blackmoon | d3aac967e193e42daab4880df34918c94445378882bd983b5eaafa3149e4abb3

Analysis

max time kernel
59s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
d3aac967e193e42daab4880df34918c94445378882bd983b5eaafa3149e4abb3.exe
Size 60KB
Sample240607-jpwlhaea48
SHA256 d3aac967e193e42daab4880df34918c94445378882bd983b5eaafa3149e4abb3
MD5 df7e5bafe9f57a106b6adfdb4e1264e0
SHA1 3fcb0ef102e2c69b5509b1723812681687c5a91f
SHA512 a8076d9ff21bdffd3ab8204434f31de28ae278aaf7a6d38836ada3ce245815cac31c5a850e1babf009dfd5815c28362f353e0ba08becab1a16ff5470b84a175b
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJ0:ymb3NkkiQ3mdBjFIvlqq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackmoon banker trojan upx

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 6 IoCs

resource	yara_rule
behavioral2/memory/1620-4-0x0000000000400000-0x0000000000429000-memory.dmp	family_blackmoon
behavioral2/memory/3944-17-0x0000000000400000-0x0000000000429000-memory.dmp	family_blackmoon
behavioral2/memory/1968-69-0x0000000000400000-0x0000000000429000-memory.dmp	family_blackmoon
behavioral2/memory/2096-77-0x0000000000400000-0x0000000000429000-memory.dmp	family_blackmoon
behavioral2/memory/4040-147-0x0000000000400000-0x0000000000429000-memory.dmp	family_blackmoon
behavioral2/memory/2216-153-0x0000000000400000-0x0000000000429000-memory.dmp	family_blackmoon

UPX dump on OEP (original entry point) 8 IoCs

resource	yara_rule
behavioral2/memory/1620-4-0x0000000000400000-0x0000000000429000-memory.dmp	UPX
behavioral2/memory/3944-10-0x0000000000400000-0x0000000000429000-memory.dmp	UPX
behavioral2/memory/3944-17-0x0000000000400000-0x0000000000429000-memory.dmp	UPX
behavioral2/memory/4008-52-0x0000000000400000-0x0000000000429000-memory.dmp	UPX
behavioral2/memory/1968-69-0x0000000000400000-0x0000000000429000-memory.dmp	UPX
behavioral2/memory/2096-77-0x0000000000400000-0x0000000000429000-memory.dmp	UPX
behavioral2/memory/4040-147-0x0000000000400000-0x0000000000429000-memory.dmp	UPX
behavioral2/memory/2216-153-0x0000000000400000-0x0000000000429000-memory.dmp	UPX

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1620-4-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/3944-10-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/3944-17-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/4008-52-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/1968-69-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/2096-77-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/4040-147-0x0000000000400000-0x0000000000429000-memory.dmp	upx
behavioral2/memory/2216-153-0x0000000000400000-0x0000000000429000-memory.dmp	upx

\??\c:\bhnbht.exe
c:\bhnbht.exe
1⤵
PID:1968

\??\c:\ttbhht.exe
c:\ttbhht.exe
1⤵
PID:4108

\??\c:\vpjdv.exe
c:\vpjdv.exe
1⤵
PID:4568

\??\c:\bnttnt.exe
c:\bnttnt.exe
1⤵
PID:3552
- \??\c:\jvjjp.exe
  c:\jvjjp.exe
  2⤵
  PID:4784
- - \??\c:\jjdvj.exe
    c:\jjdvj.exe
    3⤵
    PID:3112
  - - \??\c:\rlflfrl.exe
      c:\rlflfrl.exe
      4⤵
      PID:4716
    - - \??\c:\flxffrl.exe
        
