Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows7-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
10Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2024 19:51
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240729-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240802-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral20/memory/1196-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1196-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4292-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4820-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2304-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4600-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3668-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4600-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2600-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2052-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2252-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2240-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3968-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3896-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3448-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2920-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2672-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1480-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1356-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1564-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4060-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2956-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4760-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1164-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2832-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4884-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4136-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4396-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4292-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4292 ffxlfxl.exe 4820 hbbnht.exe 2304 vvppj.exe 4600 5ntnhb.exe 3668 jdvdd.exe 2600 1bhbtt.exe 2052 rrxrxll.exe 2252 fllfrrl.exe 2240 jdvdd.exe 3968 flllllr.exe 3896 jvjjv.exe 3392 7ppdd.exe 3448 ffrfffl.exe 2920 pdjpv.exe 2672 rfxfxlf.exe 1480 vpvjp.exe 1356 rlxlffx.exe 3388 llxxfrl.exe 4060 fflrfll.exe 1564 bhhtth.exe 2956 djpjv.exe 4760 jjpdj.exe 3664 frfrlll.exe 1164 ttbhhh.exe 2832 vjpjp.exe 4884 fllrlrl.exe 3872 xrxlfrx.exe 4136 3tthbb.exe 4396 bbbhtt.exe 4460 djjdv.exe 4292 htbbbh.exe 1700 ddjjj.exe 4020 thhtth.exe 5080 pjjjj.exe 920 lrllrxx.exe 3624 9ntnbt.exe 4464 dvvdd.exe 3100 ffrflff.exe 2808 hnbhth.exe 3436 thnhtn.exe 1472 vdvjd.exe 2236 5flllll.exe 3572 3tbnhh.exe 3508 vpjvv.exe 4280 xfrrrrl.exe 1988 tbnhnh.exe 4936 pdpdd.exe 1684 1pjvj.exe 4144 llxlflr.exe 3648 1nnnnh.exe 5100 jpjvj.exe 432 vvpvd.exe 4520 tnnntb.exe 3448 3ttbbb.exe 900 pppvd.exe 3356 xllrxfl.exe 4516 nhtnnt.exe 1480 pvdpv.exe 1200 rllllll.exe 1356 nnhntb.exe 2932 bnnbhh.exe 4440 vddpj.exe 2472 rllfxxr.exe 5084 9htbtb.exe -
resource yara_rule behavioral20/memory/1196-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1196-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4292-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4820-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2304-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4600-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4600-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4600-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3668-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4600-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2600-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2052-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2052-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2052-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