Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 16:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95e5e7252e514e09e8cab9176aba15e4_JaffaCakes118.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
95e5e7252e514e09e8cab9176aba15e4_JaffaCakes118.exe
-
Size
118KB
-
MD5
95e5e7252e514e09e8cab9176aba15e4
-
SHA1
d24cb4ec7f0541666762ec5fe615e71762835d0d
-
SHA256
f07a75273ae0cff187739b5d3f603997316eca4edaefbbe714289ead3354992e
-
SHA512
6d614a6abb4a8145d8a588be05df38d49abdfaccbbff6834133674098421825e5b2892e4a6679a6ef3d0860c6d6e313f4c810059b25de1fa0694c561b5257f4a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp9EarSAcUeFN+D:ymb3NkkiQ3mdBjFo73tvn+Yp9WT6jzP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/5052-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/364-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2488-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2248 rrrrllf.exe 2392 jpvvj.exe 2848 7vdpv.exe 3220 bnbnhb.exe 844 pvdvp.exe 4324 lxllxrf.exe 2640 djjvp.exe 1108 llllxrl.exe 4724 thbtnh.exe 2384 vdjjd.exe 364 rlrlrlr.exe 1768 xrrlffx.exe 4704 nbbnhh.exe 3068 pjpdp.exe 4232 rxrlfxr.exe 4488 9bnnhh.exe 4788 5jjdj.exe 2008 xxlfllf.exe 4872 7lfxrlx.exe 2412 bbbbtt.exe 2768 7ppjj.exe 3492 rllffxr.exe 3388 xlxrffr.exe 2488 jvvjd.exe 4792 fxfxfrl.exe 636 thhhbn.exe 4460 jddpp.exe 4696 dppvp.exe 1696 3xxxrlf.exe 4020 tnnnhh.exe 372 vdddd.exe 380 frxrrrl.exe 1516 tbbtnh.exe 5096 vpvpd.exe 3228 xlrlffx.exe 3088 7btnbb.exe 1632 bbbtnn.exe 2696 rflrfff.exe 4396 5rlfflx.exe 3940 jpjdv.exe 1624 lrxrlfx.exe 2796 thhbnh.exe 428 ttnnhh.exe 3944 vppjv.exe 4316 frrfrrl.exe 3424 tnnbht.exe 1144 7jjpj.exe 1520 3xxxrxr.exe 3888 xrllffx.exe 4324 hbtbth.exe 4876 7bhbnh.exe 3136 9pvvv.exe 4592 fxrlffx.exe 4628 xrrrrll.exe 4724 hhhbtt.exe 5008 ppjdv.exe 4456 lrlfxrl.exe 1092 rxrrffx.exe 4132 vjjpp.exe 4880 rflfllf.exe 3936 rrrfxrl.exe 4488 tnttbh.exe 4788 vjjdp.exe 4000 fxxrllr.exe -
resource yara_rule behavioral2/memory/5052-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/364-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2488-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4696-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llfxlf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5052 wrote to memory of 2248 5052 95e5e7252e514e09e8cab9176aba15e4_JaffaCakes118.exe 83 PID 5052 wrote to memory of 2248 5052 95e5e7252e514e09e8cab9176aba15e4_JaffaCakes118.exe 83 PID 5052 wrote to memory of 2248 5052 95e5e7252e514e09e8cab9176aba15e4_JaffaCakes118.exe 83 PID 2248 wrote to memory of 2392 2248 rrrrllf.exe 84 PID 2248 wrote to memory of 2392 2248 rrrrllf.exe 84 PID 2248 wrote to memory of 2392 2248 rrrrllf.exe 84 PID 2392 wrote to memory of 2848 2392 jpvvj.exe 85 PID 2392 wrote to memory of 2848 2392 jpvvj.exe 85 PID 2392 wrote to memory of 2848 2392 jpvvj.exe 85 PID 2848 wrote to memory of 3220 2848 7vdpv.exe 86 PID 2848 wrote to memory of 3220 2848 7vdpv.exe 86 PID 2848 wrote to memory of 3220 2848 7vdpv.exe 86 PID 3220 wrote to memory of 844 3220 bnbnhb.exe 87 PID 3220 wrote to memory of 844 3220 bnbnhb.exe 87 PID 3220 wrote to memory of 844 3220 bnbnhb.exe 87 PID 844 wrote to memory of 4324 844 pvdvp.exe 88 PID 844 wrote to memory of 4324 844 pvdvp.exe 