        c:\flxffrl.exe
        5⤵
        
        PID:3908
      - \??\c:\bhbbnh.exe
        
        c:\bhbbnh.exe
        6⤵
        
        PID:4384
        
        \??\c:\vjddd.exe
        
        c:\vjddd.exe
        7⤵
        
        PID:1620
        
        \??\c:\bntbbt.exe
        
        c:\bntbbt.exe
        8⤵
        
        PID:4912
        
        \??\c:\ppvpd.exe
        
        c:\ppvpd.exe
        9⤵
        
        PID:1348

\??\c:\9hnhbh.exe
c:\9hnhbh.exe
1⤵
PID:4764

\??\c:\htbtnb.exe
c:\htbtnb.exe
1⤵
PID:4616

\??\c:\flxlllf.exe
c:\flxlllf.exe
1⤵
PID:4296

\??\c:\pdpjd.exe
c:\pdpjd.exe
1⤵
PID:836

\??\c:\bthbnh.exe
c:\bthbnh.exe
1⤵
PID:3616

\??\c:\1jvpv.exe
c:\1jvpv.exe
1⤵
PID:1100

\??\c:\1xllfff.exe
c:\1xllfff.exe
1⤵
PID:3336

\??\c:\nhntbh.exe
c:\nhntbh.exe
1⤵
PID:3120

\??\c:\7pdpp.exe
c:\7pdpp.exe
1⤵
PID:4940

\??\c:\thhhnn.exe
c:\thhhnn.exe
1⤵
PID:5008

\??\c:\lrfrrfl.exe
c:\lrfrrfl.exe
1⤵
PID:3920

\??\c:\dpjdv.exe
c:\dpjdv.exe
1⤵
PID:4008

\??\c:\pjvvj.exe
c:\pjvvj.exe
1⤵
PID:4968

\??\c:\bhhtnb.exe
c:\bhhtnb.exe
1⤵
PID:740

\??\c:\xlffxlf.exe
c:\xlffxlf.exe
1⤵
PID:3480

\??\c:\jpjjj.exe
c:\jpjjj.exe
1⤵
PID:4668

\??\c:\hhntnt.exe
c:\hhntnt.exe
1⤵
PID:3472

\??\c:\hhnhnh.exe
c:\hhnhnh.exe
1⤵
PID:836

\??\c:\lxxlxfx.exe
c:\lxxlxfx.exe
1⤵
PID:1496

\??\c:\hbtbhn.exe
c:\hbtbhn.exe
1⤵
PID:3708

\??\c:\rrxrfxl.exe
c:\rrxrfxl.exe
1⤵
PID:3724

\??\c:\vddjp.exe
c:\vddjp.exe
1⤵
PID:456
- \??\c:\3vjdd.exe
  c:\3vjdd.exe
  2⤵
  PID:2996
- - \??\c:\pjjjp.exe
    c:\pjjjp.exe
    3⤵
    PID:1160

\??\c:\lxlflrl.exe
c:\lxlflrl.exe
1⤵
PID:4364

\??\c:\3jpjj.exe
c:\3jpjj.exe
1⤵
PID:1100

\??\c:\frlrxfx.exe
c:\frlrxfx.exe
1⤵
PID:3936

\??\c:\djpjj.exe
c:\djpjj.exe
1⤵
PID:2712

\??\c:\rrfxfff.exe
c:\rrfxfff.exe
1⤵
PID:864

\??\c:\thhhnt.exe
c:\thhhnt.exe
1⤵
PID:4840

\??\c:\ppvvj.exe
c:\ppvvj.exe
1⤵
PID:2228

\??\c:\7hnhtt.exe
c:\7hnhtt.exe
1⤵
PID:3516

\??\c:\ddjdj.exe
c:\ddjdj.exe
1⤵
PID:1180

\??\c:\frfffff.exe
c:\frfffff.exe
1⤵
PID:2464

\??\c:\jdddp.exe
c:\jdddp.exe
1⤵
PID:4520
- \??\c:\vjjdp.exe
  c:\vjjdp.exe
  2⤵
  PID:2092
- - \??\c:\vpvpd.exe
    c:\vpvpd.exe
    3⤵
    PID:1468
  - - \??\c:\5xlfxll.exe
      c:\5xlfxll.exe
      4⤵
      PID:2160
    - - \??\c:\xxllfrx.exe
        
        c:\xxllfrx.exe
        5⤵
        
        PID:4268
      - \??\c:\ffrrrrx.exe
        
        c:\ffrrrrx.exe
        6⤵
        
        PID:3472
        
        \??\c:\tbbnbn.exe
        
        c:\tbbnbn.exe
        7⤵
        
        PID:5084
        
        \??\c:\bbntbh.exe
        
        c:\bbntbh.exe
        8⤵
        
        PID:392
        
        \??\c:\nhnnhh.exe
        
        c:\nhnnhh.exe
        9⤵
        
        PID:2432
        
        \??\c:\pjpjj.exe
        
        c:\pjpjj.exe
        10⤵
        
        PID:4052

\??\c:\rfxlfrl.exe
c:\rfxlfrl.exe
1⤵
PID:2004

\??\c:\xffrrrx.exe
c:\xffrrrx.exe
1⤵
PID:3536

\??\c:\dvvvd.exe
c:\dvvvd.exe
1⤵
PID:3420

\??\c:\rllfrrl.exe
c:\rllfrrl.exe
1⤵
PID:4500

\??\c:\rxfxlfx.exe
c:\rxfxlfx.exe
1⤵
PID:3168

\??\c:\ntnhhh.exe
c:\ntnhhh.exe
1⤵
PID:3532

\??\c:\ntnbbb.exe
c:\ntnbbb.exe
1⤵
PID:3272

\??\c:\tthnth.exe
c:\tthnth.exe
1⤵
PID:1516

\??\c:\ddvpj.exe
c:\ddvpj.exe
1⤵
PID:3332

\??\c:\bhbhbh.exe
c:\bhbhbh.exe
1⤵
PID:428

\??\c:\pvddd.exe
c:\pvddd.exe
1⤵
PID:4424

\??\c:\pdjdd.exe
c:\pdjdd.exe
1⤵
PID:4812

\??\c:\fffrxfx.exe
c:\fffrxfx.exe
1⤵
PID:4672

\??\c:\jdppj.exe
c:\jdppj.exe
1⤵
PID:2316

\??\c:\nbntbn.exe
c:\nbntbn.exe
1⤵
PID:1808

\??\c:\5jppj.exe
c:\5jppj.exe
1⤵
PID:2724

\??\c:\bnnhhh.exe
c:\bnnhhh.exe
1⤵
PID:4812
- \??\c:\dpvvj.exe
  c:\dpvvj.exe
  2⤵
  PID:2972

