exec:\nnnhbb.exe119⤵PID:4088
-
\??\c:\1jpdp.exec:\1jpdp.exe120⤵PID:4492
-
\??\c:\rlfxllf.exec:\rlfxllf.exe121⤵PID:4068
-
\??\c:\frxfxfx.exec:\frxfxfx.exe122⤵PID:4340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-