Analysis
- max time kernel
22s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 22:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_346d17d09022bcd400de5e6a3839c9b8ec111a1f10f011279ba3871533e4879e.exe
Resource
win10v2004-20260911-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_346d17d09022bcd400de5e6a3839c9b8ec111a1f10f011279ba3871533e4879e.exe
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
General
- Target jaffacakes118_346d17d09022bcd400de5e6a3839c9b8ec111a1f10f011279ba3871533e4879e.exe
- Size 120KB
- Sample260924-2lwffatele
- SHA256 346d17d09022bcd400de5e6a3839c9b8ec111a1f10f011279ba3871533e4879e
- MD5 2384d770b8645b86af878fdc959a91c8
- SHA1 6642553c1de3baa29f940a5f7482d38b8ba3457f
- SHA512 ff4aed8cf190e92b1414e9de557331f1c7706934cffdfc060b56e5a40887ef217bbbc882502363fd9dfd4cf0e123e94baa186e6da38883afb7ebc759288cffd0
- SSDEEP 3072:1gPU353+MamS1PQU7vvVbvCEKC5tTBf996n7y:1gPES1PrbvVbaEX5tTBV96n7y
- TLSH T15AC37C0579C9CBF2CA60843989DE3F79C7F2F4384AA50963630DC92E6D35856D3632E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3652 RemoteComputer.exe 4764 RemoteComputer.exe 2396 RemoteComputer.exe 240 RemoteComputer.exe 4356 RemoteComputer.exe 2652 RemoteComputer.exe 1756 RemoteComputer.exe 3368 RemoteComputer.exe 3488 RemoteComputer.exe 5936 RemoteComputer.exe 3788 RemoteComputer.exe 6040 RemoteComputer.exe 1492 RemoteComputer.exe 4628 RemoteComputer.exe 3424 RemoteComputer.exe 5380 RemoteComputer.exe 5224 RemoteComputer.exe 1140 RemoteComputer.exe 4800 RemoteComputer.exe 1740 RemoteComputer.exe 2668 RemoteComputer.exe 1692 RemoteComputer.exe 5304 RemoteComputer.exe 1952 RemoteComputer.exe 5872 RemoteComputer.exe 3464 RemoteComputer.exe 3868 RemoteComputer.exe 3940 RemoteComputer.exe 2136 RemoteComputer.exe 4312 RemoteComputer.exe 3380 RemoteComputer.exe 4928 RemoteComputer.exe 1192 RemoteComputer.exe 1228 RemoteComputer.exe 2072 RemoteComputer.exe 4808 RemoteComputer.exe 5544 RemoteComputer.exe 5280 RemoteComputer.exe 5360 RemoteComputer.exe 5812 RemoteComputer.exe 2648 RemoteComputer.exe 3000 RemoteComputer.exe 5468 RemoteComputer.exe 3320 RemoteComputer.exe 840 RemoteComputer.exe 2460 RemoteComputer.exe 252 RemoteComputer.exe 4088 RemoteComputer.exe 2616 RemoteComputer.exe 260 RemoteComputer.exe 2376 RemoteComputer.exe 4532 RemoteComputer.exe 5840 RemoteComputer.exe 1520 RemoteComputer.exe 3452 RemoteComputer.exe 2868 RemoteComputer.exe 4568 RemoteComputer.exe 2980 RemoteComputer.exe 1404 RemoteComputer.exe 5260 RemoteComputer.exe 2832 RemoteComputer.exe 5600 RemoteComputer.exe 1104 RemoteComputer.exe 2312 RemoteComputer.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Remote Computer = "RemoteComputer.exe" RemoteComputer.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe File created C:\Windows\SysWOW64\RemoteComputer.exe RemoteComputer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RemoteComputer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3352 wrote to memory of 3652 3352 jaffacakes118_346d17d09022bcd400de5e6a3839c9b8ec111a1f10f011279ba3871533e4879e.exe 89 PID 3652 wrote to memory of 4764 3652 RemoteComputer.exe 90 PID 4764 wrote to memory of 2396 4764 RemoteComputer.exe 92 PID 2396 wrote to memory of 240 2396 RemoteComputer.exe 93 PID 240 wrote to memory of 4356 240 RemoteComputer.exe 94 PID 4356 wrote to memory of 2652 4356 RemoteComputer.exe 95 PID 2652 wrote to memory of 1756 2652 RemoteComputer.exe 96 PID 1756 wrote to memory of 3368 1756 RemoteComputer.exe 97 PID 3368 wrote to memory of 3488 3368 RemoteComputer.exe 98 PID 3488 wrote to memory of 5936 3488 RemoteComputer.exe 99 PID 5936 wrote to memory of 3788 5936 RemoteComputer.exe 100 PID 3788 wrote to memory of 6040 3788 RemoteComputer.exe 101 PID 6040 wrote to memory of 1492 6040 RemoteComputer.exe 102 PID 1492 wrote to memory of 4628 1492 RemoteComputer.exe 103 PID 4628 wrote to memory of 3424 4628 RemoteComputer.exe 104 PID 3424 wrote to memory of 5380 3424 RemoteComputer.exe 105 PID 5380 wrote to memory of 5224 5380 RemoteComputer.exe 106 PID 5224 wrote to memory of 1140 5224 RemoteComputer.exe 107 PID 1140 wrote to memory of 4800 1140 RemoteComputer.exe 108 PID 4800 wrote to memory of 1740 4800 RemoteComputer.exe 109 PID 1740 wrote to memory of 2668 1740 RemoteComputer.exe 110 PID 2668 wrote to memory of 1692 2668 RemoteComputer.exe 111 PID 1692 wrote to memory of 5304 1692 RemoteComputer.exe 112 PID 5304 wrote to memory of 1952 5304 RemoteComputer.exe 113 PID 1952 wrote to memory of 5872 1952 RemoteComputer.exe 114 PID 5872 wrote to memory of 3464 5872 RemoteComputer.exe 115 PID 3464 wrote to memory of 3868 3464 RemoteComputer.exe 116 PID 3868 wrote to memory of 3940 3868 RemoteComputer.exe 117 PID 3940 wrote to memory of 2136 3940 RemoteComputer.exe 118 PID 2136 wrote to memory of 4312 2136 RemoteComputer.exe 119 PID 4312 wrote to memory of 3380 4312 RemoteComputer.exe 120 PID 3380 wrote to memory of 4928 3380 RemoteComputer.exe 121 PID 4928 wrote to memory of 1192 4928 RemoteComputer.exe 122 PID 1192 wrote to memory of 1228 1192 RemoteComputer.exe 123 PID 1228 wrote to memory of 2072 1228 RemoteComputer.exe 124 PID 2072 wrote to memory of 4808 2072 RemoteComputer.exe 