\??\c:\rlxlxfl.exe
c:\rlxlxfl.exe
1⤵
PID:3164

\??\c:\nttnhh.exe
c:\nttnhh.exe
1⤵
PID:5048

\??\c:\ffrrxll.exe
c:\ffrrxll.exe
1⤵
PID:3120

\??\c:\flrxlxx.exe
c:\flrxlxx.exe
1⤵
PID:4392

\??\c:\ntnbtt.exe
c:\ntnbtt.exe
1⤵
PID:3896

\??\c:\hhttnt.exe
c:\hhttnt.exe
1⤵
PID:3560

\??\c:\frlrlrf.exe
c:\frlrlrf.exe
1⤵
PID:4272

\??\c:\rrlllrr.exe
c:\rrlllrr.exe
1⤵
PID:3044

\??\c:\nbhnhh.exe
c:\nbhnhh.exe
1⤵
PID:3440

\??\c:\vpdvv.exe
c:\vpdvv.exe
1⤵
PID:584

\??\c:\7jvvp.exe
c:\7jvvp.exe
1⤵
PID:3688

\??\c:\rxlrrff.exe
c:\rxlrrff.exe
1⤵
PID:5064

\??\c:\hbbtnn.exe
c:\hbbtnn.exe
1⤵
PID:3740

\??\c:\jvjdv.exe
c:\jvjdv.exe
1⤵
PID:4152

\??\c:\jvjdd.exe
c:\jvjdd.exe
1⤵
PID:5016

\??\c:\jdjpv.exe
c:\jdjpv.exe
1⤵
PID:1500

\??\c:\hthttt.exe
c:\hthttt.exe
1⤵
PID:1180

\??\c:\frxrrfx.exe
c:\frxrrfx.exe
1⤵
PID:4400

\??\c:\nbnntt.exe
c:\nbnntt.exe
1⤵
PID:2028

\??\c:\pvdvp.exe
c:\pvdvp.exe
1⤵
PID:5008
- \??\c:\dpvvv.exe
  c:\dpvvv.exe
  2⤵
  PID:2912