2252-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2252-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2240-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3968-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3896-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3448-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2920-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2672-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1480-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1356-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1564-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4060-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2956-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4760-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1164-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2832-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4884-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4136-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4396-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4292-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxrxx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1196 wrote to memory of 4292 1196 BlackMoon.exe 84 PID 1196 wrote to memory of 4292 1196 BlackMoon.exe 84 PID 1196 wrote to memory of 4292 1196 BlackMoon.exe 84 PID 4292 wrote to memory of 4820 4292 ffxlfxl.exe 85 PID 4292 wrote to memory of 4820 4292 ffxlfxl.exe 85 PID 4292 wrote to memory of 4820 4292 ffxlfxl.exe 85 PID 4820 wrote to memory of 2304 4820 hbbnht.exe 86 PID 4820 wrote to memory of 2304 4820 hbbnht.exe 86 PID 4820 wrote to memory of 2304 4820 hbbnht.exe 86 PID 2304 wrote to memory of 4600 2304 vvppj.exe 90 PID 2304 wrote to memory of 4600 2304 vvppj.exe 90 PID 2304 wrote to memory of 4600 2304 vvppj.exe 90 PID 4600 wrote to memory of 3668 4600 5ntnhb.exe 91 PID 4600 wrote to memory of 3668 4600 5ntnhb.exe 91 PID 4600 wrote to memory of 3668 4600 5ntnhb.exe 91 PID 3668 wrote to memory of 2600 3668 jdvdd.exe 92 PID 3668 wrote to memory of 2600 3668 jdvdd.exe 92 PID 3668 wrote to memory of 2600 3668 jdvdd.exe 92 PID 2600 wrote to memory of 2052 2600 1bhbtt.exe 93 PID 2600 wrote to memory of 2052 2600 1bhbtt.exe 93 PID 2600 wrote to memory of 2052 2600 1bhbtt.exe 93 PID 2052 wrote to memory of 2252 2052 rrxrxll.exe 94 PID 2052 wrote to memory of 2252 2052 rrxrxll.exe 94 PID 2052 wrote to memory of 2252 2052 rrxrxll.exe 94 PID 2252 wrote to memory of 2240 2252 fllfrrl.exe 95 PID 2252 wrote to memory of 2240 2252 fllfrrl.exe 95 PID 2252 wrote to memory of 2240 2252 fllfrrl.exe 95 PID 2240 wrote to memory of 3968 2240 jdvdd.exe 97 PID 2240 wrote to memory of 3968 2240 jdvdd.exe 97 PID 2240 wrote to memory of 3968 2240 jdvdd.exe 97 PID 3968 wrote to memory of 3896 3968 flllllr.exe 98 PID 3968 wrote to memory of 3896 3968 flllllr.exe 98 PID 3968 wrote to memory of 3896 3968 flllllr.exe 98 PID 3896 wrote to memory of 3392 3896 jvjjv.exe 99 PID 3896 wrote to memory of 3392 3896 jvjjv.exe 99 PID 3896 wrote to memory of 3392 3896 jvjjv.exe 99 PID 3392 wrote to memory of 3448 3392 7ppdd.exe 100 PID 3392 wrote to memory of 3448 3392 7ppdd.exe 100 PID 3392 wrote to memory of 3448 3392 7ppdd.exe 100 PID 3448 wrote to memory of 2920 3448 ffrfffl.exe 101 PID 3448 wrote to memory of 2920 3448 ffrfffl.exe 101 PID 3448 wrote to memory of 2920 3448 ffrfffl.exe 101 PID 2920 wrote to memory of 2672 2920 pdjpv.exe 102 PID 2920 wrote to memory of 2672 2920 pdjpv.exe 102 PID 2920 wrote to memory of 2672 2920 pdjpv.exe 102 PID 2672 wrote to memory of 1480 2672 rfxfxlf.exe 103 PID 2672 wrote to memory of 1480 2672 rfxfxlf.exe 103 PID 2672 wrote to memory of 1480 2672 rfxfxlf.exe 103 PID 1480 wrote to memory of 1356 1480 vpvjp.exe 104 PID 1480 wrote to memory of 1356 1480 vpvjp.exe 104 PID 1480 wrote to memory of 1356 1480 vpvjp.exe 104 PID 1356 wrote