Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 22:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
018bc4e98004a6793822b77b39e20248_JaffaCakes118.exe
Resource
win7-20240729-en
6 signatures
150 seconds
General
-
Target
018bc4e98004a6793822b77b39e20248_JaffaCakes118.exe
-
Size
94KB
-
MD5
018bc4e98004a6793822b77b39e20248
-
SHA1
746d837186c325339b405b6bcb05cce070814d15
-
SHA256
8812b1cde6d977310458413309ec3f98682dd07db12d740ca3f265f62bc2fe01
-
SHA512
2ac419725540a5c10ae0d8222f0129dff51672ce947a7c772ac11a580eed2065a68a44222605e4cbaf1bdf01aa5282b653ac3120e30fa89632bdd59aa89a7ca3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+mzv7oEzNcI2gxprr4H8YoI:ymb3NkkiQ3mdBjF+3TYzvTbrr4Hh
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2652-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2652 flxlxrx.exe 3500 rlfxffl.exe 1252 bbbbtt.exe 4640 vvvvp.exe 1140 9xllrrr.exe 2040 rfxxlxx.exe 3228 bbhtbt.exe 2088 ddjdv.exe 1584 lllxflf.exe 3724 lxffllf.exe 3468 bbbhbh.exe 3504 jjppp.exe 3364 ffllxfl.exe 2292 xrrrrrl.exe 1592 tbbbbh.exe 2948 9vvvv.exe 2244 rrlxxff.exe 2272 hbhnnn.exe 996 dddjd.exe 4652 jdddv.exe 4016 rxlfxxr.exe 2620 hbhhht.exe 2000 btnntt.exe 2036 9jjjp.exe 440 lflfxxx.exe 2760 rfllllr.exe 1888 xrrxxxx.exe 4792 fxrrllf.exe 4808 7nttnt.exe 3940 tnhbtt.exe 1840 jdjjj.exe 4292 pjjpp.exe 4676 lrxrllf.exe 4840 tnnnhh.exe 4896 nthhnn.exe 2796 pdjpj.exe 4544 vjpvv.exe 3292 llrxxll.exe 4488 nhtttb.exe 4248 bbhhbb.exe 3196 vvvvv.exe 3784 7dvvv.exe 2988 lxxrrxf.exe 3744 xxffllr.exe 1424 bbhttn.exe 3352 hhttnb.exe 3536 ppvvp.exe 2764 dpddp.exe 4396 rrfxffl.exe 2968 xrrrlrl.exe 1940 bthhhn.exe 3572 hntntn.exe 3484 jvddd.exe 3852 vpvvv.exe 4408 xxxxxff.exe 972 frrxrrr.exe 4016 lxfflll.exe 1716 httbbh.exe 548 bnbtbt.exe 1740 jjjjd.exe 2148 jjvvj.exe 4420 fxxxlrr.exe 3104 rrffxxr.exe 3920 hnbbbb.exe -
resource yara_rule behavioral2/memory/4456-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2652-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1140-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1140-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-19-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxffrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4456 wrote to memory of 2652 4456 018bc4e98004a6793822b77b39e20248_JaffaCakes118.exe 84 PID 4456 wrote to memory of 2652 4456 018bc4e98004a6793822b77b39e20248_JaffaCakes118.exe 84 PID 4456 wrote to memory of 2652 4456 018bc4e98004a6793822b77b39e20248_JaffaCakes118.exe 84 PID 2652 wrote to memory of 3500 2652 flxlxrx.exe 85 PID 2652 wrote to memory of 3500 2652 flxlxrx.exe 85 PID 2652 wrote to memory of 3500 2652 flxlxrx.exe 85 PID 3500 wrote to memory of 1252 3500 rlfxffl.exe 86 PID 3500 wrote to memory of 1252 3500 rlfxffl.exe 86 PID 3500 wrote to memory of 1252 3500 rlfxffl.exe 86 PID 1252 wrote to memory of 4640 1252 bbbbtt.exe 87 PID 1252 wrote to memory of 4640 1252 bbbbtt.exe 87 PID 1252 wrote to memory of 4640 1252 bbbbtt.exe 87 PID 4640 wrote to memory of 1140 4640 vvvvp.exe 88 PID 4640 wrote to memory of 1140 4640 vvvvp.exe 88 PID 4640 wrote to memory of 1140 4640 vvvvp.exe 88 PID 1140 wrote to memory of 2040 1140 9xllrrr.exe 89 PID 1140 wrote to memory of 2040 1140 9xllrrr.exe 89 PID 1140 wrote to