Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows7-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
10Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02-09-2024 19:51
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240802-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
resource yara_rule behavioral19/memory/824-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2408-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2784-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2592-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/796-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2636-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2832-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2636-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2976-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2876-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/1936-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2764-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/1260-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2548-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/1564-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2196-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2444-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/604-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/980-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2408 lxllfff.exe 2784 pjpdd.exe 796 jddjp.exe 2592 btbtbt.exe 2832 ddppv.exe 2636 7nthht.exe 2360 nhbtnb.exe 2976 xxflrfr.exe 2100 1httnt.exe 2892 fflrxlx.exe 2760 bnhthn.exe 2876 lrlrxfl.exe 1936 rrflfff.exe 2764 jjpjj.exe 1944 tnbttt.exe 1260 ddpvj.exe 1392 xfffxxl.exe 3040 vvjjd.exe 2548 frfxfxl.exe 1564 bnbhth.exe 2196 jvddd.exe 2444 hthbhh.exe 2488 tnhtbn.exe 604 lfxfrrf.exe 980 thhbnn.exe 880 rxxffll.exe 2292 bnttbb.exe 1232 lxxlfxl.exe 2344 nbhthh.exe 1764 jjdvd.exe 884 thtnhn.exe 2408 jpddj.exe 2792 xflxfff.exe 1508 nnbbbn.exe 796 dddjj.exe 2744 xfxxxxr.exe 2560 tbhbbt.exe 2624 1pppj.exe 764 lrffrfr.exe 2180 bbhntt.exe 2148 tntbhh.exe 1308 dpjjv.exe 868 rrrfrxr.exe 772 nhhhbt.exe 2672 ddjpv.exe 2760 xrlfflf.exe 1028 llxrflx.exe 2884 7nthhh.exe 2172 jdvvj.exe 1928 lrfxfrx.exe 1648 hbhbhn.exe 2116 9pppv.exe 3032 5dvpd.exe 2240 xxrxxlr.exe 1040 bthbhn.exe 1176 dpjpv.exe 1872 frfrfxf.exe 1604 lffflrf.exe 908 thnbbn.exe 1208 9djdd.exe 2488 frrlxfl.exe 1884 rrfxfxr.exe 3016 tbhtnb.exe 2248 dpjjv.exe -
resource yara_rule behavioral19/memory/824-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2408-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2784-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2784-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2784-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/796-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/796-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2592-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2592-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/796-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2832-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2832-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2636-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2636-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2636-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2832-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2636-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2976-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2876-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1936-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2764-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1260-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2548-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1564-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2196-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2444-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/604-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/980-253-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffrlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 