to memory of 3388 1356 rlxlffx.exe 105 PID 1356 wrote to memory of 3388 1356 rlxlffx.exe 105 PID 1356 wrote to memory of 3388 1356 rlxlffx.exe 105 PID 3388 wrote to memory of 4060 3388 llxxfrl.exe 106 PID 3388 wrote to memory of 4060 3388 llxxfrl.exe 106 PID 3388 wrote to memory of 4060 3388 llxxfrl.exe 106 PID 4060 wrote to memory of 1564 4060 fflrfll.exe 107 PID 4060 wrote to memory of 1564 4060 fflrfll.exe 107 PID 4060 wrote to memory of 1564 4060 fflrfll.exe 107 PID 1564 wrote to memory of 2956 1564 bhhtth.exe 108 PID 1564 wrote to memory of 2956 1564 bhhtth.exe 108 PID 1564 wrote to memory of 2956 1564 bhhtth.exe 108 PID 2956 wrote to memory of 4760 2956 djpjv.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\ffxlfxl.exec:\ffxlfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\hbbnht.exec:\hbbnht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\vvppj.exec:\vvppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\5ntnhb.exec:\5ntnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\jdvdd.exec:\jdvdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\1bhbtt.exec:\1bhbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\rrxrxll.exec:\rrxrxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\fllfrrl.exec:\fllfrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\jdvdd.exec:\jdvdd.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\flllllr.exec:\flllllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\jvjjv.exec:\jvjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\7ppdd.exec:\7ppdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\ffrfffl.exec:\ffrfffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\pdjpv.exec:\pdjpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rfxfxlf.exec:\rfxfxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\vpvjp.exec:\vpvjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\rlxlffx.exec:\rlxlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\llxxfrl.exec:\llxxfrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\fflrfll.exec:\fflrfll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\bhhtth.exec:\bhhtth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\djpjv.exec:\djpjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\jjpdj.exec:\jjpdj.exe23⤵
- Executes dropped EXE
PID:4760 -
\??\c:\frfrlll.exec:\frfrlll.exe24⤵
- Executes dropped EXE
PID:3664 -
\??\c:\ttbhhh.exec:\ttbhhh.exe25⤵
- Executes dropped EXE
PID:1164 -
\??\c:\vjpjp.exec:\vjpjp.exe26⤵
- Executes dropped EXE
PID:2832 -
\??\c:\fllrlrl.exec:\fllrlrl.exe27⤵
- Executes dropped EXE
PID:4884 -
\??\c:\xrxlfrx.exec:\xrxlfrx.exe28⤵
- Executes dropped EXE
PID:3872 -
\??\c:\3tthbb.exec:\3tthbb.exe29⤵
- Executes dropped EXE
PID:4136 -
\??\c:\bbbhtt.exec:\bbbhtt.exe30⤵
- Executes dropped EXE
PID:4396 -
\??\c:\djjdv.exec:\djjdv.exe31⤵
- Executes dropped EXE
PID:4460 -
\??\c:\htbbbh.exec:\htbbbh.exe32⤵
- Executes dropped EXE
PID:4292 -
\??\c:\ddjjj.exec:\ddjjj.exe33⤵
- Executes dropped EXE
PID:1700 -
\??\c:\thhtth.exec:\thhtth.exe34⤵
- Executes dropped EXE
PID:4020 -
\??\c:\pjjjj.exec:\pjjjj.exe35⤵
- Executes dropped EXE
PID:5080 -
\??\c:\lrllrxx.exec:\lrllrxx.exe36⤵
- Executes dropped EXE
PID:920 -
\??\c:\9ntnbt.exec:\9ntnbt.exe37⤵
- Executes dropped EXE
PID:3624 -
\??\c:\dvvdd.exec:\dvvdd.exe38⤵
- Executes dropped EXE
PID:4464 -
\??\c:\ffrflff.exec:\ffrflff.exe39⤵
- Executes dropped EXE
PID:3100 -
\??\c:\hnbhth.exec:\hnbhth.exe40⤵
- Executes dropped EXE
PID:2808 -
\??\c:\thnhtn.exec:\thnhtn.exe41⤵
- Executes dropped EXE
PID:3436 -
\??\c:\vdvjd.exec:\vdvjd.exe42⤵
- Executes dropped EXE
PID:1472 -
\??\c:\5flllll.exec:\5flllll.exe43⤵
- Executes dropped EXE
PID:2236 -
\??\c:\3tbnhh.exec:\3tbnhh.exe44⤵
- Executes dropped EXE
PID:3572 -
\??\c:\vpjvv.exec:\vpjvv.exe45⤵
- Executes dropped EXE
PID:3508 -
\??\c:\xfrrrrl.exec:\xfrrrrl.exe46⤵
- Executes dropped EXE
PID:4280 -
\??\c:\tbnhnh.exec:\tbnhnh.exe47⤵
- Executes dropped EXE