memory of 2040 1140 9xllrrr.exe 89 PID 2040 wrote to memory of 3228 2040 rfxxlxx.exe 90 PID 2040 wrote to memory of 3228 2040 rfxxlxx.exe 90 PID 2040 wrote to memory of 3228 2040 rfxxlxx.exe 90 PID 3228 wrote to memory of 2088 3228 bbhtbt.exe 91 PID 3228 wrote to memory of 2088 3228 bbhtbt.exe 91 PID 3228 wrote to memory of 2088 3228 bbhtbt.exe 91 PID 2088 wrote to memory of 1584 2088 ddjdv.exe 92 PID 2088 wrote to memory of 1584 2088 ddjdv.exe 92 PID 2088 wrote to memory of 1584 2088 ddjdv.exe 92 PID 1584 wrote to memory of 3724 1584 lllxflf.exe 93 PID 1584 wrote to memory of 3724 1584 lllxflf.exe 93 PID 1584 wrote to memory of 3724 1584 lllxflf.exe 93 PID 3724 wrote to memory of 3468 3724 lxffllf.exe 94 PID 3724 wrote to memory of 3468 3724 lxffllf.exe 94 PID 3724 wrote to memory of 3468 3724 lxffllf.exe 94 PID 3468 wrote to memory of 3504 3468 bbbhbh.exe 95 PID 3468 wrote to memory of 3504 3468 bbbhbh.exe 95 PID 3468 wrote to memory of 3504 3468 bbbhbh.exe 95 PID 3504 wrote to memory of 3364 3504 jjppp.exe 97 PID 3504 wrote to memory of 3364 3504 jjppp.exe 97 PID 3504 wrote to memory of 3364 3504 jjppp.exe 97 PID 3364 wrote to memory of 2292 3364 ffllxfl.exe 98 PID 3364 wrote to memory of 2292 3364 ffllxfl.exe 98 PID 3364 wrote to memory of 2292 3364 ffllxfl.exe 98 PID 2292 wrote to memory of 1592 2292 xrrrrrl.exe 99 PID 2292 wrote to memory of 1592 2292 xrrrrrl.exe 99 PID 2292 wrote to memory of 1592 2292 xrrrrrl.exe 99 PID 1592 wrote to memory of 2948 1592 tbbbbh.exe 100 PID 1592 wrote to memory of 2948 1592 tbbbbh.exe 100 PID 1592 wrote to memory of 2948 1592 tbbbbh.exe 100 PID 2948 wrote to memory of 2244 2948 9vvvv.exe 102 PID 2948 wrote to memory of 2244 2948 9vvvv.exe 102 PID 2948 wrote to memory of 2244 2948 9vvvv.exe 102 PID 2244 wrote to memory of 2272 2244 rrlxxff.exe 103 PID 2244 wrote to memory of 2272 2244 rrlxxff.exe 103 PID 2244 wrote to memory of 2272 2244 rrlxxff.exe 103 PID 2272 wrote to memory of 996 2272 hbhnnn.exe 104 PID 2272 wrote to memory of 996 2272 hbhnnn.exe 104 PID 2272 wrote to memory of 996 2272 hbhnnn.exe 104 PID 996 wrote to memory of 4652 996 dddjd.exe 105 PID 996 wrote to memory of 4652 996 dddjd.exe 105 PID 996 wrote to memory of 4652 996 dddjd.exe 105 PID 4652 wrote to memory of 4016 4652 jdddv.exe 106 PID 4652 wrote to memory of 4016 4652 jdddv.exe 106 PID 4652 wrote to memory of 4016 4652 jdddv.exe 106 PID 4016 wrote to memory of 2620 4016 rxlfxxr.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\018bc4e98004a6793822b77b39e20248_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\018bc4e98004a6793822b77b39e20248_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\flxlxrx.exec:\flxlxrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\rlfxffl.exec:\rlfxffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\bbbbtt.exec:\bbbbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\vvvvp.exec:\vvvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\9xllrrr.exec:\9xllrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\rfxxlxx.exec:\rfxxlxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\bbhtbt.exec:\bbhtbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\ddjdv.exec:\ddjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\lllxflf.exec