Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 16:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dca80251a7b1a0cd739dcc414a98de13_JaffaCakes118.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
dca80251a7b1a0cd739dcc414a98de13_JaffaCakes118.exe
-
Size
222KB
-
MD5
dca80251a7b1a0cd739dcc414a98de13
-
SHA1
40b1a15969bcec307ebe42e0208a6fd53a36aa77
-
SHA256
9b8d8032ac41c92960866d4c2df3abb3f9392f8d7e727da77c9ed3ddb2bc72cf
-
SHA512
64ed91f206add3501651a46109b1da912162d8268150a041024ba38001d215b973da377d8e0a59b5e6452b449433042a47da039b373ce00af313f55ad7823a27
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4SSNc:n3C9BRo7MlrWKo+lx6Nc
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4284-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/840-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/828-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/936-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1708 dvdvj.exe 2536 hbntnn.exe 2752 vvjdv.exe 2832 vppjv.exe 4292 xlfrffx.exe 2168 1tbtnh.exe 3808 pjjvp.exe 840 5pvjv.exe 2824 7lrlxxl.exe 3584 nthbbt.exe 2116 ppdpd.exe 3664 7pvjv.exe 828 rfxrfxr.exe 2200 7nnbtn.exe 1108 djpjv.exe 4956 5ppdp.exe 1472 lflxlfx.exe 2148 jpdvv.exe 1932 xxrlfxr.exe 3900 xlrxrfx.exe 5068 thtnnh.exe 3156 vjjdd.exe 4912 tbhbtn.exe 2968 hbbnhh.exe 2748 lfxrlfx.exe 3036 rlrlffx.exe 808 3vdvv.exe 1492 vjvvd.exe 228 3xfrfff.exe 1824 hhttnh.exe 936 vjpjd.exe 2224 ntbnnt.exe 3648 3pppp.exe 2772 hbhbtn.exe 3864 3hhbtn.exe 4740 vpdvd.exe 4972 fxxrffr.exe 620 thnnnn.exe 4444 bhntnh.exe 3392 pdjjj.exe 4844 rfrlfff.exe 3752 nbnnnn.exe 1088 btbtnn.exe 3208 pjvpj.exe 4688 vvjdd.exe 5080 xrfxfxf.exe 3380 nhbttt.exe 3444 nhtnhb.exe 2168 jjdvv.exe 4768 jdpjp.exe 4340 9flrxxf.exe 840 nhtntn.exe 2620 thhbtn.exe 2824 vppjv.exe 3148 vpvpj.exe 4784 rlxxxfx.exe 1376 bttttt.exe 1676 bthbhh.exe 1092 pjpjd.exe 608 rfffxrl.exe 4456 xrrllll.exe 2096 9tbtnn.exe 2392 9ppjd.exe 4996 rfrrrrr.exe -
resource yara_rule behavioral2/memory/4284-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/840-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/828-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/936-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4284 wrote to memory of 1708 4284 dca80251a7b1a0cd739dcc414a98de13_JaffaCakes118.exe 84 PID 4284 wrote to memory of 1708 4284 dca80251a7b1a0cd739dcc414a98de13_JaffaCakes118.exe 84 PID 4284 wrote to memory of 1708 4284 dca80251a7b1a0cd739dcc414a98de13_JaffaCakes118.exe 84 PID 1708 wrote to memory of 2536 1708 dvdvj.exe 85 PID 1708 wrote to memory of 2536 1708 dvdvj.exe 85 PID 1708 wrote to memory of 2536 1708 dvdvj.exe 85 PID 2536 wrote to memory of 2752 2536 hbntnn.exe 86 PID 2536 wrote to memory of 2752 2536 hbntnn.exe 86 PID 2536 wrote to memory of 2752 2536 hbntnn.exe 86 PID 2752 wrote to memory of 2832 2752 vvjdv.exe 87 PID 2752 wrote to memory of 2832 2752 vvjdv.exe 87 PID 2752 wrote to memory of 2832 2752 vvjdv.exe 87 PID 2832 wrote to memory of 4292 2832 vppjv.exe 89 PID 2832 wrote to memory of 4292 2832 vppjv.exe 89 PID 2832 wrote to memory of 4292 2832 vppjv.exe 89 PID 4292 wrote to memory of 2168 4292 xlfrffx.exe 90 PID 4292 wrote to memory of 2168 4292 xlfrffx.exe 90 PID 4292 wrote to memory of 2168 