Overview
overview
10Static
static
10Archive.zip
windows10-1703-x64
1Dropper/Berbew.exe
windows10-1703-x64
10Dropper/Phorphiex.exe
windows10-1703-x64
10out.exe
windows10-1703-x64
3RAT/31.exe
windows10-1703-x64
10RAT/XClient.exe
windows10-1703-x64
10RAT/file.exe
windows10-1703-x64
7Ransomware...-2.exe
windows10-1703-x64
10Ransomware...01.exe
windows10-1703-x64
10Ransomware...lt.exe
windows10-1703-x64
10Stealers/Azorult.exe
windows10-1703-x64
10Stealers/B...on.exe
windows10-1703-x64
10Stealers/Dridex.dll
windows10-1703-x64
10Stealers/M..._2.exe
windows10-1703-x64
10Stealers/lumma.exe
windows10-1703-x64
10Trojan/BetaBot.exe
windows10-1703-x64
10Trojan/Smo...er.exe
windows10-1703-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
02-09-2024 02:27
Behavioral task
behavioral1
Sample
Archive.zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win10-20240611-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
RAT/XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
RAT/file.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
Ransomware/Client-2.exe
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
Ransomware/criticalupdate01.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
Ransomware/default.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
Stealers/Azorult.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
Stealers/BlackMoon.exe
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
Stealers/Dridex.dll
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10-20240611-en
Behavioral task
behavioral15
Sample
Stealers/lumma.exe
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
Trojan/BetaBot.exe
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
Trojan/SmokeLoader.exe
Resource
win10-20240404-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral12/memory/1948-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/1948-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4672-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4948-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4308-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4308-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4596-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4404-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/3348-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/2992-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/212-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/2372-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4920-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4464-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/68-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4004-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4296-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/3500-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4912-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4940-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4492-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/2656-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4840-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/356-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/496-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4380-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/1640-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4564-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4580-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/304-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4672 