\??\c:\lflxlrf.exe
c:\lflxlrf.exe
1⤵
PID:4560

\??\c:\lffrrlr.exe
c:\lffrrlr.exe
1⤵
PID:4208

\??\c:\xrfffff.exe
c:\xrfffff.exe
1⤵
PID:3944

\??\c:\jvjvd.exe
c:\jvjvd.exe
1⤵
PID:2628

\??\c:\pvjjd.exe
c:\pvjjd.exe
1⤵
PID:2708

\??\c:\lrrrlll.exe
c:\lrrrlll.exe
1⤵
PID:2952

\??\c:\nhhbbh.exe
c:\nhhbbh.exe
1⤵
PID:1192

\??\c:\1rlfrll.exe
c:\1rlfrll.exe
1⤵
PID:3192

\??\c:\lxxrxff.exe
c:\lxxrxff.exe
1⤵
PID:2120

\??\c:\thtthh.exe
c:\thtthh.exe
1⤵
PID:4040

\??\c:\frxxrrr.exe
c:\frxxrrr.exe
1⤵
PID:4400

\??\c:\jdpjj.exe
c:\jdpjj.exe
1⤵
PID:2876

\??\c:\xlrlxxf.exe
c:\xlrlxxf.exe
1⤵
PID:3736

\??\c:\ttbnnh.exe
c:\ttbnnh.exe
1⤵
PID:224

\??\c:\flrfflx.exe
c:\flrfflx.exe
1⤵
PID:4988

\??\c:\dppjj.exe
c:\dppjj.exe
1⤵
PID:1384

\??\c:\pvpjd.exe
c:\pvpjd.exe
1⤵
PID:3388

\??\c:\jdppj.exe
c:\jdppj.exe
1⤵
PID:4460

\??\c:\rlrlffx.exe
c:\rlrlffx.exe
1⤵
PID:2972

\??\c:\fxxfrrr.exe
c:\fxxfrrr.exe
1⤵
PID:4900

\??\c:\bhbtbh.exe
c:\bhbtbh.exe
1⤵
PID:3996

\??\c:\jdjpv.exe
c:\jdjpv.exe
1⤵
PID:1968

\??\c:\jpjpd.exe
c:\jpjpd.exe
1⤵
PID:3972

\??\c:\ttbhnb.exe
c:\ttbhnb.exe
1⤵
PID:3024

\??\c:\lflffll.exe
c:\lflffll.exe
1⤵
PID:4676

\??\c:\xrflfxl.exe
c:\xrflfxl.exe
1⤵
PID:400

\??\c:\hnhbtn.exe
c:\hnhbtn.exe
1⤵
PID:428

\??\c:\hbhhtb.exe
c:\hbhhtb.exe
1⤵
PID:2820

\??\c:\nnttbh.exe
c:\nnttbh.exe
1⤵
PID:884

\??\c:\rrlrlfl.exe
c:\rrlrlfl.exe
1⤵
PID:2024

\??\c:\nththn.exe
c:\nththn.exe
1⤵
PID:1492

\??\c:\lffxffx.exe
c:\lffxffx.exe
1⤵
PID:3688

\??\c:\frxxllf.exe
c:\frxxllf.exe
1⤵
PID:3932

\??\c:\jjjjj.exe
c:\jjjjj.exe
1⤵
PID:632

\??\c:\bbtnhh.exe
c:\bbtnhh.exe
1⤵
PID:4316

\??\c:\frfxxlx.exe
c:\frfxxlx.exe
1⤵
PID:2632

\??\c:\flrlxxf.exe
c:\flrlxxf.exe
1⤵
PID:868

\??\c:\ttthbb.exe
c:\ttthbb.exe
1⤵
PID:5008

\??\c:\rxlfxlr.exe
c:\rxlfxlr.exe
1⤵
PID:2596

\??\c:\hnbtnn.exe
c:\hnbtnn.exe
1⤵
PID:3728

\??\c:\tttnbb.exe
c:\tttnbb.exe
1⤵
PID:4556

\??\c:\5flrfxf.exe
c:\5flrfxf.exe
1⤵
PID:3320

\??\c:\3jjpp.exe
c:\3jjpp.exe
1⤵
PID:1476

\??\c:\dvddv.exe
c:\dvddv.exe
1⤵
PID:3244

\??\c:\jjpvj.exe
c:\jjpvj.exe
1⤵
PID:776

\??\c:\xxrxlfx.exe
c:\xxrxlfx.exe
1⤵
PID:4024

\??\c:\jpjdp.exe
c:\jpjdp.exe
1⤵
PID:3272

\??\c:\djjdv.exe
c:\djjdv.exe
1⤵
PID:3688

\??\c:\7rllfll.exe
c:\7rllfll.exe
1⤵
PID:4392

\??\c:\rxrrlfl.exe
c:\rxrrlfl.exe
1⤵
PID:3476

\??\c:\vddvj.exe
c:\vddvj.exe
1⤵
PID:4716

\??\c:\rlxrlfx.exe
c:\rlxrlfx.exe
1⤵
PID:3700

\??\c:\tthbbb.exe
c:\tthbbb.exe
1⤵
PID:556

\??\c:\tnhbtt.exe
c:\tnhbtt.exe
1⤵
PID:1892

\??\c:\pjdvp.exe
c:\pjdvp.exe
1⤵
PID:4404

\??\c:\tbhhhn.exe
c:\tbhhhn.exe
1⤵
PID:2912

\??\c:\bttnnn.exe
c:\bttnnn.exe
1⤵
PID:4268

\??\c:\bhnnnn.exe
c:\bhnnnn.exe
1⤵
PID:5052

\??\c:\tbhtht.exe
c:\tbhtht.exe
1⤵
PID:3388

\??\c:\rxxffxr.exe
c:\rxxffxr.exe
1⤵
PID:4568

\??\c:\hbbbtb.exe
c:\hbbbtb.exe
1⤵
PID:1424

\??\c:\llxlrlr.exe
c:\llxlrlr.exe
1⤵
PID:3972

\??\c:\fxxrxfx.exe
c:\fxxrxfx.exe
1⤵
PID:1808

\??\c:\nhbbbt.exe
c:\nhbbbt.exe
1⤵
PID:2116

\??\c:\jdvpp.exe
c:\jdvpp.exe
1⤵
PID:2696

\??\c:\jdvpj.exe
c:\jdvpj.exe
