Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 00:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d0b04726bd848f15647350e70c773711_JaffaCakes118.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
d0b04726bd848f15647350e70c773711_JaffaCakes118.exe
-
Size
78KB
-
MD5
d0b04726bd848f15647350e70c773711
-
SHA1
b5af9845eb69ee0ba5d60e48135de251b2e4b1ce
-
SHA256
21adf2c62befe260a9e10365f2ed2a6dfdfec5ca65b4eaefbae01e6766918b08
-
SHA512
837aa48ba9caf744f3cf09868398c3d447ba1036241b4179031c72d089461165c38ea56daea7fbff0b3a2fc194436b9344b752019dfcc1731baf4175752bc97a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot3nj:ymb3NkkiQ3mdBjFWXkj7afodnj
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2676-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/524-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 216 hhthtt.exe 4320 jpvjv.exe 4844 rllxrlx.exe 3296 httnhb.exe 1352 hbbnbt.exe 3700 9pjdv.exe 2704 pjpjj.exe 2108 rlrffxr.exe 4776 hhtnbt.exe 2444 xrfxlfr.exe 3044 rlrflfr.exe 4972 9ntbnh.exe 4892 vjjdv.exe 3452 xfxllll.exe 4408 tbhhbt.exe 524 nhbtbt.exe 3256 9pjdv.exe 4400 vvpjv.exe 3036 frxrrxr.exe 1880 rxxrrlx.exe 884 bntnbn.exe 4572 thtnbt.exe 2376 dppdv.exe 2688 5pvpd.exe 4448 llrffxf.exe 2080 nbhntb.exe 1732 pjjjv.exe 1588 vpvpp.exe 1440 9xrlxrl.exe 4884 bhhnhh.exe 2896 7btnhb.exe 3292 jpppj.exe 4948 1jjvj.exe 1464 1ffxrxr.exe 2208 rflxxrr.exe 3956 nnnbtn.exe 648 bhhbnb.exe 216 jvdpd.exe 1900 pppjj.exe 1488 llllxrl.exe 4844 xlfxllf.exe 4908 5bbtnn.exe 4088 hbbbbn.exe 3984 pdpvp.exe 1712 pdvpd.exe 4696 5rrfllr.exe 3216 rfxxrxx.exe 2596 7ntnbb.exe 5020 5ttnbt.exe 4692 5nbnbt.exe 2096 vdvpv.exe 2444 9jjdj.exe 3044 fxrxfxx.exe 2736 lfrrlfx.exe 4972 thtnhb.exe 3708 bbhbbt.exe 4380 ddvjv.exe 2472 1jdvd.exe 4544 xxlxlfx.exe 4968 3fxrffr.exe 520 htnbth.exe 3256 tbnhbt.exe 8 9vvjv.exe 2252 rllfrfr.exe -
resource yara_rule behavioral2/memory/2676-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/524-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2676 wrote to memory of 216 2676 d0b04726bd848f15647350e70c773711_JaffaCakes118.exe 83 PID 2676 wrote to memory of 216 2676 d0b04726bd848f15647350e70c773711_JaffaCakes118.exe 83 PID 2676 wrote to memory of 216 2676 d0b04726bd848f15647350e70c773711_JaffaCakes118.exe 83 PID 216 wrote to memory of 4320 216 hhthtt.exe 84 PID 216 wrote to memory of 4320 216 hhthtt.exe 84 PID 216 wrote to memory of 4320 216 hhthtt.exe 84 PID 4320 wrote to memory of 4844 4320 jpvjv.exe 85 PID 4320 wrote to memory of 4844 4320 jpvjv.exe 85 PID 4320 wrote to memory of 4844 4320 jpvjv.exe 85 PID 4844 wrote to memory of 3296 4844 rllxrlx.exe 86 PID 4844 wrote to memory of 3296 4844 rllxrlx.exe 86 PID 4844 wrote to memory of 3296 4844 rllxrlx.exe 86 PID 3296 wrote to memory of 1352 3296 httnhb.exe 87 PID 3296 wrote to memory of 1352 3296 httnhb.exe 87 PID 3296 wrote to memory of 1352 3296 httnhb.exe 87 PID 1352 wrote to memory of 3700 1352 hbbnbt.exe 89 PID 1352 wrote to memory of 3700 1352 hbbnbt.exe 89 PID 1352 wrote to memory of 3700 1352 hbbnbt.exe 89 PID 3700 wrote to memory of 2704 3700 9pjdv.exe 90 PID 3700 wrote to memory of 2704 3700 9pjdv.exe 90 PID 3700 wrote to memory of 2704 3700 9pjdv.exe 90 PID 2704 wrote to memory of 2108 2704 pjpjj.exe 91 