Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2024 05:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe
-
Size
132KB
-
MD5
1203015e3c1fc213eee40870a1bdbf1c
-
SHA1
d31d27d7fa6db7bc1ba4ee10083accae6f77b39a
-
SHA256
764ea099bfbee95b8522ae91095b8f8b936591af40ae35f916f7d338278fe18b
-
SHA512
5c57b96576a9a79ed061592792352be3c5654c6276873605091ffac1262ea1e5b07f2cb90045effa55a9d5436b954993d45ef276953e3a0182943d32c08ef138
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9gFbctg0IyAyhZvjDUgJu:n3C9BRo7tvnJ9oH0IRgZvjD1u
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4816-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4984 pjjdd.exe 60 rlfxllf.exe 3416 hhhhnb.exe 4396 fxxrlfx.exe 1496 hnnttt.exe 4928 ntbnhb.exe 3624 rlxrlfr.exe 2928 hhnbhn.exe 3196 dvvvp.exe 3232 dvvpj.exe 4280 rffrlrf.exe 2028 tnntht.exe 212 7rrfrlx.exe 2068 xrrlfxl.exe 3272 vdpdv.exe 5020 xxlxlfx.exe 4824 bbnbnn.exe 4492 vjjdv.exe 4440 rfxrffx.exe 3980 thhbth.exe 3716 dpdvv.exe 3456 lllrrxr.exe 1532 7lrlfxf.exe 3248 jdddv.exe 668 rffrllx.exe 3596 rlfxxrr.exe 3436 tbhhhb.exe 5064 3vpjv.exe 4640 vjdpd.exe 1900 lxxllrl.exe 4876 1bthtn.exe 2124 tttthb.exe 4864 jvjvj.exe 2940 jdvdj.exe 4088 rllxrll.exe 2896 pdjpj.exe 4416 3jpjp.exe 4840 ffffxrl.exe 4884 hbhbnb.exe 2076 djjdv.exe 396 vpjvj.exe 1028 fxlflfr.exe 3892 nhhbtt.exe 1572 bbhhnn.exe 4660 pvvjv.exe 3428 vpjvj.exe 4816 lxlxffl.exe 1712 thnbtt.exe 3976 hbnhtn.exe 4836 djpdp.exe 2828 9ddpj.exe 4432 3rrxrxx.exe 5112 tnnbtt.exe 2680 hnbthb.exe 3032 dddvj.exe 3736 llrlffx.exe 4756 lffxrxr.exe 3064 tnbnhh.exe 1576 jdjjp.exe 5048 pppvd.exe 2604 flrfrrl.exe 3144 lfffrxr.exe 1584 hbtnhh.exe 4092 vjjjv.exe -
resource yara_rule behavioral2/memory/4816-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4816 wrote to memory of 4984 4816 1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe 82 PID 4816 wrote to memory of 4984 4816 1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe 82 PID 4816 wrote to memory of 4984 4816 1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe 82 PID 4984 wrote to memory of 60 4984 pjjdd.exe 83 PID 4984 wrote to memory of 60 4984 pjjdd.exe 83 PID 4984 wrote to memory of 60 4984 pjjdd.exe 83 PID 60 wrote to memory of 3416 60 rlfxllf.exe 84 PID 60 wrote to memory of 3416 60 rlfxllf.exe 84 PID 60 wrote to memory of 3416 60 rlfxllf.exe 84 PID 3416 wrote to memory of 4396 3416 hhhhnb.exe 85 PID 3416 wrote to memory of 4396 3416 hhhhnb.exe 85 PID 3416 wrote to memory of 4396 3416 hhhhnb.exe 85 PID 4396 wrote to memory of 1496 4396 fxxrlfx.exe 86 PID 4396 wrote to memory of 1496 4396 fxxrlfx.exe 86 PID 4396 wrote to memory of 1496 4396 fxxrlfx.exe 86 PID 1496 wrote to memory of 4928 1496 hnnttt.exe 87 PID 1496 wrote to memory of 4928 1496 hnnttt.exe 87 PID 1496 wrote to memory of 4928 1496 hnnttt.exe 87 PID 4928 wrote to memory of 3624 4928 ntbnhb.exe 88 PID 4928 wrote to memory of 3624 4928 ntbnhb.exe 88 PID 4928 wrote to memory of 3624 4928 ntbnhb.exe 88 PID 3624 wrote to memory of 2928 3624 rlxrlfr.exe 89 PID 3624 wrote to memory of 2928 3624 rlxrlfr.exe 89 PID 3624 wrote to memory of 2928 3624 rlxrlfr.exe 89 PID 2928 wrote to memory