Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows7-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
10Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-09-2024 13:51
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240802-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral19/memory/2400-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2928-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/1792-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/1172-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2828-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2856-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2432-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2664-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2060-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2544-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2596-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2340-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2136-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/1904-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2452-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2564-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2488-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2104-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2088-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/1492-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrlfxfr.exetttbnh.exexlflrxf.exettntth.exexrrrxxf.exepjdpd.exehhtbnb.exejjppd.exe5nhntb.exehbtbhh.exerlxllfl.exehnthhb.exe1rfflrx.exenbtnbb.exexllrrxl.exennnhbh.exexfrfxrl.exe9thbhn.exefrrfrfx.exentbttt.exevdpjd.exefflxrxr.exevvvvd.exeflrlllr.exe5bnnbh.exedvpvj.exe9rrrxll.exebttbtb.exepddpp.exerrxfxfl.exevpdpv.exerrlrflx.exetbhhhh.exejjjdp.exe5frlflr.exenththh.exeppjvv.exexxffxxf.exerrfflxl.exettbhht.exedpvvd.exexfxfxxl.exenhthnb.exehhbhhn.exevvppv.exellffrxx.exebbtbhh.exehbnbnn.exejdddd.exexlrlxfl.exentbhtb.exehbnbnn.exepdvpj.exe9xlrlrf.exethnntt.exevjpvv.exeffrxlfx.exetbnhhn.exevpjdj.exevpddd.exe5fffflr.exebbhhht.exedpvpv.exedvppj.exepid process 2928 rrlfxfr.exe 1792 tttbnh.exe 1172 xlflrxf.exe 2828 ttntth.exe 2856 xrrrxxf.exe 2432 pjdpd.exe 2664 hhtbnb.exe 2060 jjppd.exe 2544 5nhntb.exe 2596 hbtbhh.exe 868 rlxllfl.exe 2340 hnthhb.exe 1040 1rfflrx.exe 2180 nbtnbb.exe 2136 xllrrxl.exe 1904 nnnhbh.exe 2452 xfrfxrl.exe 2984 9thbhn.exe 2564 frrfrfx.exe 1372 ntbttt.exe 1880 vdpjd.exe 2580 fflxrxr.exe 2488 vvvvd.exe 1584 flrlllr.exe 2104 5bnnbh.exe 2088 dvpvj.exe 1156 9rrrxll.exe 1492 bttbtb.exe 2200 pddpp.exe 1856 rrxfxfl.exe 1212 vpdpv.exe 1708 rrlrflx.exe 2884 tbhhhh.exe 2208 jjjdp.exe 2444 5frlflr.exe 2716 nththh.exe 2876 ppjvv.exe 2760 xxffxxf.exe 2960 rrfflxl.exe 2632 ttbhht.exe 2832 dpvvd.exe 2608 xfxfxxl.exe 2676 nhthnb.exe 1176 hhbhhn.exe 1528 vvppv.exe 1052 llffrxx.exe 1580 bbtbhh.exe 868 hbnbnn.exe 1736 jdddd.exe 1756 xlrlxfl.exe 1700 ntbhtb.exe 300 hbnbnn.exe 1900 pdvpj.exe 2308 9xlrlrf.exe 2248 thnntt.exe 1616 vjpvv.exe 2468 ffrxlfx.exe 692 tbnhhn.exe 1308 vpjdj.exe 1316 vpddd.exe 396 5fffflr.exe 936 bbhhht.exe 1336 dpvpv.exe 1324 dvppj.exe -
Processes:
resource yara_rule behavioral19/memory/2400-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2400-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2928-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1792-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1792-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1792-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1172-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2828-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2828-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2828-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2856-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2856-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2856-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2432-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2432-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2432-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2664-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2060-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2060-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2060-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2544-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2596-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2340-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2136-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1904-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2452-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2564-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2488-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2104-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2088-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1492-282-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1xrxxxf.exe5htnnh.exe7hnbnt.exethtbnn.exerrfflrf.exehbnthb.exebnhtnh.exellflrrx.exerlxlrlx.exellxflfr.exevppvj.exebhnttn.exevjdjd.exenhthnb.exehbnbnn.exehnbbbt.exexrfxxxx.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BlackMoon.exerrlfxfr.exetttbnh.exexlflrxf.exettntth.exexrrrxxf.exepjdpd.exehhtbnb.exejjppd.exe5nhntb.exehbtbhh.exerlxllfl.exehnthhb.exe1rfflrx.exenbtnbb.exexllrrxl.exedescription pid process target process PID 2400 wrote to memory of 2928 2400 BlackMoon.exe rrlfxfr.exe PID 2400 wrote to memory of 2928 2400 BlackMoon.exe rrlfxfr.exe PID 2400 wrote to memory of 2928 2400 BlackMoon.exe rrlfxfr.exe PID 2400 wrote to memory of 2928 2400 BlackMoon.exe rrlfxfr.exe PID 2928 wrote to memory of 1792 2928 rrlfxfr.exe tttbnh.exe PID 2928 wrote to memory of 1792 2928 rrlfxfr.exe tttbnh.exe PID 2928 wrote to memory of 1792 2928 rrlfxfr.exe tttbnh.exe PID 2928 wrote to memory of 1792 2928 rrlfxfr.exe tttbnh.exe PID 1792 wrote to memory of 1172 1792 tttbnh.exe xlflrxf.exe PID 1792 wrote to memory of 1172 1792 tttbnh.exe xlflrxf.exe PID 1792 wrote to memory of 1172 1792 tttbnh.exe xlflrxf.exe PID 1792 wrote to memory of 1172 1792 tttbnh.exe xlflrxf.exe PID 1172 wrote to memory of 2828 1172 xlflrxf.exe ttntth.exe PID 1172 wrote to memory of 2828 1172 xlflrxf.exe ttntth.exe PID 1172 wrote to memory of 2828 1172 xlflrxf.exe ttntth.exe PID 1172 wrote to memory of 2828 1172 xlflrxf.exe ttntth.exe PID 2828 wrote to memory of 2856 2828 ttntth.exe xrrrxxf.exe PID 2828 wrote to memory of 2856 2828 ttntth.exe xrrrxxf.exe PID 2828 wrote to memory of 2856 2828 ttntth.exe xrrrxxf.exe PID 2828 wrote to memory of 2856 2828 ttntth.exe xrrrxxf.exe PID 2856 wrote to memory of 2432 2856 xrrrxxf.exe pjdpd.exe PID 2856 wrote to memory of 2432 2856 xrrrxxf.exe pjdpd.exe PID 2856 wrote to memory of 2432 2856 xrrrxxf.exe pjdpd.exe PID 2856 wrote to memory of 2432 2856 xrrrxxf.exe pjdpd.exe PID 2432 wrote to memory of 2664 2432 pjdpd.exe hhtbnb.exe PID 2432 wrote to memory of 2664 2432 pjdpd.exe hhtbnb.exe PID 2432 wrote to memory of 2664 2432 pjdpd.exe hhtbnb.exe PID 2432 wrote to memory of 2664 2432 pjdpd.exe hhtbnb.exe PID 2664 wrote to memory of 2060 2664 hhtbnb.exe jjppd.exe PID 2664 wrote to memory of 2060 2664 hhtbnb.exe jjppd.exe PID 2664 wrote to memory of 2060 2664 hhtbnb.exe jjppd.exe PID 2664 wrote to memory of 2060 2664 hhtbnb.exe jjppd.exe PID 2060 wrote to memory of 2544 2060 jjppd.exe 5nhntb.exe PID 2060 wrote to memory of 2544 2060 jjppd.exe 5nhntb.exe PID 2060 wrote to memory of 2544 2060 jjppd.exe 5nhntb.exe PID 2060 wrote to memory of 2544 2060 jjppd.exe 5nhntb.exe PID 2544 wrote to memory of 2596 2544 5nhntb.exe hbtbhh.exe PID 2544 wrote to memory of 2596 2544 5nhntb.exe hbtbhh.exe PID 2544 wrote to memory of 2596 2544 5nhntb.exe hbtbhh.exe PID 2544 wrote to memory of 2596 2544 5nhntb.exe hbtbhh.exe PID 2596 wrote to memory of 868 2596 hbtbhh.exe rlxllfl.exe PID 2596 wrote to memory of 868 2596 hbtbhh.exe rlxllfl.exe PID 2596 wrote to memory of 868 2596 hbtbhh.exe rlxllfl.exe PID 2596 wrote to memory of 868 2596 hbtbhh.exe rlxllfl.exe PID 868 wrote to memory of 2340 868 rlxllfl.exe hnthhb.exe PID 868 wrote to memory of 2340 868 rlxllfl.exe hnthhb.exe PID 868 wrote to memory of 2340 868 rlxllfl.exe hnthhb.exe PID 868 wrote to memory of 2340 868 rlxllfl.exe hnthhb.exe PID 2340 wrote to memory of 1040 2340 hnthhb.exe 1rfflrx.exe PID 2340 wrote to memory of 1040 2340 hnthhb.exe 1rfflrx.exe PID 2340 wrote to memory of 1040 2340 hnthhb.exe 1rfflrx.exe PID 2340 wrote to memory of 1040 2340 hnthhb.exe 1rfflrx.exe PID 1040 wrote to memory of 2180 1040 1rfflrx.exe nbtnbb.exe PID 1040 wrote to memory of 2180 1040 1rfflrx.exe nbtnbb.exe PID 1040 wrote to memory of 2180 1040 1rfflrx.exe nbtnbb.exe PID 1040 wrote to memory of 2180 1040 1rfflrx.exe nbtnbb.exe PID 2180 wrote to memory of 2136 2180 nbtnbb.exe xllrrxl.exe PID 2180 wrote to memory of 2136 2180 nbtnbb.exe xllrrxl.exe PID 2180 wrote to memory of 2136 2180 nbtnbb.exe xllrrxl.exe PID 2180 wrote to memory of 2136 2180 nbtnbb.exe xllrrxl.exe PID 2136 wrote to memory of 1904 2136 xllrrxl.exe nnnhbh.exe PID 2136 wrote to memory of 1904 2136 xllrrxl.exe nnnhbh.exe PID 2136 wrote to memory of 1904 2136 xllrrxl.exe nnnhbh.exe PID 2136 wrote to memory of 1904 2136 xllrrxl.exe nnnhbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\rrlfxfr.exec:\rrlfxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\tttbnh.exec:\tttbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\xlflrxf.exec:\xlflrxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\ttntth.exec:\ttntth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\xrrrxxf.exec:\xrrrxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\pjdpd.exec:\pjdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\hhtbnb.exec:\hhtbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\jjppd.exec:\jjppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\5nhntb.exec:\5nhntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\hbtbhh.exec:\hbtbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\rlxllfl.exec:\rlxllfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\hnthhb.exec:\hnthhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\1rfflrx.exec:\1rfflrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\nbtnbb.exec:\nbtnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\xllrrxl.exec:\xllrrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\nnnhbh.exec:\nnnhbh.exe17⤵
- Executes dropped EXE
PID:1904 -
\??\c:\xfrfxrl.exec:\xfrfxrl.exe18⤵
- Executes dropped EXE
PID:2452 -
\??\c:\9thbhn.exec:\9thbhn.exe19⤵
- Executes dropped EXE
PID:2984 -
\??\c:\frrfrfx.exec:\frrfrfx.exe20⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ntbttt.exec:\ntbttt.exe21⤵
- Executes dropped EXE
PID:1372 -
\??\c:\vdpjd.exec:\vdpjd.exe22⤵
- Executes dropped EXE
PID:1880 -
\??\c:\fflxrxr.exec:\fflxrxr.exe23⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vvvvd.exec:\vvvvd.exe24⤵
- Executes dropped EXE
PID:2488 -
\??\c:\flrlllr.exec:\flrlllr.exe25⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5bnnbh.exec:\5bnnbh.exe26⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dvpvj.exec:\dvpvj.exe27⤵
- Executes dropped EXE
PID:2088 -
\??\c:\9rrrxll.exec:\9rrrxll.exe28⤵
- Executes dropped EXE
PID:1156 -
\??\c:\bttbtb.exec:\bttbtb.exe29⤵
- Executes dropped EXE
PID:1492 -
\??\c:\pddpp.exec:\pddpp.exe30⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rrxfxfl.exec:\rrxfxfl.exe31⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vpdpv.exec:\vpdpv.exe32⤵
- Executes dropped EXE
PID:1212 -
\??\c:\rrlrflx.exec:\rrlrflx.exe33⤵
- Executes dropped EXE
PID:1708 -
\??\c:\tbhhhh.exec:\tbhhhh.exe34⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jjjdp.exec:\jjjdp.exe35⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5frlflr.exec:\5frlflr.exe36⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nththh.exec:\nththh.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ppjvv.exec:\ppjvv.exe38⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xxffxxf.exec:\xxffxxf.exe39⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rrfflxl.exec:\rrfflxl.exe40⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ttbhht.exec:\ttbhht.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\dpvvd.exec:\dpvvd.exe42⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xfxfxxl.exec:\xfxfxxl.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nhthnb.exec:\nhthnb.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676 -
\??\c:\hhbhhn.exec:\hhbhhn.exe45⤵
- Executes dropped EXE
PID:1176 -
\??\c:\vvppv.exec:\vvppv.exe46⤵
- Executes dropped EXE
PID:1528 -
\??\c:\llffrxx.exec:\llffrxx.exe47⤵
- Executes dropped EXE
PID:1052 -
\??\c:\bbtbhh.exec:\bbtbhh.exe48⤵
- Executes dropped EXE
PID:1580 -
\??\c:\hbnbnn.exec:\hbnbnn.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:868 -
\??\c:\jdddd.exec:\jdddd.exe50⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xlrlxfl.exec:\xlrlxfl.exe51⤵
- Executes dropped EXE
PID:1756 -
\??\c:\ntbhtb.exec:\ntbhtb.exe52⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hbnbnn.exec:\hbnbnn.exe53⤵
- Executes dropped EXE
PID:300 -
\??\c:\pdvpj.exec:\pdvpj.exe54⤵
- Executes dropped EXE
PID:1900 -
\??\c:\9xlrlrf.exec:\9xlrlrf.exe55⤵
- Executes dropped EXE
PID:2308 -
\??\c:\thnntt.exec:\thnntt.exe56⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vjpvv.exec:\vjpvv.exe57⤵
- Executes dropped EXE
PID:1616 -
\??\c:\ffrxlfx.exec:\ffrxlfx.exe58⤵
- Executes dropped EXE
PID:2468 -
\??\c:\tbnhhn.exec:\tbnhhn.exe59⤵
- Executes dropped EXE
PID:692 -
\??\c:\vpjdj.exec:\vpjdj.exe60⤵
- Executes dropped EXE
PID:1308 -
\??\c:\vpddd.exec:\vpddd.exe61⤵
- Executes dropped EXE
PID:1316 -
\??\c:\5fffflr.exec:\5fffflr.exe62⤵
- Executes dropped EXE
PID:396 -
\??\c:\bbhhht.exec:\bbhhht.exe63⤵
- Executes dropped EXE
PID:936 -
\??\c:\dpvpv.exec:\dpvpv.exe64⤵
- Executes dropped EXE
PID:1336 -
\??\c:\dvppj.exec:\dvppj.exe65⤵
- Executes dropped EXE
PID:1324 -
\??\c:\frlrffl.exec:\frlrffl.exe66⤵PID:2920
-
\??\c:\tttbnt.exec:\tttbnt.exe67⤵PID:988
-
\??\c:\nhnhnt.exec:\nhnhnt.exe68⤵PID:2352
-
\??\c:\dpdjp.exec:\dpdjp.exe69⤵PID:1156
-
\??\c:\3fxxxxx.exec:\3fxxxxx.exe70⤵PID:1740
-
\??\c:\hbhtbt.exec:\hbhtbt.exe71⤵PID:888
-
\??\c:\hhnnbb.exec:\hhnnbb.exe72⤵PID:1512
-
\??\c:\ppddj.exec:\ppddj.exe73⤵PID:2396
-
\??\c:\lfrxffl.exec:\lfrxffl.exe74⤵PID:2212
-
\??\c:\hbbbhb.exec:\hbbbhb.exe75⤵PID:1488
-
\??\c:\bnbbhh.exec:\bnbbhh.exe76⤵PID:2692
-
\??\c:\jjjdv.exec:\jjjdv.exe77⤵PID:2284
-
\??\c:\llfrxxf.exec:\llfrxxf.exe78⤵PID:2740
-
\??\c:\hthbbt.exec:\hthbbt.exe79⤵PID:2872
-
\??\c:\hbtttt.exec:\hbtttt.exe80⤵PID:2736
-
\??\c:\vpddp.exec:\vpddp.exe81⤵PID:2312
-
\??\c:\vdvvv.exec:\vdvvv.exe82⤵PID:2968
-
\??\c:\rlxxrlr.exec:\rlxxrlr.exe83⤵PID:2536
-
\??\c:\tbnbnb.exec:\tbnbnb.exe84⤵PID:2784
-
\??\c:\dvpvv.exec:\dvpvv.exe85⤵PID:2732
-
\??\c:\3ddvd.exec:\3ddvd.exe86⤵PID:2624
-
\??\c:\rrlxllx.exec:\rrlxllx.exe87⤵PID:3040
-
\??\c:\tbtnht.exec:\tbtnht.exe88⤵PID:2184
-
\??\c:\ppjvv.exec:\ppjvv.exe89⤵PID:2596
-
\??\c:\xlffrrx.exec:\xlffrrx.exe90⤵PID:1800
-
\??\c:\9rxxxxf.exec:\9rxxxxf.exe91⤵PID:404
-
\??\c:\ttbbhn.exec:\ttbbhn.exe92⤵PID:464
-
\??\c:\pjdvd.exec:\pjdvd.exe93⤵PID:1868
-
\??\c:\pvdpv.exec:\pvdpv.exe94⤵PID:1788
-
\??\c:\rlxfrxr.exec:\rlxfrxr.exe95⤵PID:2188
-
\??\c:\bttnbt.exec:\bttnbt.exe96⤵PID:2064
-
\??\c:\vvpjv.exec:\vvpjv.exe97⤵PID:2980
-
\??\c:\jdpjp.exec:\jdpjp.exe98⤵PID:1876
-
\??\c:\1lxxffl.exec:\1lxxffl.exe99⤵PID:588
-
\??\c:\bnbntn.exec:\bnbntn.exe100⤵PID:1612
-
\??\c:\djdjj.exec:\djdjj.exe101⤵PID:1768
-
\??\c:\vvpjd.exec:\vvpjd.exe102⤵PID:960
-
\??\c:\7fxflrf.exec:\7fxflrf.exe103⤵PID:2924
-
\??\c:\tnhthh.exec:\tnhthh.exe104⤵PID:1540
-
\??\c:\jpdjv.exec:\jpdjv.exe105⤵PID:2912
-
\??\c:\dvvdd.exec:\dvvdd.exe106⤵PID:1272
-
\??\c:\xrllrxf.exec:\xrllrxf.exe107⤵PID:2264
-
\??\c:\nbbhnn.exec:\nbbhnn.exe108⤵PID:704
-
\??\c:\dpdpp.exec:\dpdpp.exe109⤵PID:2364
-
\??\c:\1jddd.exec:\1jddd.exe110⤵PID:2372
-
\??\c:\frffllr.exec:\frffllr.exe111⤵PID:1804
-
\??\c:\hthnbb.exec:\hthnbb.exe112⤵PID:2108
-
\??\c:\tnbbhn.exec:\tnbbhn.exe113⤵PID:2100
-
\??\c:\vjddj.exec:\vjddj.exe114⤵PID:2356
-
\??\c:\xxrlrxl.exec:\xxrlrxl.exe115⤵PID:1596
-
\??\c:\nnnhtn.exec:\nnnhtn.exe116⤵PID:2532
-
\??\c:\jpdvj.exec:\jpdvj.exe117⤵PID:2884
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe118⤵PID:2208
-
\??\c:\hbntnt.exec:\hbntnt.exe119⤵PID:2444
-
\??\c:\jjvdj.exec:\jjvdj.exe120⤵PID:2716
-
\??\c:\1xrxflr.exec:\1xrxflr.exe121⤵PID:2748
-
\??\c:\1dvpv.exec:\1dvpv.exe122⤵PID:2760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-