PID 2704 wrote to memory of 2108 2704 pjpjj.exe 91 PID 2704 wrote to memory of 2108 2704 pjpjj.exe 91 PID 2108 wrote to memory of 4776 2108 rlrffxr.exe 92 PID 2108 wrote to memory of 4776 2108 rlrffxr.exe 92 PID 2108 wrote to memory of 4776 2108 rlrffxr.exe 92 PID 4776 wrote to memory of 2444 4776 hhtnbt.exe 93 PID 4776 wrote to memory of 2444 4776 hhtnbt.exe 93 PID 4776 wrote to memory of 2444 4776 hhtnbt.exe 93 PID 2444 wrote to memory of 3044 2444 xrfxlfr.exe 95 PID 2444 wrote to memory of 3044 2444 xrfxlfr.exe 95 PID 2444 wrote to memory of 3044 2444 xrfxlfr.exe 95 PID 3044 wrote to memory of 4972 3044 rlrflfr.exe 96 PID 3044 wrote to memory of 4972 3044 rlrflfr.exe 96 PID 3044 wrote to memory of 4972 3044 rlrflfr.exe 96 PID 4972 wrote to memory of 4892 4972 9ntbnh.exe 97 PID 4972 wrote to memory of 4892 4972 9ntbnh.exe 97 PID 4972 wrote to memory of 4892 4972 9ntbnh.exe 97 PID 4892 wrote to memory of 3452 4892 vjjdv.exe 98 PID 4892 wrote to memory of 3452 4892 vjjdv.exe 98 PID 4892 wrote to memory of 3452 4892 vjjdv.exe 98 PID 3452 wrote to memory of 4408 3452 xfxllll.exe 99 PID 3452 wrote to memory of 4408 3452 xfxllll.exe 99 PID 3452 wrote to memory of 4408 3452 xfxllll.exe 99 PID 4408 wrote to memory of 524 4408 tbhhbt.exe 100 PID 4408 wrote to memory of 524 4408 tbhhbt.exe 100 PID 4408 wrote to memory of 524 4408 tbhhbt.exe 100 PID 524 wrote to memory of 3256 524 nhbtbt.exe 101 PID 524 wrote to memory of 3256 524 nhbtbt.exe 101 PID 524 wrote to memory of 3256 524 nhbtbt.exe 101 PID 3256 wrote to memory of 4400 3256 9pjdv.exe 102 PID 3256 wrote to memory of 4400 3256 9pjdv.exe 102 PID 3256 wrote to memory of 4400 3256 9pjdv.exe 102 PID 4400 wrote to memory of 3036 4400 vvpjv.exe 103 PID 4400 wrote to memory of 3036 4400 vvpjv.exe 103 PID 4400 wrote to memory of 3036 4400 vvpjv.exe 103 PID 3036 wrote to memory of 1880 3036 frxrrxr.exe 105 PID 3036 wrote to memory of 1880 3036 frxrrxr.exe 105 PID 3036 wrote to memory of 1880 3036 frxrrxr.exe 105 PID 1880 wrote to memory of 884 1880 rxxrrlx.exe 106 PID 1880 wrote to memory of 884 1880 rxxrrlx.exe 106 PID 1880 wrote to memory of 884 1880 rxxrrlx.exe 106 PID 884 wrote to memory of 4572 884 bntnbn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0b04726bd848f15647350e70c773711_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d0b04726bd848f15647350e70c773711_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\hhthtt.exec:\hhthtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\jpvjv.exec:\jpvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\rllxrlx.exec:\rllxrlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\httnhb.exec:\httnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\hbbnbt.exec:\hbbnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\9pjdv.exec:\9pjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\pjpjj.exec:\pjpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\rlrffxr.exec:\rlrffxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\hhtnbt.exec:\hhtnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\xrfxlfr.exec:\xrfxlfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\rlrflfr.exec:\rlrflfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\9ntbnh.exec:\9ntbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