88 PID 844 wrote to memory of 4324 844 pvdvp.exe 88 PID 4324 wrote to memory of 2640 4324 lxllxrf.exe 89 PID 4324 wrote to memory of 2640 4324 lxllxrf.exe 89 PID 4324 wrote to memory of 2640 4324 lxllxrf.exe 89 PID 2640 wrote to memory of 1108 2640 djjvp.exe 90 PID 2640 wrote to memory of 1108 2640 djjvp.exe 90 PID 2640 wrote to memory of 1108 2640 djjvp.exe 90 PID 1108 wrote to memory of 4724 1108 llllxrl.exe 91 PID 1108 wrote to memory of 4724 1108 llllxrl.exe 91 PID 1108 wrote to memory of 4724 1108 llllxrl.exe 91 PID 4724 wrote to memory of 2384 4724 thbtnh.exe 92 PID 4724 wrote to memory of 2384 4724 thbtnh.exe 92 PID 4724 wrote to memory of 2384 4724 thbtnh.exe 92 PID 2384 wrote to memory of 364 2384 vdjjd.exe 93 PID 2384 wrote to memory of 364 2384 vdjjd.exe 93 PID 2384 wrote to memory of 364 2384 vdjjd.exe 93 PID 364 wrote to memory of 1768 364 rlrlrlr.exe 94 PID 364 wrote to memory of 1768 364 rlrlrlr.exe 94 PID 364 wrote to memory of 1768 364 rlrlrlr.exe 94 PID 1768 wrote to memory of 4704 1768 xrrlffx.exe 95 PID 1768 wrote to memory of 4704 1768 xrrlffx.exe 95 PID 1768 wrote to memory of 4704 1768 xrrlffx.exe 95 PID 4704 wrote to memory of 3068 4704 nbbnhh.exe 96 PID 4704 wrote to memory of 3068 4704 nbbnhh.exe 96 PID 4704 wrote to memory of 3068 4704 nbbnhh.exe 96 PID 3068 wrote to memory of 4232 3068 pjpdp.exe 97 PID 3068 wrote to memory of 4232 3068 pjpdp.exe 97 PID 3068 wrote to memory of 4232 3068 pjpdp.exe 97 PID 4232 wrote to memory of 4488 4232 rxrlfxr.exe 98 PID 4232 wrote to memory of 4488 4232 rxrlfxr.exe 98 PID 4232 wrote to memory of 4488 4232 rxrlfxr.exe 98 PID 4488 wrote to memory of 4788 4488 9bnnhh.exe 99 PID 4488 wrote to memory of 4788 4488 9bnnhh.exe 99 PID 4488 wrote to memory of 4788 4488 9bnnhh.exe 99 PID 4788 wrote to memory of 2008 4788 5jjdj.exe 100 PID 4788 wrote to memory of 2008 4788 5jjdj.exe 100 PID 4788 wrote to memory of 2008 4788 5jjdj.exe 100 PID 2008 wrote to memory of 4872 2008 xxlfllf.exe 101 PID 2008 wrote to memory of 4872 2008 xxlfllf.exe 101 PID 2008 wrote to memory of 4872 2008 xxlfllf.exe 101 PID 4872 wrote to memory of 2412 4872 7lfxrlx.exe 102 PID 4872 wrote to memory of 2412 4872 7lfxrlx.exe 102 PID 4872 wrote to memory of 2412 4872 7lfxrlx.exe 102 PID 2412 wrote to memory of 2768 2412 bbbbtt.exe 103 PID 2412 wrote to memory of 2768 2412 bbbbtt.exe 103 PID 2412 wrote to memory of 2768 2412 bbbbtt.exe 103 PID 2768 wrote to memory of 3492 2768 7ppjj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\95e5e7252e514e09e8cab9176aba15e4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\95e5e7252e514e09e8cab9176aba15e4_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\rrrrllf.exec:\rrrrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\jpvvj.exec:\jpvvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\7vdpv.exec:\7vdpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\bnbnhb.exec:\bnbnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\pvdvp.exec:\pvdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\lxllxrf.exec:\lxllxrf.