1⤵
PID:632

\??\c:\pdpjv.exe
c:\pdpjv.exe
1⤵
PID:1252

\??\c:\xxrrlrl.exe
c:\xxrrlrl.exe
1⤵
PID:4556

\??\c:\vvvvv.exe
c:\vvvvv.exe
1⤵
PID:4712

\??\c:\jpjjj.exe
c:\jpjjj.exe
1⤵
PID:4840

\??\c:\nhntbt.exe
c:\nhntbt.exe
1⤵
PID:2704

\??\c:\lllxxll.exe
c:\lllxxll.exe
1⤵
PID:3944

\??\c:\xxrfxlr.exe
c:\xxrfxlr.exe
1⤵
PID:4052

\??\c:\jvvdj.exe
c:\jvvdj.exe
1⤵
PID:4372

\??\c:\xllflll.exe
c:\xllflll.exe
1⤵
PID:2200

\??\c:\vvddp.exe
c:\vvddp.exe
1⤵
PID:1008

\??\c:\xrxrllr.exe
c:\xrxrllr.exe
1⤵
PID:4188

\??\c:\vjddd.exe
c:\vjddd.exe
1⤵
PID:4904

\??\c:\bhbnnt.exe
c:\bhbnnt.exe
1⤵
PID:3724

\??\c:\rrrlllf.exe
c:\rrrlllf.exe
1⤵
PID:3848

\??\c:\llxrrll.exe
c:\llxrrll.exe
1⤵
PID:1060

\??\c:\jppdd.exe
c:\jppdd.exe
1⤵
PID:3344

\??\c:\hhtthb.exe
c:\hhtthb.exe
1⤵
PID:1124

\??\c:\vvpjd.exe
c:\vvpjd.exe
1⤵
PID:4332

\??\c:\pjjjd.exe
c:\pjjjd.exe
1⤵
PID:4556

\??\c:\vvvpv.exe
c:\vvvpv.exe
1⤵
PID:4116

\??\c:\dpjdp.exe
c:\dpjdp.exe
1⤵
PID:2392

\??\c:\lrllxrr.exe
c:\lrllxrr.exe
1⤵
PID:3172

\??\c:\dvdvp.exe
c:\dvdvp.exe
1⤵
PID:3936

\??\c:\xffrlrr.exe
c:\xffrlrr.exe
1⤵
PID:516

\??\c:\rflflfx.exe
c:\rflflfx.exe
1⤵
PID:1392

\??\c:\ppjvj.exe
c:\ppjvj.exe
1⤵
PID:756

\??\c:\fxllxxf.exe
c:\fxllxxf.exe
1⤵
PID:1348

\??\c:\3nnnbb.exe
c:\3nnnbb.exe
1⤵
PID:3388

\??\c:\jpjdj.exe
c:\jpjdj.exe
1⤵
PID:4652

\??\c:\tttbbb.exe
c:\tttbbb.exe
1⤵
PID:2408

\??\c:\ppdpd.exe
c:\ppdpd.exe
1⤵
PID:2512

\??\c:\dvpdp.exe
c:\dvpdp.exe
1⤵
PID:4504

\??\c:\lxfxlrf.exe
c:\lxfxlrf.exe
1⤵
PID:4120

\??\c:\pppdd.exe
c:\pppdd.exe
1⤵
PID:3676

\??\c:\dpvvd.exe
c:\dpvvd.exe
1⤵
PID:404

\??\c:\rxxrfxr.exe
c:\rxxrfxr.exe
1⤵
PID:4812

\??\c:\vdjdv.exe
c:\vdjdv.exe
1⤵
PID:2600

\??\c:\ppdvp.exe
c:\ppdvp.exe
1⤵
PID:5028

\??\c:\djdpd.exe
c:\djdpd.exe
1⤵
PID:2408

\??\c:\xxrrllr.exe
c:\xxrrllr.exe
1⤵
PID:2724

\??\c:\btbbtt.exe
c:\btbbtt.exe
1⤵
PID:3492

\??\c:\jjpjj.exe
c:\jjpjj.exe
1⤵
PID:3936

\??\c:\lxxrlrl.exe
c:\lxxrlrl.exe
1⤵
PID:3440

\??\c:\hbhbhh.exe
c:\hbhbhh.exe
1⤵
PID:2912

\??\c:\jdpvj.exe
c:\jdpvj.exe
1⤵
PID:3036

\??\c:\jpdpv.exe
c:\jpdpv.exe
1⤵
PID:1612

\??\c:\pjjjj.exe
c:\pjjjj.exe
1⤵
PID:2572

\??\c:\lfrrxlx.exe
c:\lfrrxlx.exe
1⤵
PID:2284

\??\c:\nbtttn.exe
c:\nbtttn.exe
1⤵
PID:3300

\??\c:\lxrlxxr.exe
c:\lxrlxxr.exe
1⤵
PID:1504

\??\c:\rlrfxxr.exe
c:\rlrfxxr.exe
1⤵
PID:1180

\??\c:\tnntnt.exe
c:\tnntnt.exe
1⤵
PID:4352

\??\c:\rxxxxxx.exe
c:\rxxxxxx.exe
1⤵
PID:1160

\??\c:\xllffxx.exe
c:\xllffxx.exe
1⤵
PID:3932

\??\c:\ppjjv.exe
c:\ppjjv.exe
1⤵
PID:1928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

jjvjv.exe

Path C:\jjvjv.exe
Size 61KB
SHA256 59386682d036374a60fcf733c7d65b3fd0efbb96d05a40d819ea555a551ba857
MD5 b3a11d87821a8c74fd24cbc214937819
SHA1 59039d5b5e0c63d9409864323a08d0b48274c3f3
SHA512 77205486c918c144e3806302eba9530eeee3f9bf24487a6e21f424714d05b292a162141b3f9eedec2f003b66247d5ec97b573204771040c1f0b467cc3634334b
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJE:ymb3NkkiQ3mdBjFIvlqG
MD5 SHA1 SHA512 SSDEEP