:\lllxflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\lxffllf.exec:\lxffllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\bbbhbh.exec:\bbbhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\jjppp.exec:\jjppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\ffllxfl.exec:\ffllxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\xrrrrrl.exec:\xrrrrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\tbbbbh.exec:\tbbbbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\9vvvv.exec:\9vvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\rrlxxff.exec:\rrlxxff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\hbhnnn.exec:\hbhnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\dddjd.exec:\dddjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\jdddv.exec:\jdddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\hbhhht.exec:\hbhhht.exe23⤵
- Executes dropped EXE
PID:2620 -
\??\c:\btnntt.exec:\btnntt.exe24⤵
- Executes dropped EXE
PID:2000 -
\??\c:\9jjjp.exec:\9jjjp.exe25⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lflfxxx.exec:\lflfxxx.exe26⤵
- Executes dropped EXE
PID:440 -
\??\c:\rfllllr.exec:\rfllllr.exe27⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xrrxxxx.exec:\xrrxxxx.exe28⤵
- Executes dropped EXE
PID:1888 -
\??\c:\fxrrllf.exec:\fxrrllf.exe29⤵
- Executes dropped EXE
PID:4792 -
\??\c:\7nttnt.exec:\7nttnt.exe30⤵
- Executes dropped EXE
PID:4808 -
\??\c:\tnhbtt.exec:\tnhbtt.exe31⤵
- Executes dropped EXE
PID:3940 -
\??\c:\jdjjj.exec:\jdjjj.exe32⤵
- Executes dropped EXE
PID:1840 -
\??\c:\pjjpp.exec:\pjjpp.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4292 -
\??\c:\lrxrllf.exec:\lrxrllf.exe34⤵
- Executes dropped EXE
PID:4676 -
\??\c:\tnnnhh.exec:\tnnnhh.exe35⤵
- Executes dropped EXE
PID:4840 -
\??\c:\nthhnn.exec:\nthhnn.exe36⤵
- Executes dropped EXE
PID:4896 -
\??\c:\pdjpj.exec:\pdjpj.exe37⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vjpvv.exec:\vjpvv.exe38⤵
- Executes dropped EXE
PID:4544 -
\??\c:\llrxxll.exec:\llrxxll.exe39⤵
- Executes dropped EXE
PID:3292 -
\??\c:\nhtttb.exec:\nhtttb.exe40⤵
- Executes dropped EXE
PID:4488 -
\??\c:\bbhhbb.exec:\bbhhbb.exe41⤵
- Executes dropped EXE
PID:4248 -
\??\c:\vvvvv.exec:\vvvvv.exe42⤵
- Executes dropped EXE
PID:3196 -
\??\c:\7dvvv.exec:\7dvvv.exe43⤵
- Executes dropped EXE
PID:3784 -
\??\c:\lxxrrxf.exec:\lxxrrxf.exe44⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xxffllr.exec:\xxffllr.exe45⤵
- Executes dropped EXE
PID:3744 -
\??\c:\bbhttn.exec:\bbhttn.exe46⤵
- Executes dropped EXE
PID:1424 -
\??\c:\hhttnb.exec:\hhttnb.exe47⤵
- Executes dropped EXE
PID:3352 -
\??\c:\ppvvp.exec:\ppvvp.exe48⤵
- Executes dropped EXE
PID:3536 -
\??\c:\dpddp.exec:\dpddp.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rrfxffl.exec:\rrfxffl.exe50⤵
- Executes dropped EXE
PID:4396 -
\??\c:\xrrrlrl.exec:\xrrrlrl.exe51⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bthhhn.exec:\bthhhn.exe52⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hntntn.exec:\hntntn.exe53⤵
- Executes dropped EXE
PID:3572 -
\??\c:\jvddd.exec:\jvddd.exe54⤵
- Executes dropped EXE
PID:3484 -
\??\c:\vpvvv.exec:\vpvvv.exe55⤵
- Executes dropped EXE
PID:3852 -
\??\c:\xxxxxff.exec:\xxxxxff.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4408 -