djddv.exe 4948 ppvdd.exe 4308 dvdpj.exe 4596 pjjdv.exe 4404 llfxflr.exe 3348 bthbhh.exe 212 pvvdp.exe 2992 1rxlrll.exe 3312 bbhbbh.exe 2372 pjpjd.exe 4920 lffrlll.exe 4464 dppdp.exe 68 rlflrrx.exe 4004 1djdd.exe 4296 lrxfxxx.exe 3500 bnhhbt.exe 4912 vjjdd.exe 5040 ttbntn.exe 4940 dvjdd.exe 4492 xflxrrr.exe 2656 pvdvp.exe 4840 9rlrllf.exe 356 vpjpv.exe 496 xxlrlff.exe 4380 bttttt.exe 1640 ddpjp.exe 4564 9vjjj.exe 4580 tnnhhh.exe 1928 5dpjv.exe 4968 xfrfrlr.exe 304 hbnhhn.exe 4848 vjjjd.exe 2248 5lllrlr.exe 2164 hhhbbt.exe 4216 3rxrlrr.exe 2964 nhtntt.exe 3656 dpvvj.exe 2340 dpjpp.exe 3904 lfxlrfx.exe 3908 bbhnth.exe 4124 pvvpj.exe 4892 llllrfr.exe 1992 nnbhbh.exe 96 nhnnhb.exe 1220 jvdpd.exe 4308 rrfrffr.exe 1852 1thbtn.exe 640 nhhhhb.exe 4952 jpdjp.exe 220 fffrrlf.exe 4428 xrrrlfx.exe 4632 htthbh.exe 3532 jdddv.exe 2156 ffrrrrr.exe 3932 tnnttb.exe 4824 dddvj.exe 364 jvpdp.exe 2548 llfffxx.exe 1800 3hhbhb.exe 2136 nhthbb.exe 2628 jdvpj.exe 1864 xrxffxl.exe 3500 xfffxrl.exe 4912 bnnhbh.exe -
resource yara_rule behavioral12/memory/1948-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/1948-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4672-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4948-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4308-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4308-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4308-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4308-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4596-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4404-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/3348-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/2992-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/212-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/2372-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4920-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4464-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/68-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4004-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4296-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/3500-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4912-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4940-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4492-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/2656-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4840-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/356-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/496-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4380-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/1640-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4564-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4580-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/304-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lllrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1948 wrote to memory of 4672 1948 BlackMoon.exe 73 PID 1948 wrote to memory of 4672 1948 BlackMoon.exe 73 PID 1948 wrote to memory of 4672 1948 BlackMoon.exe 73 PID 4672 wrote to memory of 4948 4672 djddv.exe 74 PID 4672 wrote to memory of 4948 4672 djddv.exe 74 PID 4672 