Submit Download

tttttn.exe

Path C:\tttttn.exe
Size 61KB
SHA256 0151a0ec9682aa4cac6396ca22959c1bc294cf87676a620b2265daa682e401af
MD5 7fb43cf22b6100fc4ec760ca9f84517a
SHA1 00e3ef8091e5659006c4e69bed2483bcacb59ba9
SHA512 7798dfc3b67fd74bc6cf4aaa5ecb753b05913705573200ee34657ef83b67889981b937716f5d2918a4e981083fd4c5ce251cb28021e2bc9c89f4cae5679c97e1
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJK:ymb3NkkiQ3mdBjFIvlqU
MD5 SHA1 SHA512 SSDEEP

Submit Download

5nnnnh.exe

Path \??\c:\5nnnnh.exe
Size 60KB
SHA256 6fa35bcb84636e4ec543eb07b19c3733dacb0c39743bf1f4cbb88ce1601bd459
MD5 fced8327012c58c54540a52b21961fdb
SHA1 1b2d39e59fa782622ff394a28c9c58109d225040
SHA512 7d1cd8844ad4d26688dda9e26ead210bf9c60fd5ffd80479cea5f6ade5a41ad6a525ab18b022878db757c8544e3989bf82f554a48ce8b3e060579e222c19d013
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJI:ymb3NkkiQ3mdBjFIvlqG
MD5 SHA1 SHA512 SSDEEP

Submit Download

dddvj.exe

Path \??\c:\dddvj.exe
Size 61KB
SHA256 a1519b0a00302c0bbc314c4314f36662a9955da7b518962d59a94b8d47cd4756
MD5 a6d1f10554e1fd080effb8d8bb466dd1
SHA1 f741ca5a69a9ff10d0a8e776ab3308014d9ba2dc
SHA512 6a8b7ea17a6b0f2505931b1cfe36eb1ae04127073dcb8775403c9efa67082968f76ef3b05ac61625858904884417c5f8d92c640f58b8103c405369060e0416fb
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJG:ymb3NkkiQ3mdBjFIvlqU
MD5 SHA1 SHA512 SSDEEP

Submit Download

djjjj.exe

Path \??\c:\djjjj.exe
Size 60KB
SHA256 b8df7f57601a11f5939b9a050e8119be7761518bf270901f00a73afd1c7e8726
MD5 1755667036c5fe6368992df539e59940
SHA1 1f41f00a3651007a87341a73f05eef817eb4ed31
SHA512 10044c0f66e8eb7ed2e2f3d92cb22028d8ecb39cc8ef336955de73afac4dca23f71f2e035c942ec8bb4238e73ce30744dc594d28e6d5242d870aaa9e589f9206
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJI:ymb3NkkiQ3mdBjFIvlqC
MD5 SHA1 SHA512 SSDEEP

Submit Download

dpvjp.exe

Path \??\c:\dpvjp.exe
Size 60KB
SHA256 b4f91218665d87e2b6f3eeba1d574552a405f2c9ba1608ff330690555ee87a6e
MD5 482f817b82f39e1d122eeec8905f5ec3
SHA1 e6342e4fb1ca041948c1a23a9eb355778b5ee5ff
SHA512 e543b10c2ae878152d4589c59ea340ae31ddd7d7dc048bf11fa2d65368a35a2042ed1441b2f7086c1fd9f81ddf2ff3315a3461b378af9bc358d71f74264891c1
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJE:ymb3NkkiQ3mdBjFIvlq+
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvvpp.exe

Path \??\c:\dvvpp.exe
Size 60KB
SHA256 5712cb990f3116a0f33772926c45f145c428ca135108e45fcdd4f61f18dcf578
MD5 9266accf25650ff191a5cdddd5319508
SHA1 cd6776604c69a93119d8e61a6f5a098b26b59e65
SHA512 2620a4151d370ea42c87b32cb5e54a6075b253964a5545aaa5349323f6e52eabf4bd8ab3b6c9b0ed33f86693b702d3a1a85a2de93f28da82d95ba1fb7202ce54
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJe:ymb3NkkiQ3mdBjFIvlqc
MD5 SHA1 SHA512 SSDEEP

Submit Download

dvvvp.exe

Path \??\c:\dvvvp.exe
Size 60KB
SHA256 1edcc86eaec2e87d34e60966dc9b0459562a6eb89700434499bc0912ad1f93f7
MD5 bb03e8e1e7b60c1c9533c4dbf71cfbad
SHA1 c07f6bb950e280ea78d0bb639aa1b84fa598a26d
SHA512 9a97d9178441c1a42c1bdda35ebad2441394435c67b48f93c4f949ebe51ceea3048013887140cacff53e7c1987c91a93dae464a7e4700a8ce367f254c9d31335
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJE:ymb3NkkiQ3mdBjFIvlqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