4292 xlfrffx.exe 90 PID 2168 wrote to memory of 3808 2168 1tbtnh.exe 91 PID 2168 wrote to memory of 3808 2168 1tbtnh.exe 91 PID 2168 wrote to memory of 3808 2168 1tbtnh.exe 91 PID 3808 wrote to memory of 840 3808 pjjvp.exe 92 PID 3808 wrote to memory of 840 3808 pjjvp.exe 92 PID 3808 wrote to memory of 840 3808 pjjvp.exe 92 PID 840 wrote to memory of 2824 840 5pvjv.exe 93 PID 840 wrote to memory of 2824 840 5pvjv.exe 93 PID 840 wrote to memory of 2824 840 5pvjv.exe 93 PID 2824 wrote to memory of 3584 2824 7lrlxxl.exe 94 PID 2824 wrote to memory of 3584 2824 7lrlxxl.exe 94 PID 2824 wrote to memory of 3584 2824 7lrlxxl.exe 94 PID 3584 wrote to memory of 2116 3584 nthbbt.exe 95 PID 3584 wrote to memory of 2116 3584 nthbbt.exe 95 PID 3584 wrote to memory of 2116 3584 nthbbt.exe 95 PID 2116 wrote to memory of 3664 2116 ppdpd.exe 96 PID 2116 wrote to memory of 3664 2116 ppdpd.exe 96 PID 2116 wrote to memory of 3664 2116 ppdpd.exe 96 PID 3664 wrote to memory of 828 3664 7pvjv.exe 98 PID 3664 wrote to memory of 828 3664 7pvjv.exe 98 PID 3664 wrote to memory of 828 3664 7pvjv.exe 98 PID 828 wrote to memory of 2200 828 rfxrfxr.exe 99 PID 828 wrote to memory of 2200 828 rfxrfxr.exe 99 PID 828 wrote to memory of 2200 828 rfxrfxr.exe 99 PID 2200 wrote to memory of 1108 2200 7nnbtn.exe 100 PID 2200 wrote to memory of 1108 2200 7nnbtn.exe 100 PID 2200 wrote to memory of 1108 2200 7nnbtn.exe 100 PID 1108 wrote to memory of 4956 1108 djpjv.exe 101 PID 1108 wrote to memory of 4956 1108 djpjv.exe 101 PID 1108 wrote to memory of 4956 1108 djpjv.exe 101 PID 4956 wrote to memory of 1472 4956 5ppdp.exe 102 PID 4956 wrote to memory of 1472 4956 5ppdp.exe 102 PID 4956 wrote to memory of 1472 4956 5ppdp.exe 102 PID 1472 wrote to memory of 2148 1472 lflxlfx.exe 103 PID 1472 wrote to memory of 2148 1472 lflxlfx.exe 103 PID 1472 wrote to memory of 2148 1472 lflxlfx.exe 103 PID 2148 wrote to memory of 1932 2148 jpdvv.exe 104 PID 2148 wrote to memory of 1932 2148 jpdvv.exe 104 PID 2148 wrote to memory of 1932 2148 jpdvv.exe 104 PID 1932 wrote to memory of 3900 1932 xxrlfxr.exe 105 PID 1932 wrote to memory of 3900 1932 xxrlfxr.exe 105 PID 1932 wrote to memory of 3900 1932 xxrlfxr.exe 105 PID 3900 wrote to memory of 5068 3900 xlrxrfx.exe 106 PID 3900 wrote to memory of 5068 3900 xlrxrfx.exe 106 PID 3900 wrote to memory of 5068 3900 xlrxrfx.exe 106 PID 5068 wrote to memory of 3156 5068 thtnnh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\dca80251a7b1a0cd739dcc414a98de13_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dca80251a7b1a0cd739dcc414a98de13_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\dvdvj.exec:\dvdvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\hbntnn.exec:\hbntnn.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\vvjdv.exec:\vvjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vppjv.exec:\vppjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\xlfrffx.exec:\xlfrffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\1tbtnh.exec:\1tbtnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\pjjvp.exec:\pjjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\5pvjv.exec:\5pvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\7lrlxxl.exec:\7lrlxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