824 wrote to memory of 2408 824 BlackMoon.exe 31 PID 824 wrote to memory of 2408 824 BlackMoon.exe 31 PID 824 wrote to memory of 2408 824 BlackMoon.exe 31 PID 824 wrote to memory of 2408 824 BlackMoon.exe 31 PID 2408 wrote to memory of 2784 2408 lxllfff.exe 32 PID 2408 wrote to memory of 2784 2408 lxllfff.exe 32 PID 2408 wrote to memory of 2784 2408 lxllfff.exe 32 PID 2408 wrote to memory of 2784 2408 lxllfff.exe 32 PID 2784 wrote to memory of 796 2784 pjpdd.exe 33 PID 2784 wrote to memory of 796 2784 pjpdd.exe 33 PID 2784 wrote to memory of 796 2784 pjpdd.exe 33 PID 2784 wrote to memory of 796 2784 pjpdd.exe 33 PID 796 wrote to memory of 2592 796 jddjp.exe 34 PID 796 wrote to memory of 2592 796 jddjp.exe 34 PID 796 wrote to memory of 2592 796 jddjp.exe 34 PID 796 wrote to memory of 2592 796 jddjp.exe 34 PID 2592 wrote to memory of 2832 2592 btbtbt.exe 35 PID 2592 wrote to memory of 2832 2592 btbtbt.exe 35 PID 2592 wrote to memory of 2832 2592 btbtbt.exe 35 PID 2592 wrote to memory of 2832 2592 btbtbt.exe 35 PID 2832 wrote to memory of 2636 2832 ddppv.exe 36 PID 2832 wrote to memory of 2636 2832 ddppv.exe 36 PID 2832 wrote to memory of 2636 2832 ddppv.exe 36 PID 2832 wrote to memory of 2636 2832 ddppv.exe 36 PID 2636 wrote to memory of 2360 2636 7nthht.exe 37 PID 2636 wrote to memory of 2360 2636 7nthht.exe 37 PID 2636 wrote to memory of 2360 2636 7nthht.exe 37 PID 2636 wrote to memory of 2360 2636 7nthht.exe 37 PID 2360 wrote to memory of 2976 2360 nhbtnb.exe 38 PID 2360 wrote to memory of 2976 2360 nhbtnb.exe 38 PID 2360 wrote to memory of 2976 2360 nhbtnb.exe 38 PID 2360 wrote to memory of 2976 2360 nhbtnb.exe 38 PID 2976 wrote to memory of 2100 2976 xxflrfr.exe 39 PID 2976 wrote to memory of 2100 2976 xxflrfr.exe 39 PID 2976 wrote to memory of 2100 2976 xxflrfr.exe 39 PID 2976 wrote to memory of 2100 2976 xxflrfr.exe 39 PID 2100 wrote to memory of 2892 2100 1httnt.exe 40 PID 2100 wrote to memory of 2892 2100 1httnt.exe 40 PID 2100 wrote to memory of 2892 2100 1httnt.exe 40 PID 2100 wrote to memory of 2892 2100 1httnt.exe 40 PID 2892 wrote to memory of 2760 2892 fflrxlx.exe 41 PID 2892 wrote to memory of 2760 2892 fflrxlx.exe 41 PID 2892 wrote to memory of 2760 2892 fflrxlx.exe 41 PID 2892 wrote to memory of 2760 2892 fflrxlx.exe 41 PID 2760 wrote to memory of 2876 2760 bnhthn.exe 42 PID 2760 wrote to memory of 2876 2760 bnhthn.exe 42 PID 2760 wrote to memory of 2876 2760 bnhthn.exe 42 PID 2760 wrote to memory of 2876 2760 bnhthn.exe 42 PID 2876 wrote to memory of 1936 2876 lrlrxfl.exe 43 PID 2876 wrote to memory of 1936 2876 lrlrxfl.exe 43 PID 2876 wrote to memory of 1936 2876 lrlrxfl.exe 43 PID 2876 wrote to memory of 1936 2876 lrlrxfl.exe 43 PID 1936 wrote to memory of 2764 1936 rrflfff.exe 44 PID 1936 wrote to memory of 2764 1936 rrflfff.exe 44 PID 1936 wrote to memory of 2764 1936 rrflfff.exe 44 PID 1936 wrote to memory of 2764 1936 rrflfff.exe 44 PID 2764 wrote to memory of 1944 2764 jjpjj.exe 45 PID 2764 wrote to memory of 1944 2764 jjpjj.exe 45 PID 2764 wrote to memory of 1944 2764 jjpjj.exe 45 PID 2764 wrote to memory of 1944 2764 jjpjj.exe 45 PID 1944 wrote to memory of 1260 1944 tnbttt.exe 