wrote to memory of 4948 4672 djddv.exe 74 PID 4948 wrote to memory of 4308 4948 ppvdd.exe 75 PID 4948 wrote to memory of 4308 4948 ppvdd.exe 75 PID 4948 wrote to memory of 4308 4948 ppvdd.exe 75 PID 4308 wrote to memory of 4596 4308 dvdpj.exe 76 PID 4308 wrote to memory of 4596 4308 dvdpj.exe 76 PID 4308 wrote to memory of 4596 4308 dvdpj.exe 76 PID 4596 wrote to memory of 4404 4596 pjjdv.exe 77 PID 4596 wrote to memory of 4404 4596 pjjdv.exe 77 PID 4596 wrote to memory of 4404 4596 pjjdv.exe 77 PID 4404 wrote to memory of 3348 4404 llfxflr.exe 78 PID 4404 wrote to memory of 3348 4404 llfxflr.exe 78 PID 4404 wrote to memory of 3348 4404 llfxflr.exe 78 PID 3348 wrote to memory of 212 3348 bthbhh.exe 79 PID 3348 wrote to memory of 212 3348 bthbhh.exe 79 PID 3348 wrote to memory of 212 3348 bthbhh.exe 79 PID 212 wrote to memory of 2992 212 pvvdp.exe 80 PID 212 wrote to memory of 2992 212 pvvdp.exe 80 PID 212 wrote to memory of 2992 212 pvvdp.exe 80 PID 2992 wrote to memory of 3312 2992 1rxlrll.exe 81 PID 2992 wrote to memory of 3312 2992 1rxlrll.exe 81 PID 2992 wrote to memory of 3312 2992 1rxlrll.exe 81 PID 3312 wrote to memory of 2372 3312 bbhbbh.exe 82 PID 3312 wrote to memory of 2372 3312 bbhbbh.exe 82 PID 3312 wrote to memory of 2372 3312 bbhbbh.exe 82 PID 2372 wrote to memory of 4920 2372 pjpjd.exe 83 PID 2372 wrote to memory of 4920 2372 pjpjd.exe 83 PID 2372 wrote to memory of 4920 2372 pjpjd.exe 83 PID 4920 wrote to memory of 4464 4920 lffrlll.exe 84 PID 4920 wrote to memory of 4464 4920 lffrlll.exe 84 PID 4920 wrote to memory of 4464 4920 lffrlll.exe 84 PID 4464 wrote to memory of 68 4464 dppdp.exe 85 PID 4464 wrote to memory of 68 4464 dppdp.exe 85 PID 4464 wrote to memory of 68 4464 dppdp.exe 85 PID 68 wrote to memory of 4004 68 rlflrrx.exe 86 PID 68 wrote to memory of 4004 68 rlflrrx.exe 86 PID 68 wrote to memory of 4004 68 rlflrrx.exe 86 PID 4004 wrote to memory of 4296 4004 1djdd.exe 87 PID 4004 wrote to memory of 4296 4004 1djdd.exe 87 PID 4004 wrote to memory of 4296 4004 1djdd.exe 87 PID 4296 wrote to memory of 3500 4296 lrxfxxx.exe 88 PID 4296 wrote to memory of 3500 4296 lrxfxxx.exe 88 PID 4296 wrote to memory of 3500 4296 lrxfxxx.exe 88 PID 3500 wrote to memory of 4912 3500 bnhhbt.exe 89 PID 3500 wrote to memory of 4912 3500 bnhhbt.exe 89 PID 3500 wrote to memory of 4912 3500 bnhhbt.exe 89 PID 4912 wrote to memory of 5040 4912 vjjdd.exe 90 PID 4912 wrote to memory of 5040 4912 vjjdd.exe 90 PID 4912 wrote to memory of 5040 4912 vjjdd.exe 90 PID 5040 wrote to memory of 4940 5040 ttbntn.exe 91 PID 5040 wrote to memory of 4940 5040 ttbntn.exe 91 PID 5040 wrote to memory of 4940 5040 ttbntn.exe 91 PID 4940 wrote to memory of 4492 4940 dvjdd.exe 92 PID 4940 wrote to memory of 4492 4940 dvjdd.exe 92 PID 4940 wrote to memory of 4492 4940 dvjdd.exe 92 PID 4492 wrote to memory of 2656 4492 xflxrrr.exe 93 PID 4492 wrote to memory of 2656 4492 xflxrrr.exe 93 PID 4492 wrote to memory of 2656 4492 xflxrrr.exe 93 PID 2656 wrote to memory of 4840 2656 pvdvp.