frfrrfx.exe

Path \??\c:\frfrrfx.exe
Size 60KB
SHA256 0fcfd3238c431465980a3b21d7ba365068ba8bb3c5926e6e0b0f1ca1588896ea
MD5 25120b1338fd436f73e69453f7db43a8
SHA1 9a2171ad281daa375a3f81440d76bd8966a55a79
SHA512 7c68fd5ac3c6f1308990e49e10b4840f75c34fbd5ec96868529a3e98a1b43c1cc33fc36eb3bfc1c1087ed0c7ac282823661ed97d698c3a092e1c29390371ad07
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJ0:ymb3NkkiQ3mdBjFIvlqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

jvjdj.exe

Path \??\c:\jvjdj.exe
Size 61KB
SHA256 322f416ca27c54d79b5d6eb940bbbf9ef7f33855977e9858313801c3873c7556
MD5 b7b93ce51b6c2ff4129286b94fe2a96e
SHA1 01189cf2143892c4b16f39487557b26190fa7cd9
SHA512 fc193fcb3a598ea1ab4e3b9c445514132d1842a2421beaf3f29e868fefd2174cb50c06852f3b3d0aabbea9354fc4f29536c8a339d8a691b484e7cae521f4ebbf
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJI:ymb3NkkiQ3mdBjFIvlq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

lfrxrxr.exe

Path \??\c:\lfrxrxr.exe
Size 60KB
SHA256 c4d924352028ccce91cd47871948d20cf9e807df8ef00eb7d12885316792d0b8
MD5 0a91942ab39e94bfc48c86b76d81d192
SHA1 70a205d7a6cd006e510f1675e18053cf40c11e7e
SHA512 a8669d21f4ccba4da6f05cf265e2c193cf86964df6d2a326a7cc74e88018dd53466cc534650aba76638f5c9c443aef2574032540d2da56d6c2cd1be37d3b5ccc
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJ2:ymb3NkkiQ3mdBjFIvlqA
MD5 SHA1 SHA512 SSDEEP

Submit Download

llffrfr.exe

Path \??\c:\llffrfr.exe
Size 60KB
SHA256 460f1a30f9b3338c5c2fe9423245b3d4f303ecaff7b51aa62ff8a5afaab43cfa
MD5 ce935f5837ab4e4c39fd4812c4f89282
SHA1 800d4a0aba7d0204ac71a9580d05e3ac2917b062
SHA512 a05c394dfaca18f74750924821ac4104848e4a74d0a0ee6ddd3429d579123491c4cd0d249d2518cc86a4dd5a98f2117c922526d9471f61fb26fcaa0645328fe2
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJ2:ymb3NkkiQ3mdBjFIvlqY
MD5 SHA1 SHA512 SSDEEP

Submit Download

lxllxfx.exe

Path \??\c:\lxllxfx.exe
Size 60KB
SHA256 314cb26c8b1bd490ab5ff08992715d6e85278c5b77adc4517f1bee7f5cd38450
MD5 d6b510c0cbde3de78b1aaf631d88b52f
SHA1 9bd5a45d75a23e252219e899f60bc15fdb134b8d
SHA512 c282c5c1cbad6e1b5df0ccaa7ef751e74ed654e89d459fbb17d6db6945d8d59e22668c17d5d3b24db08d25f606c59146f9a44e5f9aa152abdd5f2b223388ec9d
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJE:ymb3NkkiQ3mdBjFIvlqq
MD5 SHA1 SHA512 SSDEEP

Submit Download

nhnbhn.exe

Path \??\c:\nhnbhn.exe
Size 60KB
SHA256 ecc42bc81cb238ddb1ffae48128fe72012a54e758c91cfb8445dbdc9787ec9c4
MD5 8237852714d5539c9faade19c7bed3ad
SHA1 dc26404b4bce4d887275c7b5780f5c5f988aeb10
SHA512 da0ac1e97362d96a2195448883de399efcac537714a84f8052c2d0a8ed4072b64258e40ae4a95d73b340d8c2c723684aaf92777d08c99e27ed28437603ad2ebc
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJG:ymb3NkkiQ3mdBjFIvlq8
MD5 SHA1 SHA512 SSDEEP

Submit Download

ppjdd.exe

Path \??\c:\ppjdd.exe
Size 60KB
SHA256 594ad47bfe988be005def7a3856a7375e584738704798b34f51f31d53176ff31
MD5 371fc6cb3a52df84703b5b292991c689
SHA1 a0fc5cc612378a869ee6740f2acf345acc1434d0
SHA512 a4178b917327623460c710008041694dbfb2480bca63a3d06c950aa8cefda10a53f0f93a103b49f76a64ed0d4e61b75df50f8b28a16657087d42a507c337da73
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJ8:ymb3NkkiQ3mdBjFIvlqy
MD5 SHA1 SHA512 SSDEEP