46 PID 1944 wrote to memory of 1260 1944 tnbttt.exe 46 PID 1944 wrote to memory of 1260 1944 tnbttt.exe 46 PID 1944 wrote to memory of 1260 1944 tnbttt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\lxllfff.exec:\lxllfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\pjpdd.exec:\pjpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\jddjp.exec:\jddjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\btbtbt.exec:\btbtbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\ddppv.exec:\ddppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\7nthht.exec:\7nthht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nhbtnb.exec:\nhbtnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\xxflrfr.exec:\xxflrfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\1httnt.exec:\1httnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\fflrxlx.exec:\fflrxlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\bnhthn.exec:\bnhthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\lrlrxfl.exec:\lrlrxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\rrflfff.exec:\rrflfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\jjpjj.exec:\jjpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\tnbttt.exec:\tnbttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\ddpvj.exec:\ddpvj.exe17⤵
- Executes dropped EXE
PID:1260 -
\??\c:\xfffxxl.exec:\xfffxxl.exe18⤵
- Executes dropped EXE
PID:1392 -
\??\c:\vvjjd.exec:\vvjjd.exe19⤵
- Executes dropped EXE
PID:3040 -
\??\c:\frfxfxl.exec:\frfxfxl.exe20⤵
- Executes dropped EXE
PID:2548 -
\??\c:\bnbhth.exec:\bnbhth.exe21⤵
- Executes dropped EXE
PID:1564 -
\??\c:\jvddd.exec:\jvddd.exe22⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hthbhh.exec:\hthbhh.exe23⤵
- Executes dropped EXE
PID:2444 -
\??\c:\tnhtbn.exec:\tnhtbn.exe24⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:604 -
\??\c:\thhbnn.exec:\thhbnn.exe26⤵
- Executes dropped EXE
PID:980 -
\??\c:\rxxffll.exec:\rxxffll.exe27⤵
- Executes dropped EXE
PID:880 -
\??\c:\bnttbb.exec:\bnttbb.exe28⤵
- Executes dropped EXE
PID:2292 -
\??\c:\lxxlfxl.exec:\lxxlfxl.exe29⤵
- Executes dropped EXE
PID:1232 -
\??\c:\nbhthh.exec:\nbhthh.exe30⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jjdvd.exec:\jjdvd.exe31⤵
- Executes dropped EXE
PID:1764 -
\??\c:\thtnhn.exec:\thtnhn.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\jpddj.exec:\jpddj.exe33⤵
- Executes dropped EXE
PID:2408 -
\??\c:\xflxfff.exec:\xflxfff.exe34⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nnbbbn.exec:\nnbbbn.exe35⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dddjj.exec:\dddjj.exe36⤵
- Executes dropped EXE
PID:796 -
\??\c:\xfxxxxr.exec:\xfxxxxr.exe37⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tbhbbt.exec:\tbhbbt.exe38⤵
- Executes dropped EXE
PID:2560 -
\??\c:\1pppj.exec:\1pppj.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lrffrfr.exec:\lrffrfr.exe40⤵
- Executes dropped EXE
PID:764 -
\??\c:\bbhntt.exec:\bbhntt.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2180 -
\??\c:\tntbhh.exec:\tntbhh.exe42⤵
- Executes dropped EXE
PID:2148 -
\??\c:\dpjjv.exec:\dpjjv.exe43⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rrrfrxr.exec:\rrrfrxr.exe44⤵
- Executes dropped EXE
PID:868 -
\??\c:\nhhhbt.exec:\nhhhbt.exe45⤵
- Executes dropped EXE
PID:772 -
\??\c:\ddjpv.exec:\ddjpv.exe46⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xrlfflf.exec:\xrlfflf.exe47⤵
- Executes dropped EXE
PID:2760 -
\??\c:\llxrflx.exec:\llxrflx.exe48⤵
- Executes dropped EXE
PID:1028 -
\??\c:\7nthhh.exec:\7nthhh.exe49⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jdvvj.exec:\jdvvj.exe50⤵
- Executes dropped EXE
PID:2172 -
\??\c:\lrfxfrx.exec:\lrfxfrx.exe51⤵