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\djddv.exec:\djddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\ppvdd.exec:\ppvdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\dvdpj.exec:\dvdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\pjjdv.exec:\pjjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\llfxflr.exec:\llfxflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\bthbhh.exec:\bthbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\pvvdp.exec:\pvvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\1rxlrll.exec:\1rxlrll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\bbhbbh.exec:\bbhbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\pjpjd.exec:\pjpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\lffrlll.exec:\lffrlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\dppdp.exec:\dppdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\rlflrrx.exec:\rlflrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:68 -
\??\c:\1djdd.exec:\1djdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\lrxfxxx.exec:\lrxfxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\bnhhbt.exec:\bnhhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\vjjdd.exec:\vjjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\ttbntn.exec:\ttbntn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\dvjdd.exec:\dvjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\xflxrrr.exec:\xflxrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\pvdvp.exec:\pvdvp.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\9rlrllf.exec:\9rlrllf.exe23⤵
- Executes dropped EXE
PID:4840 -
\??\c:\vpjpv.exec:\vpjpv.exe24⤵
- Executes dropped EXE
PID:356 -
\??\c:\xxlrlff.exec:\xxlrlff.exe25⤵
- Executes dropped EXE
PID:496 -
\??\c:\bttttt.exec:\bttttt.exe26⤵
- Executes dropped EXE
PID:4380 -
\??\c:\ddpjp.exec:\ddpjp.exe27⤵
- Executes dropped EXE
PID:1640 -
\??\c:\9vjjj.exec:\9vjjj.exe28⤵
- Executes dropped EXE
PID:4564 -
\??\c:\tnnhhh.exec:\tnnhhh.exe29⤵
- Executes dropped EXE
PID:4580 -
\??\c:\5dpjv.exec:\5dpjv.exe30⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xfrfrlr.exec:\xfrfrlr.exe31⤵
- Executes dropped EXE
PID:4968 -
\??\c:\hbnhhn.exec:\hbnhhn.exe32⤵
- Executes dropped EXE
PID:304 -
\??\c:\vjjjd.exec:\vjjjd.exe33⤵
- Executes dropped EXE
PID:4848 -
\??\c:\5lllrlr.exec:\5lllrlr.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2248 -
\??\c:\hhhbbt.exec:\hhhbbt.exe35⤵
- Executes dropped EXE
PID:2164 -
\??\c:\3rxrlrr.exec:\3rxrlrr.exe36⤵
- Executes dropped EXE
PID:4216 -
\??\c:\nhtntt.exec:\nhtntt.exe37⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dpvvj.exec:\dpvvj.exe38⤵
- Executes dropped EXE
PID:3656 -
\??\c:\dpjpp.exec:\dpjpp.exe39⤵
- Executes dropped EXE
PID:2340 -
\??\c:\lfxlrfx.exec:\lfxlrfx.exe40⤵
- Executes dropped EXE
PID:3904 -
\??\c:\bbhnth.exec:\bbhnth.exe41⤵
- Executes dropped EXE
PID:3908 -
\??\c:\pvvpj.exec:\pvvpj.exe42⤵
- Executes dropped EXE
PID:4124 -
\??\c:\llllrfr.exec:\llllrfr.exe43⤵
- Executes dropped EXE
PID:4892 -
\??\c:\nnbhbh.exec:\nnbhbh.exe44⤵
- Executes dropped EXE
PID:1992 -
\??\c:\nhnnhb.exec:\nhnnhb.exe45⤵
- Executes dropped EXE
PID:96 -
\??\c:\jvdpd.exec:\jvdpd.exe46⤵
- Executes dropped EXE
PID:1220 -
\??\c:\rrfrffr.exec:\rrfrffr.exe47⤵
- Executes dropped EXE
PID:4308 -
\??\c:\1thbtn.exec:\1thbtn.exe48⤵
- Executes dropped EXE
PID:1852 -
\??\c:\nhhhhb.exec:\nhhhhb.exe49⤵
- Executes dropped EXE
PID:640 -
\??\c:\jpdjp.exec:\jpdjp.exe50⤵
- Executes dropped EXE
PID:4952 -
\??\c:\fffrrlf.exec:\fffrrlf.exe51⤵
- Executes dropped EXE
PID:220 -
\??\c:\xrrrlfx.exec:\xrrrlfx.exe52⤵
- Executes dropped EXE
PID:4428 -
\??\c:\htthbh.exec:\htthbh.exe53⤵
- Executes dropped EXE
PID:4632 -
\??\c:\jdddv.exec:\jdddv.exe54⤵
- Executes dropped EXE
PID:3532 -
\??\c:\ffrrrrr.exec:\ffrrrrr.exe55⤵