\vjjdv.exec:\vjjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\xfxllll.exec:\xfxllll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\tbhhbt.exec:\tbhhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\nhbtbt.exec:\nhbtbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\9pjdv.exec:\9pjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\vvpjv.exec:\vvpjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\frxrrxr.exec:\frxrrxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\rxxrrlx.exec:\rxxrrlx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\bntnbn.exec:\bntnbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\thtnbt.exec:\thtnbt.exe23⤵
- Executes dropped EXE
PID:4572 -
\??\c:\dppdv.exec:\dppdv.exe24⤵
- Executes dropped EXE
PID:2376 -
\??\c:\5pvpd.exec:\5pvpd.exe25⤵
- Executes dropped EXE
PID:2688 -
\??\c:\llrffxf.exec:\llrffxf.exe26⤵
- Executes dropped EXE
PID:4448 -
\??\c:\nbhntb.exec:\nbhntb.exe27⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pjjjv.exec:\pjjjv.exe28⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vpvpp.exec:\vpvpp.exe29⤵
- Executes dropped EXE
PID:1588 -
\??\c:\9xrlxrl.exec:\9xrlxrl.exe30⤵
- Executes dropped EXE
PID:1440 -
\??\c:\bhhnhh.exec:\bhhnhh.exe31⤵
- Executes dropped EXE
PID:4884 -
\??\c:\7btnhb.exec:\7btnhb.exe32⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jpppj.exec:\jpppj.exe33⤵
- Executes dropped EXE
PID:3292 -
\??\c:\1jjvj.exec:\1jjvj.exe34⤵
- Executes dropped EXE
PID:4948 -
\??\c:\1ffxrxr.exec:\1ffxrxr.exe35⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rflxxrr.exec:\rflxxrr.exe36⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nnnbtn.exec:\nnnbtn.exe37⤵
- Executes dropped EXE
PID:3956 -
\??\c:\bhhbnb.exec:\bhhbnb.exe38⤵
- Executes dropped EXE
PID:648 -
\??\c:\jvdpd.exec:\jvdpd.exe39⤵
- Executes dropped EXE
PID:216 -
\??\c:\pppjj.exec:\pppjj.exe40⤵
- Executes dropped EXE
PID:1900 -
\??\c:\llllxrl.exec:\llllxrl.exe41⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xlfxllf.exec:\xlfxllf.exe42⤵
- Executes dropped EXE
PID:4844 -
\??\c:\5bbtnn.exec:\5bbtnn.exe43⤵
- Executes dropped EXE
PID:4908 -
\??\c:\hbbbbn.exec:\hbbbbn.exe44⤵
- Executes dropped EXE
PID:4088 -
\??\c:\pdpvp.exec:\pdpvp.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3984 -
\??\c:\pdvpd.exec:\pdvpd.exe46⤵
- Executes dropped EXE
PID:1712 -
\??\c:\5rrfllr.exec:\5rrfllr.exe47⤵
- Executes dropped EXE
PID:4696 -
\??\c:\rfxxrxx.exec:\rfxxrxx.exe48⤵
- Executes dropped EXE
PID:3216 -
\??\c:\7ntnbb.exec:\7ntnbb.exe49⤵
- Executes dropped EXE
PID:2596 -
\??\c:\5ttnbt.exec:\5ttnbt.exe50⤵
- Executes dropped EXE
PID:5020 -
\??\c:\5nbnbt.exec:\5nbnbt.exe51⤵
- Executes dropped EXE
PID:4692 -
\??\c:\vdvpv.exec:\vdvpv.exe52⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9jjdj.exec:\9jjdj.exe53⤵
- Executes dropped EXE
PID:2444 -
\??\c:\fxrxfxx.exec:\fxrxfxx.exe54⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lfrrlfx.exec:\lfrrlfx.exe55⤵
- Executes dropped EXE
PID:2736 -
\??\c:\thtnhb.exec:\thtnhb.exe56⤵
- Executes dropped EXE
PID:4972 -
\??\c:\bbhbbt.exec:\bbhbbt.exe57⤵
- Executes dropped EXE
PID:3708 -
\??\c:\ddvjv.exec:\ddvjv.exe58⤵
- Executes dropped EXE
PID:4380 -