- Executes dropped EXE
PID:1928 -
\??\c:\hbhbhn.exec:\hbhbhn.exe52⤵
- Executes dropped EXE
PID:1648 -
\??\c:\9pppv.exec:\9pppv.exe53⤵
- Executes dropped EXE
PID:2116 -
\??\c:\5dvpd.exec:\5dvpd.exe54⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xxrxxlr.exec:\xxrxxlr.exe55⤵
- Executes dropped EXE
PID:2240 -
\??\c:\bthbhn.exec:\bthbhn.exe56⤵
- Executes dropped EXE
PID:1040 -
\??\c:\dpjpv.exec:\dpjpv.exe57⤵
- Executes dropped EXE
PID:1176 -
\??\c:\frfrfxf.exec:\frfrfxf.exe58⤵
- Executes dropped EXE
PID:1872 -
\??\c:\lffflrf.exec:\lffflrf.exe59⤵
- Executes dropped EXE
PID:1604 -
\??\c:\thnbbn.exec:\thnbbn.exe60⤵
- Executes dropped EXE
PID:908 -
\??\c:\9djdd.exec:\9djdd.exe61⤵
- Executes dropped EXE
PID:1208 -
\??\c:\frrlxfl.exec:\frrlxfl.exe62⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rrfxfxr.exec:\rrfxfxr.exe63⤵
- Executes dropped EXE
PID:1884 -
\??\c:\tbhtnb.exec:\tbhtnb.exe64⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dpjjv.exec:\dpjjv.exe65⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xrlfllx.exec:\xrlfllx.exe66⤵PID:2288
-
\??\c:\xrxfflf.exec:\xrxfflf.exe67⤵PID:1844
-
\??\c:\rfflxlf.exec:\rfflxlf.exe68⤵PID:2160
-
\??\c:\httnnt.exec:\httnnt.exe69⤵PID:2296
-
\??\c:\vjvdv.exec:\vjvdv.exe70⤵PID:2500
-
\??\c:\frfrffx.exec:\frfrffx.exe71⤵PID:108
-
\??\c:\frlrfxl.exec:\frlrfxl.exe72⤵PID:3020
-
\??\c:\bhbnht.exec:\bhbnht.exe73⤵PID:2852
-
\??\c:\vvvjv.exec:\vvvjv.exe74⤵PID:2940
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe75⤵PID:2820
-
\??\c:\9nhnbn.exec:\9nhnbn.exe76⤵PID:2388
-
\??\c:\jvvvj.exec:\jvvvj.exe77⤵PID:2620
-
\??\c:\xxxlxfx.exec:\xxxlxfx.exe78⤵PID:1776
-
\??\c:\nbhtht.exec:\nbhtht.exe79⤵PID:2124
-
\??\c:\hhhnhn.exec:\hhhnhn.exe80⤵PID:2260
-
\??\c:\pdpvp.exec:\pdpvp.exe81⤵PID:1628
-
\??\c:\xxllxfr.exec:\xxllxfr.exe82⤵PID:2904
-
\??\c:\lxfxlxf.exec:\lxfxlxf.exe83⤵PID:1308
-
\??\c:\tnthnb.exec:\tnthnb.exe84⤵PID:2816
-
\??\c:\jdpdp.exec:\jdpdp.exe85⤵PID:2964
-
\??\c:\rlxflxf.exec:\rlxflxf.exe86⤵PID:2888
-
\??\c:\ttnbtb.exec:\ttnbtb.exe87⤵PID:540
-
\??\c:\bthhnh.exec:\bthhnh.exe88⤵PID:1936
-
\??\c:\7dvjd.exec:\7dvjd.exe89⤵PID:1268
-
\??\c:\flxfrll.exec:\flxfrll.exe90⤵PID:1556
-
\??\c:\bnhttt.exec:\bnhttt.exe91⤵PID:2016
-
\??\c:\xfrrllx.exec:\xfrrllx.exe92⤵PID:1648
-
\??\c:\nnhthn.exec:\nnhthn.exe93⤵PID:1652
-
\??\c:\tbbbtt.exec:\tbbbtt.exe94⤵PID:3040
-
\??\c:\vpdvv.exec:\vpdvv.exe95⤵PID:408
-
\??\c:\xrrrfrf.exec:\xrrrfrf.exe96⤵PID:2364
-
\??\c:\tbhhbh.exec:\tbhhbh.exe97⤵PID:956
-
\??\c:\xrllflx.exec:\xrllflx.exe98⤵PID:1872
-
\??\c:\ttnhtb.exec:\ttnhtb.exe99⤵PID:2444
-
\??\c:\jpdvj.exec:\jpdvj.exe100⤵PID:1616
-
\??\c:\lflxlxf.exec:\lflxlxf.exe101⤵PID:632
-
\??\c:\ddjvv.exec:\ddjvv.exe102⤵PID:696
-
\??\c:\xfxlfrf.exec:\xfxlfrf.exe103⤵PID:1428
-
\??\c:\htbnnh.exec:\htbnnh.exe104⤵PID:880
-
\??\c:\pjdvv.exec:\pjdvv.exe105⤵PID:1192
-
\??\c:\rflxlfx.exec:\rflxlfx.exe106⤵PID:1232
-
\??\c:\bnnbbt.exec:\bnnbbt.exe107⤵PID:824
-
\??\c:\tbnhnn.exec:\tbnhnn.exe108⤵PID:1516
-
\??\c:\jvjvv.exec:\jvjvv.exe109⤵PID:2680
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe110⤵PID:2800
-
\??\c:\bhbbhn.exec:\bhbbhn.exe111⤵PID:3008
-
\??\c:\jpvjj.exec:\jpvjj.exe112⤵PID:2848
-
\??\c:\lfrrxlr.exec:\lfrrxlr.exe113⤵PID:2508
-
\??\c:\flllxfr.exec:\flllxfr.exe114⤵PID:2708
-
\??\c:\tbbbnh.exec:\tbbbnh.exe115⤵PID:2736
-
\??\c:\vdjjj.exec:\vdjjj.exe116⤵PID:2740
-
\??\c:\flrrxxr.exec:\flrrxxr.exe117⤵PID:264
-
\??\c:\nbhhnb.exec:\nbhhnb.exe118⤵PID:2928
-
\??\c:\jvvdp.exec:\jvvdp.exe119⤵PID:2256
-
\??\c:\rrrflrr.exec:\rrrflrr.exe120⤵PID:2952
-
\??\c:\hhtbhh.exec:\hhtbhh.exe121⤵PID:2188
-
\??\c:\pvvjd.exec:\pvvjd.exe122⤵PID:1932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-