125 PID 4808 wrote to memory of 5544 4808 RemoteComputer.exe 126 PID 5544 wrote to memory of 5280 5544 RemoteComputer.exe 127 PID 5280 wrote to memory of 5360 5280 RemoteComputer.exe 128 PID 5360 wrote to memory of 5812 5360 RemoteComputer.exe 129 PID 5812 wrote to memory of 2648 5812 RemoteComputer.exe 130 PID 2648 wrote to memory of 3000 2648 RemoteComputer.exe 131 PID 3000 wrote to memory of 5468 3000 RemoteComputer.exe 132 PID 5468 wrote to memory of 3320 5468 RemoteComputer.exe 133 PID 3320 wrote to memory of 840 3320 RemoteComputer.exe 134 PID 840 wrote to memory of 2460 840 RemoteComputer.exe 135 PID 2460 wrote to memory of 252 2460 RemoteComputer.exe 136 PID 252 wrote to memory of 4088 252 RemoteComputer.exe 137 PID 4088 wrote to memory of 2616 4088 RemoteComputer.exe 138 PID 2616 wrote to memory of 260 2616 RemoteComputer.exe 139 PID 260 wrote to memory of 2376 260 RemoteComputer.exe 140 PID 2376 wrote to memory of 4532 2376 RemoteComputer.exe 141 PID 4532 wrote to memory of 5840 4532 RemoteComputer.exe 142 PID 5840 wrote to memory of 1520 5840 RemoteComputer.exe 143 PID 1520 wrote to memory of 3452 1520 RemoteComputer.exe 144 PID 3452 wrote to memory of 2868 3452 RemoteComputer.exe 145 PID 2868 wrote to memory of 4568 2868 RemoteComputer.exe 146 PID 4568 wrote to memory of 2980 4568 RemoteComputer.exe 147 PID 2980 wrote to memory of 1404 2980 RemoteComputer.exe 148 PID 1404 wrote to memory of 5260 1404 RemoteComputer.exe 149 PID 5260 wrote to memory of 2832 5260 RemoteComputer.exe 150 PID 2832 wrote to memory of 5600 2832 RemoteComputer.exe 151 PID 5600 wrote to memory of 1104 5600 RemoteComputer.exe 152 PID 1104 wrote to memory of 2312 1104 RemoteComputer.exe 153
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_346d17d09022bcd400de5e6a3839c9b8ec111a1f10f011279ba3871533e4879e.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_346d17d09022bcd400de5e6a3839c9b8ec111a1f10f011279ba3871533e4879e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"11⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5936 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"12⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"14⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"16⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"17⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5224 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"19⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"20⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"21⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"22⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5304 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"25⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"26⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5872 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"28⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"30⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"35⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"37⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"39⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5280 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"40⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5360 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"41⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"43⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"44⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"46⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:252 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"49⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"51⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"52⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"53⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"54⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5840 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"57⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"58⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"61⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5260 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"62⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"63⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"64⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"65⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2312 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"66⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5524 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"67⤵PID:3888
-
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"68⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1484 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"69⤵PID:1580
-
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"70⤵PID:5232
-
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"71⤵PID:5132
-
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"72⤵
- Adds Run key to start application
PID:5908 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"73⤵
- System Location Discovery: System Language Discovery