of 3196 2928 hhnbhn.exe 90 PID 2928 wrote to memory of 3196 2928 hhnbhn.exe 90 PID 2928 wrote to memory of 3196 2928 hhnbhn.exe 90 PID 3196 wrote to memory of 3232 3196 dvvvp.exe 91 PID 3196 wrote to memory of 3232 3196 dvvvp.exe 91 PID 3196 wrote to memory of 3232 3196 dvvvp.exe 91 PID 3232 wrote to memory of 4280 3232 dvvpj.exe 92 PID 3232 wrote to memory of 4280 3232 dvvpj.exe 92 PID 3232 wrote to memory of 4280 3232 dvvpj.exe 92 PID 4280 wrote to memory of 2028 4280 rffrlrf.exe 93 PID 4280 wrote to memory of 2028 4280 rffrlrf.exe 93 PID 4280 wrote to memory of 2028 4280 rffrlrf.exe 93 PID 2028 wrote to memory of 212 2028 tnntht.exe 94 PID 2028 wrote to memory of 212 2028 tnntht.exe 94 PID 2028 wrote to memory of 212 2028 tnntht.exe 94 PID 212 wrote to memory of 2068 212 7rrfrlx.exe 95 PID 212 wrote to memory of 2068 212 7rrfrlx.exe 95 PID 212 wrote to memory of 2068 212 7rrfrlx.exe 95 PID 2068 wrote to memory of 3272 2068 xrrlfxl.exe 96 PID 2068 wrote to memory of 3272 2068 xrrlfxl.exe 96 PID 2068 wrote to memory of 3272 2068 xrrlfxl.exe 96 PID 3272 wrote to memory of 5020 3272 vdpdv.exe 97 PID 3272 wrote to memory of 5020 3272 vdpdv.exe 97 PID 3272 wrote to memory of 5020 3272 vdpdv.exe 97 PID 5020 wrote to memory of 4824 5020 xxlxlfx.exe 98 PID 5020 wrote to memory of 4824 5020 xxlxlfx.exe 98 PID 5020 wrote to memory of 4824 5020 xxlxlfx.exe 98 PID 4824 wrote to memory of 4492 4824 bbnbnn.exe 99 PID 4824 wrote to memory of 4492 4824 bbnbnn.exe 99 PID 4824 wrote to memory of 4492 4824 bbnbnn.exe 99 PID 4492 wrote to memory of 4440 4492 vjjdv.exe 100 PID 4492 wrote to memory of 4440 4492 vjjdv.exe 100 PID 4492 wrote to memory of 4440 4492 vjjdv.exe 100 PID 4440 wrote to memory of 3980 4440 rfxrffx.exe 101 PID 4440 wrote to memory of 3980 4440 rfxrffx.exe 101 PID 4440 wrote to memory of 3980 4440 rfxrffx.exe 101 PID 3980 wrote to memory of 3716 3980 thhbth.exe 102 PID 3980 wrote to memory of 3716 3980 thhbth.exe 102 PID 3980 wrote to memory of 3716 3980 thhbth.exe 102 PID 3716 wrote to memory of 3456 3716 dpdvv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1203015e3c1fc213eee40870a1bdbf1c_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\pjjdd.exec:\pjjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\rlfxllf.exec:\rlfxllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\hhhhnb.exec:\hhhhnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\hnnttt.exec:\hnnttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\ntbnhb.exec:\ntbnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\rlxrlfr.exec:\rlxrlfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\hhnbhn.exec:\hhnbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\dvvvp.exec:\dvvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\dvvpj.exec:\dvvpj.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\rffrlrf.exec:\rffrlrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\tnntht.exec:\tnntht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\7rrfrlx.exec:\7rrfrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\xrrlfxl.exec:\xrrlfxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\vdpdv.exec:\vdpdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\xxlxlfx.exec:\xxlxlfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\bbnbnn.exec:\bbnbnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\vjjdv.exec:\vjjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\rfxrffx.exec:\rfxrffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\thhbth.exec:\thhbth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\dpdvv.exec:\dpdvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\lllrrxr.exec:\lllrrxr.exe23⤵
- Executes dropped EXE
PID:3456 -
\??\c:\7lrlfxf.exec:\7lrlfxf.exe24⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jdddv.exec:\jdddv.exe25⤵
- Executes dropped EXE
PID:3248 -
\??\c:\rffrllx.exec:\rffrllx.exe26⤵
- Executes dropped EXE
PID:668 -
\??\c:\rlfxxrr.exec:\rlfxxrr.exe27⤵
- Executes dropped EXE
PID:3596 -
\??\c:\tbhhhb.exec:\tbhhhb.exe28⤵
- Executes dropped EXE
PID:3436 -
\??\c:\3vpjv.exec:\3vpjv.exe29⤵
- Executes dropped EXE
PID:5064 -
\??\c:\vjdpd.exec:\vjdpd.exe30⤵
- Executes dropped EXE
PID:4640 -
\??\c:\lxxllrl.exec:\lxxllrl.exe31⤵
- Executes dropped EXE
PID:1900 -
\??\c:\1bthtn.exec:\1bthtn.exe32⤵
- Executes dropped EXE
PID:4876 -
\??\c:\tttthb.exec:\tttthb.exe33⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jvjvj.exec:\jvjvj.exe34⤵
- Executes dropped EXE
PID:4864 -
\??\c:\jdvdj.exec:\jdvdj.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2940 -
\??\c:\rllxrll.exec:\rllxrll.exe36⤵
- Executes dropped EXE
PID:4088 -
\??\c:\pdjpj.exec:\pdjpj.exe37⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3jpjp.exec:\3jpjp.exe38⤵
- Executes dropped EXE
PID:4416 -
\??\c:\ffffxrl.exec:\ffffxrl.exe39⤵
- Executes dropped EXE
PID:4840 -
\??\c:\hbhbnb.exec:\hbhbnb.exe40⤵
- Executes dropped EXE
PID:4884 -
\??\c:\djjdv.exec:\djjdv.exe41⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vpjvj.exec:\vpjvj.exe42⤵
- Executes dropped EXE
PID:396 -
\??\c:\fxlflfr.exec:\fxlflfr.exe43⤵
- Executes dropped EXE
PID:1028 -
\??\c:\nhhbtt.exec:\nhhbtt.exe44⤵
- Executes dropped EXE
PID:3892 -
\??\c:\bbhhnn.exec:\bbhhnn.exe45⤵
- Executes dropped EXE
PID:1572 -
\??\c:\pvvjv.exec:\pvvjv.exe46⤵
- Executes dropped EXE
PID:4660 -
\??\c:\vpjvj.exec:\vpjvj.exe47⤵
- Executes dropped EXE
PID:3428 -
\??\c:\lxlxffl.exec:\lxlxffl.exe48⤵
- Executes dropped EXE
PID:4816 -
\??\c:\thnbtt.exec:\thnbtt.exe49⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hbnhtn.exec:\hbnhtn.exe50⤵
- Executes dropped EXE
PID:3976 -
\??\c:\djpdp.exec:\djpdp.exe51⤵
- Executes dropped EXE
PID:4836 -
\??\c:\9ddpj.exec:\9ddpj.exe52⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3rrxrxx.exec:\3rrxrxx.exe53⤵
- Executes dropped EXE
PID:4432 -
\??\c:\tnnbtt.exec:\tnnbtt.exe54⤵
- Executes dropped EXE
PID:5112 -
\??\c:\hnbthb.exec:\hnbthb.exe55⤵
- Executes dropped EXE
PID:2680 -
\??\c:\dddvj.exec:\dddvj.exe56⤵
- Executes dropped EXE
PID:3032 -
\??\c:\llrlffx.exec:\llrlffx.exe57⤵
- Executes dropped EXE
PID:3736 -
\??\c:\lffxrxr.exec:\lffxrxr.exe58⤵
- Executes dropped EXE
PID:4756 -
\??\c:\tnbnhh.exec:\tnbnhh.exe59⤵
- Executes dropped EXE
PID:3064 -
\??\c:\jdjjp.exec:\jdjjp.exe60⤵
- Executes dropped EXE
PID:1576 -