\??\c:\1jdvd.exec:\1jdvd.exe59⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xxlxlfx.exec:\xxlxlfx.exe60⤵
- Executes dropped EXE
PID:4544 -
\??\c:\3fxrffr.exec:\3fxrffr.exe61⤵
- Executes dropped EXE
PID:4968 -
\??\c:\htnbth.exec:\htnbth.exe62⤵
- Executes dropped EXE
PID:520 -
\??\c:\tbnhbt.exec:\tbnhbt.exe63⤵
- Executes dropped EXE
PID:3256 -
\??\c:\9vvjv.exec:\9vvjv.exe64⤵
- Executes dropped EXE
PID:8 -
\??\c:\rllfrfr.exec:\rllfrfr.exe65⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nbthbt.exec:\nbthbt.exe66⤵PID:2700
-
\??\c:\nbhbbt.exec:\nbhbbt.exe67⤵PID:3252
-
\??\c:\vjvjd.exec:\vjvjd.exe68⤵PID:3536
-
\??\c:\vpjdp.exec:\vpjdp.exe69⤵PID:4532
-
\??\c:\vppjp.exec:\vppjp.exe70⤵PID:4572
-
\??\c:\fffxfxl.exec:\fffxfxl.exe71⤵PID:2996
-
\??\c:\9rrllfx.exec:\9rrllfx.exe72⤵PID:2312
-
\??\c:\5tthtn.exec:\5tthtn.exe73⤵PID:4928
-
\??\c:\1bbbtt.exec:\1bbbtt.exe74⤵PID:4016
-
\??\c:\jppjd.exec:\jppjd.exe75⤵PID:436
-
\??\c:\djjdv.exec:\djjdv.exe76⤵PID:1984
-
\??\c:\xlfxffx.exec:\xlfxffx.exe77⤵PID:2608
-
\??\c:\fxlxlfr.exec:\fxlxlfr.exe78⤵PID:4360
-
\??\c:\7rfxrlf.exec:\7rfxrlf.exe79⤵PID:4652
-
\??\c:\thnhtt.exec:\thnhtt.exe80⤵PID:4852
-
\??\c:\7tnbbt.exec:\7tnbbt.exe81⤵PID:3288
-
\??\c:\pvpdp.exec:\pvpdp.exe82⤵PID:3292
-
\??\c:\vppjd.exec:\vppjd.exe83⤵PID:4472
-
\??\c:\rfxlfrr.exec:\rfxlfrr.exe84⤵PID:4296
-
\??\c:\9nhbnh.exec:\9nhbnh.exe85⤵PID:3444
-
\??\c:\tnnbtn.exec:\tnnbtn.exe86⤵PID:2576
-
\??\c:\ppvvv.exec:\ppvvv.exe87⤵PID:648
-
\??\c:\9jdvv.exec:\9jdvv.exe88⤵PID:3208
-
\??\c:\fxrrfxr.exec:\fxrrfxr.exe89⤵PID:3724
-
\??\c:\xlrffxr.exec:\xlrffxr.exe90⤵
- System Location Discovery: System Language Discovery
PID:2028 -
\??\c:\frrrflf.exec:\frrrflf.exe91⤵PID:2188
-
\??\c:\btttnh.exec:\btttnh.exe92⤵PID:632
-
\??\c:\7nnhhb.exec:\7nnhhb.exe93⤵PID:4668
-
\??\c:\9pdpd.exec:\9pdpd.exe94⤵PID:4156
-
\??\c:\vvpjv.exec:\vvpjv.exe95⤵PID:1608
-
\??\c:\lflfxrr.exec:\lflfxrr.exe96⤵PID:2176
-
\??\c:\nnthbn.exec:\nnthbn.exe97⤵PID:3232
-
\??\c:\jjjdp.exec:\jjjdp.exe98⤵PID:3004
-
\??\c:\rlfrxlx.exec:\rlfrxlx.exe99⤵PID:4776
-
\??\c:\rlfrrrf.exec:\rlfrrrf.exe100⤵PID:1404
-
\??\c:\btnhbt.exec:\btnhbt.exe101⤵PID:1280
-
\??\c:\jvdjd.exec:\jvdjd.exe102⤵PID:1180
-
\??\c:\dvjpd.exec:\dvjpd.exe103⤵PID:2112
-
\??\c:\9ppdp.exec:\9ppdp.exe104⤵PID:5040
-
\??\c:\1fxlxrl.exec:\1fxlxrl.exe105⤵PID:4976
-
\??\c:\htbbtt.exec:\htbbtt.exe106⤵PID:828
-
\??\c:\hhnhnh.exec:\hhnhnh.exe107⤵PID:3432
-
\??\c:\djpjv.exec:\djpjv.exe108⤵PID:1332
-
\??\c:\vddvv.exec:\vddvv.exe109⤵
- System Location Discovery: System Language Discovery
PID:3572 -
\??\c:\xllxlfx.exec:\xllxlfx.exe110⤵PID:3424
-
\??\c:\ffllxff.exec:\ffllxff.exe111⤵PID:220
-
\??\c:\tnhbbb.exec:\tnhbbb.exe112⤵PID:4528
-
\??\c:\hbnntt.exec:\hbnntt.exe113⤵PID:4444
-
\??\c:\pjpjd.exec:\pjpjd.exe114⤵PID:2740
-
\??\c:\lfrlrlr.exec:\lfrlrlr.exe115⤵PID:1268
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe116⤵PID:4904
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe117⤵PID:3524
-
\??\c:\9thbbt.exec:\9thbbt.exe118⤵PID:5012
-
\??\c:\5ttbbt.exec:\5ttbbt.exe119⤵PID:3740
-
\??\c:\jjpjd.exec:\jjpjd.exe120⤵
- System Location Discovery: System Language Discovery
PID:1564 -
\??\c:\vjpjd.exec:\vjpjd.exe121⤵PID:1436
-
\??\c:\lffxxrx.exec:\lffxxrx.exe122⤵PID:2216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-