- Executes dropped EXE
PID:2156 -
\??\c:\tnnttb.exec:\tnnttb.exe56⤵
- Executes dropped EXE
PID:3932 -
\??\c:\dddvj.exec:\dddvj.exe57⤵
- Executes dropped EXE
PID:4824 -
\??\c:\jvpdp.exec:\jvpdp.exe58⤵
- Executes dropped EXE
PID:364 -
\??\c:\llfffxx.exec:\llfffxx.exe59⤵
- Executes dropped EXE
PID:2548 -
\??\c:\3hhbhb.exec:\3hhbhb.exe60⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nhthbb.exec:\nhthbb.exe61⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jdvpj.exec:\jdvpj.exe62⤵
- Executes dropped EXE
PID:2628 -
\??\c:\xrxffxl.exec:\xrxffxl.exe63⤵
- Executes dropped EXE
PID:1864 -
\??\c:\xfffxrl.exec:\xfffxrl.exe64⤵
- Executes dropped EXE
PID:3500 -
\??\c:\bnnhbh.exec:\bnnhbh.exe65⤵
- Executes dropped EXE
PID:4912 -
\??\c:\jdjpj.exec:\jdjpj.exe66⤵PID:5060
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe67⤵PID:2080
-
\??\c:\ttnttt.exec:\ttnttt.exe68⤵PID:2328
-
\??\c:\bhhhbh.exec:\bhhhbh.exe69⤵PID:4616
-
\??\c:\djvvp.exec:\djvvp.exe70⤵PID:2656
-
\??\c:\jvjdj.exec:\jvjdj.exe71⤵PID:2904
-
\??\c:\lxlllxr.exec:\lxlllxr.exe72⤵PID:1664
-
\??\c:\ntbbtb.exec:\ntbbtb.exe73⤵PID:4544
-
\??\c:\jppvj.exec:\jppvj.exe74⤵PID:4604
-
\??\c:\dpjjd.exec:\dpjjd.exe75⤵PID:1308
-
\??\c:\9rlxxrf.exec:\9rlxxrf.exe76⤵PID:1600
-
\??\c:\bntbhb.exec:\bntbhb.exe77⤵PID:2716
-
\??\c:\jpvjd.exec:\jpvjd.exe78⤵PID:3488
-
\??\c:\7rxrfxf.exec:\7rxrfxf.exe79⤵PID:4312
-
\??\c:\rrlxfxf.exec:\rrlxfxf.exe80⤵PID:4556
-
\??\c:\ntnhnt.exec:\ntnhnt.exe81⤵PID:868
-
\??\c:\pddpd.exec:\pddpd.exe82⤵PID:4016
-
\??\c:\xxllrrl.exec:\xxllrrl.exe83⤵PID:3664
-
\??\c:\thhbnb.exec:\thhbnb.exe84⤵PID:4208
-
\??\c:\htttnh.exec:\htttnh.exe85⤵PID:1876
-
\??\c:\vvvpv.exec:\vvvpv.exe86⤵PID:3716
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe87⤵PID:2036
-
\??\c:\fxxllfx.exec:\fxxllfx.exe88⤵PID:1460
-
\??\c:\bbhhhn.exec:\bbhhhn.exe89⤵PID:4832
-
\??\c:\nhtbht.exec:\nhtbht.exe90⤵PID:1772
-
\??\c:\jjppj.exec:\jjppj.exe91⤵PID:2952
-
\??\c:\tnnbth.exec:\tnnbth.exe92⤵PID:4232
-
\??\c:\pjpdd.exec:\pjpdd.exe93⤵PID:4672
-
\??\c:\vvvpp.exec:\vvvpp.exe94⤵PID:2028
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe95⤵PID:4948
-
\??\c:\9hhtnh.exec:\9hhtnh.exe96⤵PID:1484
-
\??\c:\pppjp.exec:\pppjp.exe97⤵PID:1656
-
\??\c:\pjjdp.exec:\pjjdp.exe98⤵PID:4308
-
\??\c:\9flxffx.exec:\9flxffx.exe99⤵PID:1096
-
\??\c:\nttnbh.exec:\nttnbh.exe100⤵PID:4860
-
\??\c:\7nhtnb.exec:\7nhtnb.exe101⤵PID:4868
-
\??\c:\vppjd.exec:\vppjd.exe102⤵PID:4040
-
\??\c:\llllrrx.exec:\llllrrx.exe103⤵PID:4584
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe104⤵PID:3312
-
\??\c:\7thttn.exec:\7thttn.exe105⤵PID:4980
-
\??\c:\9vvjv.exec:\9vvjv.exe106⤵PID:1508
-
\??\c:\dvvjd.exec:\dvvjd.exe107⤵PID:692
-
\??\c:\xllffrr.exec:\xllffrr.exe108⤵PID:1088
-
\??\c:\hhbthn.exec:\hhbthn.exe109⤵PID:1156
-
\??\c:\pjjjd.exec:\pjjjd.exe110⤵PID:2140
-
\??\c:\bnnhbb.exec:\bnnhbb.exe111⤵PID:644
-
\??\c:\jjjvv.exec:\jjjvv.exe112⤵PID:5044
-
\??\c:\xlllffx.exec:\xlllffx.exe113⤵PID:5088
-
\??\c:\nbbnhn.exec:\nbbnhn.exe114⤵PID:8
-
\??\c:\hhhbbb.exec:\hhhbbb.exe115⤵PID:1628
-
\??\c:\pjdjd.exec:\pjdjd.exe116⤵PID:3660
-
\??\c:\xxxllrr.exec:\xxxllrr.exe117⤵PID:3252
-
\??\c:\lfrrrxf.exec:\lfrrrxf.exe118⤵PID:2632
-
\??\c:\bhthth.exec:\bhthth.exe119⤵PID:4676
-
\??\c:\jjdvp.exec:\jjdvp.exe120⤵PID:1576
-
\??\c:\vjpvj.exec:\vjpvj.exe121⤵PID:516
-
\??\c:\llfffxr.exec:\llfffxr.exe122⤵PID:3084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-