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\djjvp.exec:\djjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\llllxrl.exec:\llllxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\thbtnh.exec:\thbtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\vdjjd.exec:\vdjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\rlrlrlr.exec:\rlrlrlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\xrrlffx.exec:\xrrlffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\nbbnhh.exec:\nbbnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\pjpdp.exec:\pjpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\9bnnhh.exec:\9bnnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\5jjdj.exec:\5jjdj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\xxlfllf.exec:\xxlfllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\7lfxrlx.exec:\7lfxrlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\bbbbtt.exec:\bbbbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\7ppjj.exec:\7ppjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rllffxr.exec:\rllffxr.exe23⤵
- Executes dropped EXE
PID:3492 -
\??\c:\xlxrffr.exec:\xlxrffr.exe24⤵
- Executes dropped EXE
PID:3388 -
\??\c:\jvvjd.exec:\jvvjd.exe25⤵
- Executes dropped EXE
PID:2488 -
\??\c:\fxfxfrl.exec:\fxfxfrl.exe26⤵
- Executes dropped EXE
PID:4792 -
\??\c:\thhhbn.exec:\thhhbn.exe27⤵
- Executes dropped EXE
PID:636 -
\??\c:\jddpp.exec:\jddpp.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4460 -
\??\c:\dppvp.exec:\dppvp.exe29⤵
- Executes dropped EXE
PID:4696 -
\??\c:\3xxxrlf.exec:\3xxxrlf.exe30⤵
- Executes dropped EXE
PID:1696 -
\??\c:\tnnnhh.exec:\tnnnhh.exe31⤵
- Executes dropped EXE
PID:4020 -
\??\c:\vdddd.exec:\vdddd.exe32⤵
- Executes dropped EXE
PID:372 -
\??\c:\frxrrrl.exec:\frxrrrl.exe33⤵
- Executes dropped EXE
PID:380 -
\??\c:\tbbtnh.exec:\tbbtnh.exe34⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vpvpd.exec:\vpvpd.exe35⤵
- Executes dropped EXE
PID:5096 -
\??\c:\xlrlffx.exec:\xlrlffx.exe36⤵
- Executes dropped EXE
PID:3228 -
\??\c:\7btnbb.exec:\7btnbb.exe37⤵
- Executes dropped EXE
PID:3088 -
\??\c:\bbbtnn.exec:\bbbtnn.exe38⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rflrfff.exec:\rflrfff.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\5rlfflx.exec:\5rlfflx.exe40⤵
- Executes dropped EXE
PID:4396 -
\??\c:\jpjdv.exec:\jpjdv.exe41⤵
- Executes dropped EXE
PID:3940 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe42⤵
- Executes dropped EXE
PID:1624 -
\??\c:\thhbnh.exec:\thhbnh.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ttnnhh.exec:\ttnnhh.exe44⤵
- Executes dropped EXE
PID:428 -
\??\c:\vppjv.exec:\vppjv.exe45⤵
- Executes dropped EXE
PID:3944 -
\??\c:\frrfrrl.exec:\frrfrrl.exe46⤵
- Executes dropped EXE
PID:4316 -
\??\c:\tnnbht.exec:\tnnbht.exe47⤵
- Executes dropped EXE
PID:3424 -
\??\c:\7jjpj.exec:\7jjpj.exe48⤵
- Executes dropped EXE
PID:1144 -
\??\c:\3xxxrxr.exec:\3xxxrxr.exe49⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xrllffx.exec:\xrllffx.exe50⤵
- Executes dropped EXE
PID:3888 -
\??\c:\hbtbth.exec:\hbtbth.exe51⤵
- Executes dropped EXE
PID:4324 -
\??\c:\7bhbnh.exec:\7bhbnh.exe52⤵
- Executes dropped EXE
PID:4876 -
\??\c:\9pvvv.exec:\9pvvv.exe53⤵
- Executes dropped EXE
PID:3136 -
\??\c:\fxrlffx.exec:\fxrlffx.exe54⤵
- Executes dropped EXE
PID:4592 -
\??\c:\xrrrrll.exec:\xrrrrll.exe55⤵
- Executes dropped EXE
PID:4628 -
\??\c:\hhhbtt.exec:\hhhbtt.exe56⤵
- Executes dropped EXE