PID:5384 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"74⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:5912 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"75⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3544 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"76⤵
- System Location Discovery: System Language Discovery
PID:5200 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"77⤵
- Drops file in System32 directory
PID:5568 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"78⤵
- Adds Run key to start application
PID:2424 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"79⤵
- System Location Discovery: System Language Discovery
PID:2756 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"80⤵
- System Location Discovery: System Language Discovery
PID:1416 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"81⤵
- Adds Run key to start application
PID:2520 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"82⤵
- Adds Run key to start application
PID:3908 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"83⤵PID:4788
-
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"84⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:1556 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"85⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4736 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"86⤵
- Adds Run key to start application
PID:5320 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"87⤵
- Adds Run key to start application
PID:4708 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"88⤵PID:2320
-
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"89⤵PID:5368
-
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"90⤵
- Adds Run key to start application
PID:4108 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"91⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:3112 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"92⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"93⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:564 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"94⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3248 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"95⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:256 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"96⤵
- System Location Discovery: System Language Discovery
PID:6092 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"97⤵PID:2736
-
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"98⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:680 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"99⤵
- Adds Run key to start application
PID:3004 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"100⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:5092 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"101⤵
- Drops file in System32 directory
PID:5940 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"102⤵PID:5448
-
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"103⤵
- Adds Run key to start application
PID:5712 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"104⤵
- System Location Discovery: System Language Discovery
PID:5188 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"105⤵
- System Location Discovery: System Language Discovery
PID:4728 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"106⤵
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"107⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:964 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"108⤵
- System Location Discovery: System Language Discovery
PID:3092 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"109⤵
- Adds Run key to start application
PID:1040 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"110⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:2160 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"111⤵
- Drops file in System32 directory
PID:1620 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"112⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:6112 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"113⤵PID:1064
-
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"114⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4964 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"115⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:5824 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"116⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1764 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"117⤵
- System Location Discovery: System Language Discovery
PID:5520 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"118⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:5880 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"119⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:5604 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"120⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2212 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"121⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5204 -
C:\Windows\SysWOW64\RemoteComputer.exe"C:\Windows\system32\RemoteComputer.exe"122⤵PID:3420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-