\??\c:\pppvd.exec:\pppvd.exe61⤵
- Executes dropped EXE
PID:5048 -
\??\c:\flrfrrl.exec:\flrfrrl.exe62⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lfffrxr.exec:\lfffrxr.exe63⤵
- Executes dropped EXE
PID:3144 -
\??\c:\hbtnhh.exec:\hbtnhh.exe64⤵
- Executes dropped EXE
PID:1584 -
\??\c:\vjjjv.exec:\vjjjv.exe65⤵
- Executes dropped EXE
PID:4092 -
\??\c:\1vvvj.exec:\1vvvj.exe66⤵PID:5008
-
\??\c:\rxrlfff.exec:\rxrlfff.exe67⤵
- System Location Discovery: System Language Discovery
PID:3016 -
\??\c:\3ffxllf.exec:\3ffxllf.exe68⤵PID:3588
-
\??\c:\tnhhbb.exec:\tnhhbb.exe69⤵
- System Location Discovery: System Language Discovery
PID:4948 -
\??\c:\lxxrfff.exec:\lxxrfff.exe70⤵PID:4428
-
\??\c:\tnhbtb.exec:\tnhbtb.exe71⤵
- System Location Discovery: System Language Discovery
PID:4592 -
\??\c:\nhnhtt.exec:\nhnhtt.exe72⤵PID:4680
-
\??\c:\9vdvj.exec:\9vdvj.exe73⤵PID:5020
-
\??\c:\jdpjj.exec:\jdpjj.exe74⤵PID:4540
-
\??\c:\flxlxlf.exec:\flxlxlf.exe75⤵PID:4796
-
\??\c:\hbtnbb.exec:\hbtnbb.exe76⤵PID:2036
-
\??\c:\bthtbh.exec:\bthtbh.exe77⤵PID:4684
-
\??\c:\ppppd.exec:\ppppd.exe78⤵PID:4336
-
\??\c:\xllfxxr.exec:\xllfxxr.exe79⤵PID:1796
-
\??\c:\7flxxrx.exec:\7flxxrx.exe80⤵PID:3500
-
\??\c:\hhbbtt.exec:\hhbbtt.exe81⤵PID:1864
-
\??\c:\ttnnnn.exec:\ttnnnn.exe82⤵PID:404
-
\??\c:\vjjdp.exec:\vjjdp.exe83⤵PID:368
-
\??\c:\ffrlxrl.exec:\ffrlxrl.exe84⤵PID:3688
-
\??\c:\fflrlrl.exec:\fflrlrl.exe85⤵PID:4108
-
\??\c:\hbttnn.exec:\hbttnn.exe86⤵PID:4300
-
\??\c:\hthhbn.exec:\hthhbn.exe87⤵PID:3596
-
\??\c:\ddvpj.exec:\ddvpj.exe88⤵PID:536
-
\??\c:\3pvjd.exec:\3pvjd.exe89⤵PID:4860
-
\??\c:\xlrxxlr.exec:\xlrxxlr.exe90⤵PID:1916
-
\??\c:\nhhbtn.exec:\nhhbtn.exe91⤵PID:4156
-
\??\c:\5bbthh.exec:\5bbthh.exe92⤵PID:1900
-
\??\c:\3jjdv.exec:\3jjdv.exe93⤵PID:2724
-
\??\c:\vjjdv.exec:\vjjdv.exe94⤵PID:2244
-
\??\c:\lxrlfff.exec:\lxrlfff.exe95⤵PID:4576
-
\??\c:\fllxrlx.exec:\fllxrlx.exe96⤵PID:1408
-
\??\c:\nhbhtt.exec:\nhbhtt.exe97⤵PID:2940
-
\??\c:\jdpvp.exec:\jdpvp.exe98⤵PID:2192
-
\??\c:\vvddv.exec:\vvddv.exe99⤵PID:4064
-
\??\c:\3llfrrf.exec:\3llfrrf.exe100⤵PID:3544
-
\??\c:\rffrlff.exec:\rffrlff.exe101⤵PID:3048
-
\??\c:\htbtnn.exec:\htbtnn.exe102⤵PID:1064
-
\??\c:\httnnn.exec:\httnnn.exe103⤵PID:4248
-
\??\c:\7jvvj.exec:\7jvvj.exe104⤵PID:396
-
\??\c:\dpppj.exec:\dpppj.exe105⤵PID:4136
-
\??\c:\xlfrxrl.exec:\xlfrxrl.exe106⤵PID:4468
-
\??\c:\xffxrrl.exec:\xffxrrl.exe107⤵PID:1572
-
\??\c:\9nnhbb.exec:\9nnhbb.exe108⤵PID:3180
-
\??\c:\bthbtt.exec:\bthbtt.exe109⤵PID:2404
-
\??\c:\dddvj.exec:\dddvj.exe110⤵PID:4816
-
\??\c:\fxffrrl.exec:\fxffrrl.exe111⤵PID:3560
-
\??\c:\xflfxxr.exec:\xflfxxr.exe112⤵PID:2280
-
\??\c:\bhnhbb.exec:\bhnhbb.exe113⤵
- System Location Discovery: System Language Discovery
PID:3416 -
\??\c:\bnttnh.exec:\bnttnh.exe114⤵PID:2740
-
\??\c:\vpvdd.exec:\vpvdd.exe115⤵PID:3028
-
\??\c:\3jdpv.exec:\3jdpv.exe116⤵PID:5112
-
\??\c:\xrllxrl.exec:\xrllxrl.exe117⤵PID:2680
-
\??\c:\thhbth.exec:\thhbth.exe118⤵PID:3032
-
\??\c:\hhhbtt.exec:\hhhbtt.exe119⤵PID:4164
-
\??\c:\dvppd.exec:\dvppd.exe120⤵PID:4756
-
\??\c:\nttntt.exec:\nttntt.exe121⤵PID:3064
-
\??\c:\ntbnbb.exec:\ntbnbb.exe122⤵PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-