PID:4724 -
\??\c:\ppjdv.exec:\ppjdv.exe57⤵
- Executes dropped EXE
PID:5008 -
\??\c:\lrlfxrl.exec:\lrlfxrl.exe58⤵
- Executes dropped EXE
PID:4456 -
\??\c:\rxrrffx.exec:\rxrrffx.exe59⤵
- Executes dropped EXE
PID:1092 -
\??\c:\vjjpp.exec:\vjjpp.exe60⤵
- Executes dropped EXE
PID:4132 -
\??\c:\rflfllf.exec:\rflfllf.exe61⤵
- Executes dropped EXE
PID:4880 -
\??\c:\rrrfxrl.exec:\rrrfxrl.exe62⤵
- Executes dropped EXE
PID:3936 -
\??\c:\tnttbh.exec:\tnttbh.exe63⤵
- Executes dropped EXE
PID:4488 -
\??\c:\vjjdp.exec:\vjjdp.exe64⤵
- Executes dropped EXE
PID:4788 -
\??\c:\fxxrllr.exec:\fxxrllr.exe65⤵
- Executes dropped EXE
PID:4000 -
\??\c:\frlxlfx.exec:\frlxlfx.exe66⤵PID:2368
-
\??\c:\nnbbnh.exec:\nnbbnh.exe67⤵PID:3852
-
\??\c:\tntnbb.exec:\tntnbb.exe68⤵PID:2524
-
\??\c:\ppppj.exec:\ppppj.exe69⤵PID:2780
-
\??\c:\rxlllfx.exec:\rxlllfx.exe70⤵PID:992
-
\??\c:\thbtnn.exec:\thbtnn.exe71⤵PID:3832
-
\??\c:\9jjvp.exec:\9jjvp.exe72⤵PID:4400
-
\??\c:\jdjdj.exec:\jdjdj.exe73⤵PID:3640
-
\??\c:\frlxxrl.exec:\frlxxrl.exe74⤵PID:1880
-
\??\c:\btnbtn.exec:\btnbtn.exe75⤵PID:2480
-
\??\c:\7bhbnh.exec:\7bhbnh.exe76⤵PID:636
-
\??\c:\dvdjp.exec:\dvdjp.exe77⤵PID:444
-
\??\c:\pvvjv.exec:\pvvjv.exe78⤵PID:452
-
\??\c:\rlxxllf.exec:\rlxxllf.exe79⤵PID:2852
-
\??\c:\hbnhtt.exec:\hbnhtt.exe80⤵PID:812
-
\??\c:\ttbttn.exec:\ttbttn.exe81⤵PID:3972
-
\??\c:\vjpdp.exec:\vjpdp.exe82⤵PID:2024
-
\??\c:\fflfrrl.exec:\fflfrrl.exe83⤵PID:2760
-
\??\c:\pjppj.exec:\pjppj.exe84⤵PID:4128
-
\??\c:\ddjdd.exec:\ddjdd.exe85⤵PID:1876
-
\??\c:\xrrlfff.exec:\xrrlfff.exe86⤵PID:4884
-
\??\c:\hbbtnn.exec:\hbbtnn.exe87⤵PID:2100
-
\??\c:\htttnn.exec:\htttnn.exe88⤵PID:1712
-
\??\c:\ddvpj.exec:\ddvpj.exe89⤵PID:1068
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe90⤵PID:1604
-
\??\c:\xlllflf.exec:\xlllflf.exe91⤵PID:2888
-
\??\c:\hhnbhb.exec:\hhnbhb.exe92⤵PID:2248
-
\??\c:\jpjdp.exec:\jpjdp.exe93⤵PID:3532
-
\??\c:\pdvpd.exec:\pdvpd.exe94⤵PID:2136
-
\??\c:\ffrrlrl.exec:\ffrrlrl.exe95⤵PID:4596
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe96⤵PID:3424
-
\??\c:\hbbbnt.exec:\hbbbnt.exe97⤵PID:1520
-
\??\c:\ddvdv.exec:\ddvdv.exe98⤵PID:1972
-
\??\c:\ppjdv.exec:\ppjdv.exe99⤵PID:3620
-
\??\c:\5flfxrx.exec:\5flfxrx.exe100⤵PID:1804
-
\??\c:\9flfxrr.exec:\9flfxrr.exe101⤵PID:4724
-
\??\c:\bntnhh.exec:\bntnhh.exe102⤵PID:1968
-
\??\c:\jppdp.exec:\jppdp.exe103⤵PID:2000
-
\??\c:\9jpdj.exec:\9jpdj.exe104⤵PID:2196
-
\??\c:\9lrlxrr.exec:\9lrlxrr.exe105⤵PID:3068
-
\??\c:\btnhhb.exec:\btnhhb.exe106⤵PID:1948
-
\??\c:\pdvpd.exec:\pdvpd.exe107⤵PID:1080
-
\??\c:\pdpjp.exec:\pdpjp.exe108⤵PID:4804
-
\??\c:\llrlrrl.exec:\llrlrrl.exe109⤵PID:2156
-
\??\c:\ttbttt.exec:\ttbttt.exe110⤵PID:900
-
\??\c:\rlllxxr.exec:\rlllxxr.exe111⤵PID:3852
-
\??\c:\nttnhn.exec:\nttnhn.exe112⤵PID:2524
-
\??\c:\tnnbtt.exec:\tnnbtt.exe113⤵PID:4624
-
\??\c:\jvpjv.exec:\jvpjv.exe114⤵PID:2448
-
\??\c:\xllfxrl.exec:\xllfxrl.exe115⤵PID:2720
-
\??\c:\1xxxrll.exec:\1xxxrll.exe116⤵PID:1728
-
\??\c:\9hhbtn.exec:\9hhbtn.exe117⤵PID:4388
-
\??\c:\dpjdv.exec:\dpjdv.exe118⤵PID:2376
-
\??\c:\fxlfrrf.exec:\fxlfrrf.exe119⤵PID:5044
-
\??\c:\tnttnb.exec:\tnttnb.exe120⤵PID:2668
-
\??\c:\nbhbnt.exec:\nbhbnt.exe121⤵PID:3224
-
\??\c:\1pppj.exec:\1pppj.exe122⤵PID:452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-