\nthbbt.exec:\nthbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\ppdpd.exec:\ppdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\7pvjv.exec:\7pvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\rfxrfxr.exec:\rfxrfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\7nnbtn.exec:\7nnbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\djpjv.exec:\djpjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\5ppdp.exec:\5ppdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\lflxlfx.exec:\lflxlfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\jpdvv.exec:\jpdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\xlrxrfx.exec:\xlrxrfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\thtnnh.exec:\thtnnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\vjjdd.exec:\vjjdd.exe23⤵
- Executes dropped EXE
PID:3156 -
\??\c:\tbhbtn.exec:\tbhbtn.exe24⤵
- Executes dropped EXE
PID:4912 -
\??\c:\hbbnhh.exec:\hbbnhh.exe25⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe26⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rlrlffx.exec:\rlrlffx.exe27⤵
- Executes dropped EXE
PID:3036 -
\??\c:\3vdvv.exec:\3vdvv.exe28⤵
- Executes dropped EXE
PID:808 -
\??\c:\vjvvd.exec:\vjvvd.exe29⤵
- Executes dropped EXE
PID:1492 -
\??\c:\3xfrfff.exec:\3xfrfff.exe30⤵
- Executes dropped EXE
PID:228 -
\??\c:\hhttnh.exec:\hhttnh.exe31⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vjpjd.exec:\vjpjd.exe32⤵
- Executes dropped EXE
PID:936 -
\??\c:\ntbnnt.exec:\ntbnnt.exe33⤵
- Executes dropped EXE
PID:2224 -
\??\c:\3pppp.exec:\3pppp.exe34⤵
- Executes dropped EXE
PID:3648 -
\??\c:\hbhbtn.exec:\hbhbtn.exe35⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3hhbtn.exec:\3hhbtn.exe36⤵
- Executes dropped EXE
PID:3864 -
\??\c:\vpdvd.exec:\vpdvd.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4740 -
\??\c:\fxxrffr.exec:\fxxrffr.exe38⤵
- Executes dropped EXE
PID:4972 -
\??\c:\thnnnn.exec:\thnnnn.exe39⤵
- Executes dropped EXE
PID:620 -
\??\c:\bhntnh.exec:\bhntnh.exe40⤵
- Executes dropped EXE
PID:4444 -
\??\c:\pdjjj.exec:\pdjjj.exe41⤵
- Executes dropped EXE
PID:3392 -
\??\c:\rfrlfff.exec:\rfrlfff.exe42⤵
- Executes dropped EXE
PID:4844 -
\??\c:\nbnnnn.exec:\nbnnnn.exe43⤵
- Executes dropped EXE
PID:3752 -
\??\c:\btbtnn.exec:\btbtnn.exe44⤵
- Executes dropped EXE
PID:1088 -
\??\c:\pjvpj.exec:\pjvpj.exe45⤵
- Executes dropped EXE
PID:3208 -
\??\c:\vvjdd.exec:\vvjdd.exe46⤵
- Executes dropped EXE
PID:4688 -
\??\c:\xrfxfxf.exec:\xrfxfxf.exe47⤵
- Executes dropped EXE
PID:5080 -
\??\c:\nhbttt.exec:\nhbttt.exe48⤵
- Executes dropped EXE
PID:3380 -
\??\c:\nhtnhb.exec:\nhtnhb.exe49⤵
- Executes dropped EXE
PID:3444 -
\??\c:\jjdvv.exec:\jjdvv.exe50⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jdpjp.exec:\jdpjp.exe51⤵
- Executes dropped EXE
PID:4768 -
\??\c:\9flrxxf.exec:\9flrxxf.exe52⤵
- Executes dropped EXE
PID:4340 -
\??\c:\nhtntn.exec:\nhtntn.exe53⤵
- Executes dropped EXE
PID:840 -
\??\c:\thhbtn.exec:\thhbtn.exe54⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vppjv.exec:\vppjv.exe55⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vpvpj.exec:\vpvpj.exe56⤵
- Executes dropped EXE
PID:3148 -
\??\c:\rlxxxfx.exec:\rlxxxfx.exe57⤵
- Executes dropped EXE
PID:4784 -
\??\c:\bttttt.exec:\bttttt.exe58⤵
- Executes dropped EXE
PID:1376 -
\??\c:\bthbhh.exec:\bthbhh.exe59⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pjpjd.exec:\pjpjd.exe60⤵
- Executes dropped EXE
PID:1092 -
\??\c:\rfffxrl.exec:\rfffxrl.exe61⤵
- Executes dropped EXE
PID:608 -
\??\c:\xrrllll.exec:\xrrllll.exe62⤵
- Executes dropped EXE
PID:4456 -
\??\c:\9tbtnn.exec:\9tbtnn.exe63⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9ppjd.exec:\9ppjd.exe64⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe65⤵
- Executes dropped EXE
PID:4996 -
\??\c:\bbhbbb.exec:\bbhbbb.exe66⤵PID:2944
-
\??\c:\dvpvj.exec:\dvpvj.exe67⤵PID:4928
-
\??\c:\vddvv.exec:\vddvv.exe68⤵PID:3984
-
\??\c:\xxfrxxl.exec:\xxfrxxl.exe69⤵PID:3164
-
\??\c:\nhnhbb.exec:\nhnhbb.exe70⤵PID:1096
-
\??\c:\7bbbtb.exec:\7bbbtb.exe71⤵PID:3440
-
\??\c:\pdppd.exec:\pdppd.exe72⤵PID:4020
-
\??\c:\llllflf.exec:\llllflf.exe73⤵PID:4764
-
\??\c:\xrrxrrx.exec:\xrrxrrx.exe74⤵PID:4912
-
\??\c:\nhtntt.exec:\nhtntt.exe75⤵PID:2464
-
\??\c:\nhnhbb.exec:\nhnhbb.exe76⤵PID:2748
-
\??\c:\jjpjv.exec:\jjpjv.exe77⤵PID:2160
-
\??\c:\3vdvj.exec:\3vdvj.exe78⤵PID:1800
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe79⤵PID:1912
-
\??\c:\fffffll.exec:\fffffll.exe80⤵PID:3904
-
\??\c:\ttbttn.exec:\ttbttn.exe81⤵PID:1504
-
\??\c:\btnnnn.exec:\btnnnn.exe82⤵PID:1028
-
\??\c:\pjjjv.exec:\pjjjv.exe83⤵PID:1620
-
\??\c:\pppjj.exec:\pppjj.exe84⤵PID:2992
-
\??\c:\5rrlfff.exec:\5rrlfff.exe85⤵PID:920
-
\??\c:\tttnnh.exec:\tttnnh.exe86⤵PID:1772
-
\??\c:\thnnhh.exec:\thnnhh.exe87⤵PID:4364
-
\??\c:\pjjvv.exec:\pjjvv.exe88⤵PID:1456
-
\??\c:\9jvpj.exec:\9jvpj.exe89⤵PID:4128
-
\??\c:\lxlffxf.exec:\lxlffxf.exe90⤵PID:4740
-
\??\c:\5flfxxx.exec:\5flfxxx.exe91⤵PID:4372
-
\??\c:\htbbtb.exec:\htbbtb.exe92⤵PID:620
-
\??\c:\dvjvd.exec:\dvjvd.exe93⤵PID:1304
-
\??\c:\jppjd.exec:\jppjd.exe94⤵PID:3472
-
\??\c:\xxlfxlf.exec:\xxlfxlf.exe95⤵PID:1200
-
\??\c:\5xrlflf.exec:\5xrlflf.exe96⤵PID:3752
-
\??\c:\7nnnhh.exec:\7nnnhh.exe97⤵PID:3796
-
\??\c:\7hhttt.exec:\7hhttt.exe98⤵PID:3208
-
\??\c:\jddvp.exec:\jddvp.exe99⤵PID:4976
-
\??\c:\9dvpj.exec:\9dvpj.exe100⤵
- System Location Discovery: System Language Discovery
PID:5080 -
\??\c:\xrfxxlf.exec:\xrfxxlf.exe101⤵PID:2440
-
\??\c:\xllrrrl.exec:\xllrrrl.exe102⤵PID:1972
-
\??\c:\hhnhhh.exec:\hhnhhh.exe103⤵PID:2120
-
\??\c:\bbtttb.exec:\bbtttb.exe104⤵PID:4832
-
\??\c:\vjvpj.exec:\vjvpj.exe105⤵PID:2312
-
\??\c:\3jpjj.exec:\3jpjj.exe106⤵PID:840
-
\??\c:\rfrlrrr.exec:\rfrlrrr.exe107⤵PID:4920
-
\??\c:\xflfxxr.exec:\xflfxxr.exe108⤵PID:3592
-
\??\c:\7bhbtt.exec:\7bhbtt.exe109⤵PID:2092
-
\??\c:\hhtttb.exec:\hhtttb.exe110⤵PID:1644
-
\??\c:\1jjdv.exec:\1jjdv.exe111⤵PID:1376
-
\??\c:\frrlllr.exec:\frrlllr.exe112⤵PID:3116
-
\??\c:\ffxrrff.exec:\ffxrrff.exe113⤵PID:2200
-
\??\c:\bbhhbb.exec:\bbhhbb.exe114⤵PID:3880
-
\??\c:\jddpj.exec:\jddpj.exe115⤵PID:2188
-
\??\c:\vjpjp.exec:\vjpjp.exe116⤵PID:3340
-
\??\c:\lrrlfff.exec:\lrrlfff.exe117⤵PID:2196
-
\??\c:\ttnhbt.exec:\ttnhbt.exe118⤵PID:1880
-
\??\c:\nttnbb.exec:\nttnbb.exe119⤵PID:464
-
\??\c:\jdddp.exec:\jdddp.exe120⤵PID:2712
-
\??\c:\frxxrrl.exec:\frxxrrl.exe121⤵
- System Location Discovery: System Language Discovery
PID:1196 -
\??\c:\llxrxff.exec:\llxrxff.exe122⤵PID:4500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-