\??\c:\frrxrrr.exec:\frrxrrr.exe57⤵
- Executes dropped EXE
PID:972 -
\??\c:\lxfflll.exec:\lxfflll.exe58⤵
- Executes dropped EXE
PID:4016 -
\??\c:\httbbh.exec:\httbbh.exe59⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bnbtbt.exec:\bnbtbt.exe60⤵
- Executes dropped EXE
PID:548 -
\??\c:\jjjjd.exec:\jjjjd.exe61⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jjvvj.exec:\jjvvj.exe62⤵
- Executes dropped EXE
PID:2148 -
\??\c:\fxxxlrr.exec:\fxxxlrr.exe63⤵
- Executes dropped EXE
PID:4420 -
\??\c:\rrffxxr.exec:\rrffxxr.exe64⤵
- Executes dropped EXE
PID:3104 -
\??\c:\hnbbbb.exec:\hnbbbb.exe65⤵
- Executes dropped EXE
PID:3920 -
\??\c:\5nbhnt.exec:\5nbhnt.exe66⤵PID:540
-
\??\c:\jdppj.exec:\jdppj.exe67⤵PID:2760
-
\??\c:\jjjvv.exec:\jjjvv.exe68⤵PID:4560
-
\??\c:\jddvj.exec:\jddvj.exe69⤵PID:1888
-
\??\c:\rlllffx.exec:\rlllffx.exe70⤵PID:4868
-
\??\c:\rllfxrf.exec:\rllfxrf.exe71⤵PID:2400
-
\??\c:\hhnbht.exec:\hhnbht.exe72⤵PID:3940
-
\??\c:\hbbbbt.exec:\hbbbbt.exe73⤵PID:4740
-
\??\c:\vvppj.exec:\vvppj.exe74⤵PID:4804
-
\??\c:\dpddd.exec:\dpddd.exe75⤵PID:404
-
\??\c:\fxrrxff.exec:\fxrrxff.exe76⤵PID:3192
-
\??\c:\fllrlll.exec:\fllrlll.exe77⤵PID:436
-
\??\c:\ttbhbh.exec:\ttbhbh.exe78⤵PID:2116
-
\??\c:\ttbbbh.exec:\ttbbbh.exe79⤵PID:4924
-
\??\c:\pvvvv.exec:\pvvvv.exe80⤵PID:2588
-
\??\c:\jpddd.exec:\jpddd.exe81⤵PID:5072
-
\??\c:\rxfllrr.exec:\rxfllrr.exe82⤵PID:2824
-
\??\c:\xxlfrrf.exec:\xxlfrrf.exe83⤵PID:1572
-
\??\c:\bbhnhn.exec:\bbhnhn.exe84⤵PID:4248
-
\??\c:\nhnhtt.exec:\nhnhtt.exe85⤵PID:3308
-
\??\c:\dvdvp.exec:\dvdvp.exe86⤵PID:1988
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe87⤵PID:112
-
\??\c:\flrrrfx.exec:\flrrrfx.exe88⤵PID:1096
-
\??\c:\bnbhhh.exec:\bnbhhh.exe89⤵PID:3448
-
\??\c:\ttnnnt.exec:\ttnnnt.exe90⤵PID:4908
-
\??\c:\1thbbb.exec:\1thbbb.exe91⤵PID:2172
-
\??\c:\dvvpp.exec:\dvvpp.exe92⤵PID:220
-
\??\c:\5vvpj.exec:\5vvpj.exe93⤵PID:3384
-
\??\c:\flrrfll.exec:\flrrfll.exe94⤵PID:4436
-
\??\c:\xrrrflf.exec:\xrrrflf.exe95⤵PID:4396
-
\??\c:\5nhhtb.exec:\5nhhtb.exe96⤵PID:4812
-
\??\c:\thnnnn.exec:\thnnnn.exe97⤵PID:1248
-
\??\c:\pppjj.exec:\pppjj.exe98⤵PID:4356
-
\??\c:\jjdjj.exec:\jjdjj.exe99⤵PID:244
-
\??\c:\vvddd.exec:\vvddd.exe100⤵PID:3628
-
\??\c:\rlllfff.exec:\rlllfff.exe101⤵PID:4652
-
\??\c:\llrrxxl.exec:\llrrxxl.exe102⤵PID:4732
-
\??\c:\bhnnhh.exec:\bhnnhh.exe103⤵PID:848
-
\??\c:\bbtnhh.exec:\bbtnhh.exe104⤵PID:1716
-
\??\c:\hhttth.exec:\hhttth.exe105⤵PID:548
-
\??\c:\pjpjj.exec:\pjpjj.exe106⤵PID:2808
-
\??\c:\pdjpp.exec:\pdjpp.exe107⤵PID:3316
-
\??\c:\7jpjj.exec:\7jpjj.exe108⤵PID:1328
-
\??\c:\rfrrlrl.exec:\rfrrlrl.exe109⤵PID:3588
-
\??\c:\rrrfrff.exec:\rrrfrff.exe110⤵PID:2216
-
\??\c:\9tbbtb.exec:\9tbbtb.exe111⤵PID:3116
-
\??\c:\7hhbbh.exec:\7hhbbh.exe112⤵PID:4092
-
\??\c:\htbhtb.exec:\htbhtb.exe113⤵PID:4524
-
\??\c:\vddjj.exec:\vddjj.exe114⤵PID:1992
-
\??\c:\vpppj.exec:\vpppj.exe115⤵PID:4792
-
\??\c:\5xfxxxr.exec:\5xfxxxr.exe116⤵PID:1832
-
\??\c:\xlrrxrr.exec:\xlrrxrr.exe117⤵PID:4400
-
\??\c:\nbbbtt.exec:\nbbbtt.exe118⤵PID:4456
-
\??\c:\pvvpd.exec:\pvvpd.exe119⤵PID:4672
-
\??\c:\fffxxxr.exec:\fffxxxr.exe120⤵PID:1644
-
\??\c:\1flrllf.exec:\1flrllf.exe121⤵PID:1796
-
\??\c:\hnbttb.exec:\hnbttb.exe122⤵PID:1692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-