Submit Download

rlfllff.exe

Path \??\c:\rlfllff.exe
Size 60KB
SHA256 eff043212f6353dbfed7cefa18d9076bcc4dbbf9968a14f9da1454c14fea1829
MD5 ba44a88769ba2e07bf0db9ead9c85d01
SHA1 35a7f8e619f8aafdb6432dbfe1ac9c0da0a3feba
SHA512 757de006002692621e0cc1425218b002f65d3de50c3547522305c5d0de70c7de0e32860871b8e286580036b003ba568510d73ab304703ae1ec92079e267ac0a1
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJY:ymb3NkkiQ3mdBjFIvlq6
MD5 SHA1 SHA512 SSDEEP

Submit Download

rrxxllr.exe

Path \??\c:\rrxxllr.exe
Size 61KB
SHA256 8b5d444476dd1090f911b9ac8bc9931b089d463e24273c38b6d2ef11ba5bedd0
MD5 2fa2014e2aac8c76158d1869882d08a0
SHA1 631fb5ec3386a83f4b99cb35a39b03378a82d6bd
SHA512 da4528b4bfef2caa535d40a05da4dcfaeac7d6f0ebaaafddcbd68f02537537efeb69436b5add3e848949795466c4b36fb77a3c1553f0dea60355a1d8e54f9ba7
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJY:ymb3NkkiQ3mdBjFIvlqW
MD5 SHA1 SHA512 SSDEEP

Submit Download

ttbhht.exe

Path \??\c:\ttbhht.exe
Size 60KB
SHA256 9142033ba22de1d3b8a45e04f7a7b56d6b219d2d39befb923171f5d6990a3f82
MD5 32a313facdb4eb1713c22435bbf50a80
SHA1 053e9ec9f6f5007018cf376ecc1e9602ebb8811c
SHA512 82a9aaf6452dbc0ce4bfbc2ffe181526ddc5dbad8427e228fe46088ffa940ace1674da7e4d1b6105e636a6f41aaaa1309555723d274e7e58ae06b0774104e6a4
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJE:ymb3NkkiQ3mdBjFIvlqK
MD5 SHA1 SHA512 SSDEEP

Submit Download

vpjdv.exe

Path \??\c:\vpjdv.exe
Size 60KB
SHA256 906bd9853707c427ad04cfe109c5ea4a8ad479d9301b55938c6685fc5df40847
MD5 853916cde6b2673f6a9c838c67e34d00
SHA1 3412e253b12de1b8a2660515abd826c49cbfd07d
SHA512 1214a3359d2f60ca17ac58d2357637159a20d9767d64f238aa2cf7d39483bf1a986bcf92d097c8c715b0ba73ad38334061c4bfa56ee660b34e2b08668ceb08de
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJG:ymb3NkkiQ3mdBjFIvlq0
MD5 SHA1 SHA512 SSDEEP

Submit Download

vpvpv.exe

Path \??\c:\vpvpv.exe
Size 60KB
SHA256 7a7a342b2f21628f858c46efc643abc3fa443abf1489175449ed2ec2411557a0
MD5 3cac99f6621bab371ca031dd17957778
SHA1 eae05d357cc8aac238d7c123595e7131cfc042b3
SHA512 5eeb4bad51d5d6a4c6792ed19ebc9b411862d489bd8277d0c724d6fa876292714bc380d17cbd24fca75adfc8288df1c980f2e45e85cd93b7e9c163a7e63612ed
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJM:ymb3NkkiQ3mdBjFIvlqm
MD5 SHA1 SHA512 SSDEEP

Submit Download

vvvvp.exe

Path \??\c:\vvvvp.exe
Size 60KB
SHA256 77715e5d9e69bf24688416abd68476a5da04aebec9228db06e2c919418ea4619
MD5 b6dcffc4bf0424cae7fc8fbd160dc960
SHA1 05ca743aba7fa8afba41ce87e19e087822244b27
SHA512 3243a45ed02f0aad94c8f86a8751416e23529822545f475fb3a45e1a93d7954cd6ed24fd4645084b802b68526d8a8fb5a55cc89919165f3664550303c1ea4e2a
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJg:ymb3NkkiQ3mdBjFIvlqu
MD5 SHA1 SHA512 SSDEEP

Submit Download

xxxrlll.exe

Path \??\c:\xxxrlll.exe
Size 60KB
SHA256 77d0e6875d33b2a6517b48a7008fff19e1ae25737483e0e814ec61478010d5da
MD5 666a5452927ca46ecdc6a67adc92804f
SHA1 6b6ccf5414c5c07bd10f5a24ca20da1e8998b7f9
SHA512 4bc4b776516709bc3d731ff65daf7c3b9e4e7acf4c9da34ba712c0131d765018c128e0afc0a1877445c20bbf89db73be5dc3f9bbd9edc4ecaae31a5846c724be
SSDEEP 1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk9UJU:ymb3NkkiQ3mdBjFIvlqO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1620-0-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1620-4-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/1968-69-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2096-77-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/2216-153-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3944-17-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/3944-10-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4008-52-0x0000000000400000-0x0000000000429000-memory.dmp

Download

memory/4040-147-0x0000000000400000-0x0000000000429000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads