Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows7-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
10Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2024 13:51
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240802-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral20/memory/116-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/5012-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1748-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1952-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1044-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4604-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3916-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2780-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3860-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2192-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4000-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3904-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/980-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1876-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1552-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3352-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2044-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4528-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3992-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4228-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2152-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3488-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/992-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3080-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2012-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/684-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2736-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fxrxxxx.exennntth.exejjdpv.exetththn.exejpvdv.exenbnhht.exedpppj.exehbbnhn.exevvppd.exevjdjp.exehhbbhn.exejjjdp.exenbtnnn.exedddvj.exepdvpp.exexfflllf.exeppvdj.exejvdjv.exetnhthn.exepvjjp.exexfxlrfx.exevvjjj.exetbttnb.exexlfrxll.exe9hthhn.exenthntb.exerxxrrrx.exejjjdv.exepjvpj.exe1xllflr.exexxlllff.exexrflflr.exejjppp.exedppvd.exefxllflr.exetbbhhn.exedvvjp.exexfxrlrr.exetbtttb.exejvjjj.exelxxxxff.exe7bhhhn.exedpddv.exellxllfr.exetbbbbn.exepvvdd.exejvjjj.exerlffxll.exehbnntb.exejjvdp.exefrxfxfx.exenntbtn.exevvjjv.exedpvvd.exexrllfxf.exenhnhnt.exedvdvv.exelfllllf.exehntbht.exebtbbbt.exejjppv.exelfllrlr.exetbbbht.exevjvdd.exepid process 5012 fxrxxxx.exe 1748 nnntth.exe 1952 jjdpv.exe 1044 tththn.exe 4604 jpvdv.exe 3916 nbnhht.exe 3860 dpppj.exe 2780 hbbnhn.exe 2192 vvppd.exe 4000 vjdjp.exe 3904 hhbbhn.exe 3528 jjjdp.exe 980 nbtnnn.exe 1552 dddvj.exe 1876 pdvpp.exe 3352 xfflllf.exe 2044 ppvdj.exe 4528 jvdjv.exe 3992 tnhthn.exe 320 pvjjp.exe 4228 xfxlrfx.exe 3488 vvjjj.exe 2152 tbttnb.exe 388 xlfrxll.exe 992 9hthhn.exe 3080 nthntb.exe 2012 rxxrrrx.exe 1792 jjjdv.exe 684 pjvpj.exe 2652 1xllflr.exe 2736 xxlllff.exe 3772 xrflflr.exe 540 jjppp.exe 3428 dppvd.exe 3728 fxllflr.exe 1228 tbbhhn.exe 4508 dvvjp.exe 4364 xfxrlrr.exe 2872 tbtttb.exe 1380 jvjjj.exe 2880 lxxxxff.exe 4156 7bhhhn.exe 3792 dpddv.exe 3900 llxllfr.exe 2220 tbbbbn.exe 2716 pvvdd.exe 4292 jvjjj.exe 2552 rlffxll.exe 2436 hbnntb.exe 2260 jjvdp.exe 3136 frxfxfx.exe 4324 nntbtn.exe 3384 vvjjv.exe 1028 dpvvd.exe 4692 xrllfxf.exe 4000 nhnhnt.exe 3904 dvdvv.exe 3528 lfllllf.exe 980 hntbht.exe 472 btbbbt.exe 2476 jjppv.exe 2172 lfllrlr.exe 3484 tbbbht.exe 440 vjvdd.exe -
Processes:
resource yara_rule behavioral20/memory/116-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/5012-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1748-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1952-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1044-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4604-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3916-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3916-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3860-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2780-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3860-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2192-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4000-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3904-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/980-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1876-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1552-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3352-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2044-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4528-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3992-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4228-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2152-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3488-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/992-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3080-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2012-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/684-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2736-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hntbht.exetbntth.exentnhhh.exepvjvv.exefxxxllx.exennbhnt.exejvjpj.exedjppp.exeddppv.exelxfflxx.exehttbnh.exentbhtb.exehtntnh.exexlrfffr.exerrlxfrr.exetnhhbb.exetbnnht.exexrllrlf.exeflfrlrf.exevvdvp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfflxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BlackMoon.exefxrxxxx.exennntth.exejjdpv.exetththn.exejpvdv.exenbnhht.exedpppj.exehbbnhn.exevvppd.exevjdjp.exehhbbhn.exejjjdp.exenbtnnn.exedddvj.exepdvpp.exexfflllf.exeppvdj.exejvdjv.exetnhthn.exepvjjp.exexfxlrfx.exedescription pid process target process PID 116 wrote to memory of 5012 116 BlackMoon.exe fxrxxxx.exe PID 116 wrote to memory of 5012 116 BlackMoon.exe fxrxxxx.exe PID 116 wrote to memory of 5012 116 BlackMoon.exe fxrxxxx.exe PID 5012 wrote to memory of 1748 5012 fxrxxxx.exe nnntth.exe PID 5012 wrote to memory of 1748 5012 fxrxxxx.exe nnntth.exe PID 5012 wrote to memory of 1748 5012 fxrxxxx.exe nnntth.exe PID 1748 wrote to memory of 1952 1748 nnntth.exe jjdpv.exe PID 1748 wrote to memory of 1952 1748 nnntth.exe jjdpv.exe PID 1748 wrote to memory of 1952 1748 nnntth.exe jjdpv.exe PID 1952 wrote to memory of 1044 1952 jjdpv.exe tththn.exe PID 1952 wrote to memory of 1044 1952 jjdpv.exe tththn.exe PID 1952 wrote to memory of 1044 1952 jjdpv.exe tththn.exe PID 1044 wrote to memory of 4604 1044 tththn.exe jpvdv.exe PID 1044 wrote to memory of 4604 1044 tththn.exe jpvdv.exe PID 1044 wrote to memory of 4604 1044 tththn.exe jpvdv.exe PID 4604 wrote to memory of 3916 4604 jpvdv.exe nbnhht.exe PID 4604 wrote to memory of 3916 4604 jpvdv.exe nbnhht.exe PID 4604 wrote to memory of 3916 4604 jpvdv.exe nbnhht.exe PID 3916 wrote to memory of 3860 3916 nbnhht.exe dpppj.exe PID 3916 wrote to memory of 3860 3916 nbnhht.exe dpppj.exe PID 3916 wrote to memory of 3860 3916 nbnhht.exe dpppj.exe PID 3860 wrote to memory of 2780 3860 dpppj.exe hbbnhn.exe PID 3860 wrote to memory of 2780 3860 dpppj.exe hbbnhn.exe PID 3860 wrote to memory of 2780 3860 dpppj.exe hbbnhn.exe PID 2780 wrote to memory of 2192 2780 hbbnhn.exe vvppd.exe PID 2780 wrote to memory of 2192 2780 hbbnhn.exe vvppd.exe PID 2780 wrote to memory of 2192 2780 hbbnhn.exe vvppd.exe PID 2192 wrote to memory of 4000 2192 vvppd.exe nhnhnt.exe PID 2192 wrote to memory of 4000 2192 vvppd.exe nhnhnt.exe PID 2192 wrote to memory of 4000 2192 vvppd.exe nhnhnt.exe PID 4000 wrote to memory of 3904 4000 vjdjp.exe dvdvv.exe PID 4000 wrote to memory of 3904 4000 vjdjp.exe dvdvv.exe PID 4000 wrote to memory of 3904 4000 vjdjp.exe dvdvv.exe PID 3904 wrote to memory of 3528 3904 hhbbhn.exe lfllllf.exe PID 3904 wrote to memory of 3528 3904 hhbbhn.exe lfllllf.exe PID 3904 wrote to memory of 3528 3904 hhbbhn.exe lfllllf.exe PID 3528 wrote to memory of 980 3528 jjjdp.exe hntbht.exe PID 3528 wrote to memory of 980 3528 jjjdp.exe hntbht.exe PID 3528 wrote to memory of 980 3528 jjjdp.exe hntbht.exe PID 980 wrote to memory of 1552 980 nbtnnn.exe dddvj.exe PID 980 wrote to memory of 1552 980 nbtnnn.exe dddvj.exe PID 980 wrote to memory of 1552 980 nbtnnn.exe dddvj.exe PID 1552 wrote to memory of 1876 1552 dddvj.exe pdvpp.exe PID 1552 wrote to memory of 1876 1552 dddvj.exe pdvpp.exe PID 1552 wrote to memory of 1876 1552 dddvj.exe pdvpp.exe PID 1876 wrote to memory of 3352 1876 pdvpp.exe xfflllf.exe PID 1876 wrote to memory of 3352 1876 pdvpp.exe xfflllf.exe PID 1876 wrote to memory of 3352 1876 pdvpp.exe xfflllf.exe PID 3352 wrote to memory of 2044 3352 xfflllf.exe svchost.exe PID 3352 wrote to memory of 2044 3352 xfflllf.exe svchost.exe PID 3352 wrote to memory of 2044 3352 xfflllf.exe svchost.exe PID 2044 wrote to memory of 4528 2044 ppvdj.exe jvdjv.exe PID 2044 wrote to memory of 4528 2044 ppvdj.exe jvdjv.exe PID 2044 wrote to memory of 4528 2044 ppvdj.exe jvdjv.exe PID 4528 wrote to memory of 3992 4528 jvdjv.exe tnhthn.exe PID 4528 wrote to memory of 3992 4528 jvdjv.exe tnhthn.exe PID 4528 wrote to memory of 3992 4528 jvdjv.exe tnhthn.exe PID 3992 wrote to memory of 320 3992 tnhthn.exe pvjjp.exe PID 3992 wrote to memory of 320 3992 tnhthn.exe pvjjp.exe PID 3992 wrote to memory of 320 3992 tnhthn.exe pvjjp.exe PID 320 wrote to memory of 4228 320 pvjjp.exe xfxlrfx.exe PID 320 wrote to memory of 4228 320 pvjjp.exe xfxlrfx.exe PID 320 wrote to memory of 4228 320 pvjjp.exe xfxlrfx.exe PID 4228 wrote to memory of 3488 4228 xfxlrfx.exe vvjjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\fxrxxxx.exec:\fxrxxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\nnntth.exec:\nnntth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\jjdpv.exec:\jjdpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\tththn.exec:\tththn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\jpvdv.exec:\jpvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\nbnhht.exec:\nbnhht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\dpppj.exec:\dpppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\hbbnhn.exec:\hbbnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vvppd.exec:\vvppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\vjdjp.exec:\vjdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\hhbbhn.exec:\hhbbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\jjjdp.exec:\jjjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\nbtnnn.exec:\nbtnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\dddvj.exec:\dddvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\pdvpp.exec:\pdvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\xfflllf.exec:\xfflllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\ppvdj.exec:\ppvdj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\jvdjv.exec:\jvdjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\tnhthn.exec:\tnhthn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\pvjjp.exec:\pvjjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\xfxlrfx.exec:\xfxlrfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\vvjjj.exec:\vvjjj.exe23⤵
- Executes dropped EXE
PID:3488 -
\??\c:\tbttnb.exec:\tbttnb.exe24⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xlfrxll.exec:\xlfrxll.exe25⤵
- Executes dropped EXE
PID:388 -
\??\c:\9hthhn.exec:\9hthhn.exe26⤵
- Executes dropped EXE
PID:992 -
\??\c:\nthntb.exec:\nthntb.exe27⤵
- Executes dropped EXE
PID:3080 -
\??\c:\rxxrrrx.exec:\rxxrrrx.exe28⤵
- Executes dropped EXE
PID:2012 -
\??\c:\jjjdv.exec:\jjjdv.exe29⤵
- Executes dropped EXE
PID:1792 -
\??\c:\pjvpj.exec:\pjvpj.exe30⤵
- Executes dropped EXE
PID:684 -
\??\c:\1xllflr.exec:\1xllflr.exe31⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xxlllff.exec:\xxlllff.exe32⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xrflflr.exec:\xrflflr.exe33⤵
- Executes dropped EXE
PID:3772 -
\??\c:\jjppp.exec:\jjppp.exe34⤵
- Executes dropped EXE
PID:540 -
\??\c:\dppvd.exec:\dppvd.exe35⤵
- Executes dropped EXE
PID:3428 -
\??\c:\fxllflr.exec:\fxllflr.exe36⤵
- Executes dropped EXE
PID:3728 -
\??\c:\tbbhhn.exec:\tbbhhn.exe37⤵
- Executes dropped EXE
PID:1228 -
\??\c:\dvvjp.exec:\dvvjp.exe38⤵
- Executes dropped EXE
PID:4508 -
\??\c:\xfxrlrr.exec:\xfxrlrr.exe39⤵
- Executes dropped EXE
PID:4364 -
\??\c:\tbtttb.exec:\tbtttb.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jvjjj.exec:\jvjjj.exe41⤵
- Executes dropped EXE
PID:1380 -
\??\c:\lxxxxff.exec:\lxxxxff.exe42⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7bhhhn.exec:\7bhhhn.exe43⤵
- Executes dropped EXE
PID:4156 -
\??\c:\dpddv.exec:\dpddv.exe44⤵
- Executes dropped EXE
PID:3792 -
\??\c:\llxllfr.exec:\llxllfr.exe45⤵
- Executes dropped EXE
PID:3900 -
\??\c:\tbbbbn.exec:\tbbbbn.exe46⤵
- Executes dropped EXE
PID:2220 -
\??\c:\pvvdd.exec:\pvvdd.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jvjjj.exec:\jvjjj.exe48⤵
- Executes dropped EXE
PID:4292 -
\??\c:\rlffxll.exec:\rlffxll.exe49⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hbnntb.exec:\hbnntb.exe50⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jjvdp.exec:\jjvdp.exe51⤵
- Executes dropped EXE
PID:2260 -
\??\c:\frxfxfx.exec:\frxfxfx.exe52⤵
- Executes dropped EXE
PID:3136 -
\??\c:\nntbtn.exec:\nntbtn.exe53⤵
- Executes dropped EXE
PID:4324 -
\??\c:\vvjjv.exec:\vvjjv.exe54⤵
- Executes dropped EXE
PID:3384 -
\??\c:\dpvvd.exec:\dpvvd.exe55⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xrllfxf.exec:\xrllfxf.exe56⤵
- Executes dropped EXE
PID:4692 -
\??\c:\nhnhnt.exec:\nhnhnt.exe57⤵
- Executes dropped EXE
PID:4000 -
\??\c:\dvdvv.exec:\dvdvv.exe58⤵
- Executes dropped EXE
PID:3904 -
\??\c:\lfllllf.exec:\lfllllf.exe59⤵
- Executes dropped EXE
PID:3528 -
\??\c:\hntbht.exec:\hntbht.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:980 -
\??\c:\btbbbt.exec:\btbbbt.exe61⤵
- Executes dropped EXE
PID:472 -
\??\c:\jjppv.exec:\jjppv.exe62⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lfllrlr.exec:\lfllrlr.exe63⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tbbbht.exec:\tbbbht.exe64⤵
- Executes dropped EXE
PID:3484 -
\??\c:\vjvdd.exec:\vjvdd.exe65⤵
- Executes dropped EXE
PID:440 -
\??\c:\lxlxrxx.exec:\lxlxrxx.exe66⤵PID:4012
-
\??\c:\hnhhhn.exec:\hnhhhn.exe67⤵PID:5068
-
\??\c:\tnnhtt.exec:\tnnhtt.exe68⤵PID:4680
-
\??\c:\jjpjp.exec:\jjpjp.exe69⤵PID:4944
-
\??\c:\xxflrlr.exec:\xxflrlr.exe70⤵PID:1996
-
\??\c:\3nnbbh.exec:\3nnbbh.exe71⤵PID:388
-
\??\c:\7jvdv.exec:\7jvdv.exe72⤵PID:992
-
\??\c:\rrxxxfx.exec:\rrxxxfx.exe73⤵PID:3520
-
\??\c:\bhnbnt.exec:\bhnbnt.exe74⤵PID:2512
-
\??\c:\1jvjv.exec:\1jvjv.exe75⤵PID:4456
-
\??\c:\xllffrx.exec:\xllffrx.exe76⤵PID:684
-
\??\c:\httbnh.exec:\httbnh.exe77⤵PID:3944
-
\??\c:\7hnbbb.exec:\7hnbbb.exe78⤵PID:4584
-
\??\c:\frxlxxf.exec:\frxlxxf.exe79⤵PID:2036
-
\??\c:\xrllrlf.exec:\xrllrlf.exe80⤵
- System Location Discovery: System Language Discovery
PID:3772 -
\??\c:\tntnbh.exec:\tntnbh.exe81⤵PID:540
-
\??\c:\djjdd.exec:\djjdd.exe82⤵PID:3428
-
\??\c:\llrxfxf.exec:\llrxfxf.exe83⤵PID:3728
-
\??\c:\nbhhnt.exec:\nbhhnt.exe84⤵PID:3424
-
\??\c:\vdpjj.exec:\vdpjj.exe85⤵PID:4384
-
\??\c:\lxrrlrx.exec:\lxrrlrx.exe86⤵PID:3532
-
\??\c:\htbthb.exec:\htbthb.exe87⤵PID:3980
-
\??\c:\tbtnhb.exec:\tbtnhb.exe88⤵PID:5012
-
\??\c:\dppdj.exec:\dppdj.exe89⤵PID:2732
-
\??\c:\fxffxrr.exec:\fxffxrr.exe90⤵PID:3732
-
\??\c:\hntntn.exec:\hntntn.exe91⤵PID:2364
-
\??\c:\ddpdj.exec:\ddpdj.exe92⤵PID:4192
-
\??\c:\rxflxlr.exec:\rxflxlr.exe93⤵PID:4640
-
\??\c:\3frrrxl.exec:\3frrrxl.exe94⤵PID:2716
-
\??\c:\hbnhtt.exec:\hbnhtt.exe95⤵PID:4292
-
\??\c:\dpvpj.exec:\dpvpj.exe96⤵PID:5100
-
\??\c:\5vjdd.exec:\5vjdd.exe97⤵PID:1520
-
\??\c:\rrrrrll.exec:\rrrrrll.exe98⤵PID:4816
-
\??\c:\9nbbbh.exec:\9nbbbh.exe99⤵PID:3244
-
\??\c:\nhnttt.exec:\nhnttt.exe100⤵PID:2340
-
\??\c:\jdvvj.exec:\jdvvj.exe101⤵PID:5028
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe102⤵PID:2460
-
\??\c:\tbntnb.exec:\tbntnb.exe103⤵PID:1536
-
\??\c:\hbhnnn.exec:\hbhnnn.exe104⤵PID:2504
-
\??\c:\jdjvd.exec:\jdjvd.exe105⤵PID:3236
-
\??\c:\rfrrflx.exec:\rfrrflx.exe106⤵PID:1216
-
\??\c:\btnbnt.exec:\btnbnt.exe107⤵PID:4904
-
\??\c:\pdjdd.exec:\pdjdd.exe108⤵PID:212
-
\??\c:\lfrllxx.exec:\lfrllxx.exe109⤵PID:3372
-
\??\c:\rfrxxfr.exec:\rfrxxfr.exe110⤵PID:2644
-
\??\c:\bbhhnt.exec:\bbhhnt.exe111⤵PID:4532
-
\??\c:\dddjp.exec:\dddjp.exe112⤵PID:3056
-
\??\c:\xflrrxx.exec:\xflrrxx.exe113⤵PID:4564
-
\??\c:\xxlrlxf.exec:\xxlrlxf.exe114⤵PID:2792
-
\??\c:\hhhbnt.exec:\hhhbnt.exe115⤵PID:4200
-
\??\c:\vvdvj.exec:\vvdvj.exe116⤵PID:4348
-
\??\c:\fxxxllx.exec:\fxxxllx.exe117⤵
- System Location Discovery: System Language Discovery
PID:4568 -
\??\c:\rxxlfrr.exec:\rxxlfrr.exe118⤵PID:2448
-
\??\c:\tthnhh.exec:\tthnhh.exe119⤵PID:1984
-
\??\c:\ppddj.exec:\ppddj.exe120⤵PID:792
-
\??\c:\vvjpv.exec:\vvjpv.exe121⤵PID:3556
-
\??\c:\xxlffxx.exec:\xxlffxx.exe122⤵PID:4044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-