PID:1988 -
\??\c:\pdpdd.exec:\pdpdd.exe48⤵
- Executes dropped EXE
PID:4936 -
\??\c:\1pjvj.exec:\1pjvj.exe49⤵
- Executes dropped EXE
PID:1684 -
\??\c:\llxlflr.exec:\llxlflr.exe50⤵
- Executes dropped EXE
PID:4144 -
\??\c:\1nnnnh.exec:\1nnnnh.exe51⤵
- Executes dropped EXE
PID:3648 -
\??\c:\jpjvj.exec:\jpjvj.exe52⤵
- Executes dropped EXE
PID:5100 -
\??\c:\vvpvd.exec:\vvpvd.exe53⤵
- Executes dropped EXE
PID:432 -
\??\c:\tnnntb.exec:\tnnntb.exe54⤵
- Executes dropped EXE
PID:4520 -
\??\c:\3ttbbb.exec:\3ttbbb.exe55⤵
- Executes dropped EXE
PID:3448 -
\??\c:\pppvd.exec:\pppvd.exe56⤵
- Executes dropped EXE
PID:900 -
\??\c:\xllrxfl.exec:\xllrxfl.exe57⤵
- Executes dropped EXE
PID:3356 -
\??\c:\nhtnnt.exec:\nhtnnt.exe58⤵
- Executes dropped EXE
PID:4516 -
\??\c:\pvdpv.exec:\pvdpv.exe59⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rllllll.exec:\rllllll.exe60⤵
- Executes dropped EXE
PID:1200 -
\??\c:\nnhntb.exec:\nnhntb.exe61⤵
- Executes dropped EXE
PID:1356 -
\??\c:\bnnbhh.exec:\bnnbhh.exe62⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vddpj.exec:\vddpj.exe63⤵
- Executes dropped EXE
PID:4440 -
\??\c:\rllfxxr.exec:\rllfxxr.exe64⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9htbtb.exec:\9htbtb.exe65⤵
- Executes dropped EXE
PID:5084 -
\??\c:\1jjdd.exec:\1jjdd.exe66⤵PID:2428
-
\??\c:\rlrfxxx.exec:\rlrfxxx.exe67⤵PID:3224
-
\??\c:\nhhtht.exec:\nhhtht.exe68⤵
- System Location Discovery: System Language Discovery
PID:1636 -
\??\c:\dvvpd.exec:\dvvpd.exe69⤵PID:1632
-
\??\c:\9dvvp.exec:\9dvvp.exe70⤵PID:1072
-
\??\c:\xrfxfxx.exec:\xrfxfxx.exe71⤵PID:3844
-
\??\c:\hhtttb.exec:\hhtttb.exe72⤵PID:4524
-
\??\c:\jpjjd.exec:\jpjjd.exe73⤵PID:4040
-
\??\c:\ffffxxx.exec:\ffffxxx.exe74⤵PID:4484
-
\??\c:\tnnhnb.exec:\tnnhnb.exe75⤵PID:780
-
\??\c:\bbbbtb.exec:\bbbbtb.exe76⤵PID:2396
-
\??\c:\lrlrlfr.exec:\lrlrlfr.exe77⤵PID:736
-
\??\c:\rfllxxf.exec:\rfllxxf.exe78⤵PID:3084
-
\??\c:\pvpjd.exec:\pvpjd.exe79⤵PID:372
-
\??\c:\xflrrlf.exec:\xflrrlf.exe80⤵PID:4616
-
\??\c:\hhhhnn.exec:\hhhhnn.exe81⤵PID:1340
-
\??\c:\vvvvp.exec:\vvvvp.exe82⤵PID:1976
-
\??\c:\5rxrrff.exec:\5rxrrff.exe83⤵PID:1052
-
\??\c:\nnnhht.exec:\nnnhht.exe84⤵PID:1812
-
\??\c:\dppjj.exec:\dppjj.exe85⤵PID:2284
-
\??\c:\xfrlxfr.exec:\xfrlxfr.exe86⤵PID:3152
-
\??\c:\ntbbbb.exec:\ntbbbb.exe87⤵PID:2012
-
\??\c:\lfxrxxx.exec:\lfxrxxx.exe88⤵PID:3272
-
\??\c:\7tntht.exec:\7tntht.exe89⤵PID:4532
-
\??\c:\pjppd.exec:\pjppd.exe90⤵PID:1464
-
\??\c:\ppvdv.exec:\ppvdv.exe91⤵PID:4828
-
\??\c:\bbnbnh.exec:\bbnbnh.exe92⤵PID:4560
-
\??\c:\bthbbb.exec:\bthbbb.exe93⤵PID:1176
-
\??\c:\vpjdv.exec:\vpjdv.exe94⤵PID:4936
-
\??\c:\5lflffx.exec:\5lflffx.exe95⤵PID:1600
-
\??\c:\nntbtn.exec:\nntbtn.exe96⤵PID:5100
-
\??\c:\ddjjj.exec:\ddjjj.exe97⤵PID:1664
-
\??\c:\9rrrffx.exec:\9rrrffx.exe98⤵PID:4520
-
\??\c:\7nntnt.exec:\7nntnt.exe99⤵PID:2400
-
\??\c:\1vppv.exec:\1vppv.exe100⤵PID:2884
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe101⤵PID:2128
-
\??\c:\httntt.exec:\httntt.exe102⤵PID:3868
-
\??\c:\vdjdd.exec:\vdjdd.exe103⤵PID:1640
-
\??\c:\rxxrflr.exec:\rxxrflr.exe104⤵PID:3432
-
\??\c:\nnnthn.exec:\nnnthn.exe105⤵PID:624
-
\??\c:\9ppjd.exec:\9ppjd.exe106⤵PID:4944
-
\??\c:\lrrffrr.exec:\lrrffrr.exe107⤵PID:2868
-
\??\c:\jjdpv.exec:\jjdpv.exe108⤵PID:2380
-
\??\c:\djvjp.exec:\djvjp.exe109⤵PID:2428
-
\??\c:\vdvvd.exec:\vdvvd.exe110⤵PID:2136
-
\??\c:\xxlrlfx.exec:\xxlrlfx.exe111⤵PID:212
-
\??\c:\jvppd.exec:\jvppd.exe112⤵PID:2972
-
\??\c:\lllxrrr.exec:\lllxrrr.exe113⤵PID:1072
-
\??\c:\jppdj.exec:\jppdj.exe114⤵PID:3972
-
\??\c:\xxxllxx.exec:\xxxllxx.exe115⤵PID:4404
-
\??\c:\bbbtbb.exec:\bbbtbb.exe116⤵PID:4428
-
\??\c:\ppvvp.exec:\ppvvp.exe117⤵PID:1236
-
\??\c:\bnnnhh.exec:\bnnnhh.exe118⤵PID:3708
-
\??\c:\pdpjd.exec:\pdpjd.exe119⤵PID:4272
-
\??\c:\djddp.exec:\djddp.exe120⤵PID:3400
-
\??\c:\xrllflx.exec:\xrllflx.exe121⤵PID:5036
-
\??\c:\pdddd.exec:\pdddd.exe122⤵PID:4112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-