Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows7-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
10Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2024 14:02
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240802-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral20/memory/3000-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3000-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3660-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/60-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/208-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4256-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1580-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/5000-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1328-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2600-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2600-64-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral20/memory/3308-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/5036-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/452-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3980-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4992-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3972-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4364-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4112-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3252-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2260-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2036-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3616-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1908-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3412-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3660 xrlffxr.exe 60 hhhhhh.exe 208 httthn.exe 4256 thnhnb.exe 1580 ffllffl.exe 5000 nntthh.exe 1328 lrxfxff.exe 2600 flxxflf.exe 5060 nnbbtt.exe 3308 tnbtnn.exe 4792 ntbnhh.exe 4192 rflllrr.exe 5036 xxxrrxr.exe 4696 tbnhhh.exe 452 vjvpp.exe 3980 9xrrlxx.exe 4992 btttnt.exe 3972 fxllllr.exe 4364 fxrrxxx.exe 4112 7ddvp.exe 3252 vjddv.exe 3616 pddvp.exe 2260 rlrrrrf.exe 2036 thtnhh.exe 1908 jdpjj.exe 4772 lxlrrrr.exe 1128 nbhbtt.exe 2684 dvppj.exe 4356 bbtnnn.exe 2640 jpdjj.exe 3412 xxllxfr.exe 2452 lfxrllf.exe 3860 rxffxfl.exe 4264 5ffffrx.exe 3676 1tthht.exe 3008 1djjp.exe 2288 ffrrflf.exe 3520 9nnnhn.exe 4744 tntttb.exe 748 jjppj.exe 4960 flllflf.exe 4444 vdjpj.exe 1428 xfllfrr.exe 3512 rlrlxfr.exe 4512 hbttbh.exe 2860 lxrflxx.exe 3056 bbnnnn.exe 376 9ppjj.exe 2720 pjpvv.exe 1612 fxxffff.exe 5096 5tttnt.exe 4124 ddvpp.exe 5020 fxfxxxr.exe 4788 nnnnnt.exe 2228 nnnhhb.exe 4792 ddvvp.exe 864 rrffflr.exe 1036 ffrrrxf.exe 5036 bbtthn.exe 1636 jvjdd.exe 3156 xrxxxxx.exe 1716 rxrlrlx.exe 3848 1hnhbb.exe 908 pjvpp.exe -
resource yara_rule behavioral20/memory/3000-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3000-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3660-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/60-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/60-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/208-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4256-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1580-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/5000-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1328-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2600-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3308-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/5036-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/452-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3980-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4992-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3972-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4364-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4112-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3252-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2260-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2036-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3616-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1908-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3412-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxffrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3660 3000 BlackMoon.exe 83 PID 3000 wrote to memory of 3660 3000 BlackMoon.exe 83 PID 3000 wrote to memory of 3660 3000 BlackMoon.exe 83 PID 3660 wrote to memory of 60 3660 xrlffxr.exe 84 PID 3660 wrote to memory of 60 3660 xrlffxr.exe 84 PID 3660 wrote to memory of 60 3660 xrlffxr.exe 84 PID 60 wrote to memory of 208 60 hhhhhh.exe 86 PID 60 wrote to memory of 208 60 hhhhhh.exe 86 PID 60 wrote to memory of 208 60 hhhhhh.exe 86 PID 208 wrote to memory of 4256 208 httthn.exe 88 PID 208 wrote to memory of 4256 208 httthn.exe 88 PID 208 wrote to memory of 4256 208 httthn.exe 88 PID 4256 wrote to memory of 1580 4256 thnhnb.exe 90 PID 4256 wrote to memory of 1580 4256 thnhnb.exe 90 PID 4256 wrote to memory of 1580 4256 thnhnb.exe 90 PID 1580 wrote to memory of 5000 1580 ffllffl.exe 91 PID 1580 wrote to memory of 5000 1580 ffllffl.exe 91 PID 1580 wrote to memory of 5000 1580 ffllffl.exe 91 PID 5000 wrote to memory of 1328 5000 nntthh.exe 92 PID 5000 wrote to memory of 1328 5000 nntthh.exe 92 PID 5000 wrote to memory of 1328 5000 nntthh.exe 92 PID 1328 wrote to memory of 2600 1328 lrxfxff.exe 93 PID 1328 wrote to memory of 2600 1328 lrxfxff.exe 93 PID 1328 wrote to memory of 2600 1328 lrxfxff.exe 93 PID 2600 wrote to memory of 5060 2600 flxxflf.exe 94 PID 2600 wrote to memory of 5060 2600 flxxflf.exe 94 PID 2600 wrote to memory of 5060 2600 flxxflf.exe 94 PID 5060 wrote to memory of 3308 5060 nnbbtt.exe 95 PID 5060 wrote to memory of 3308 5060 nnbbtt.exe 95 PID 5060 wrote to memory of 3308 5060 nnbbtt.exe 95 PID 3308 wrote to memory of 4792 3308 tnbtnn.exe 96 PID 3308 wrote to memory of 4792 3308 tnbtnn.exe 96 PID 3308 wrote to memory of 4792 3308 tnbtnn.exe 96 PID 4792 wrote to memory of 4192 4792 ntbnhh.exe 97 PID 4792 wrote to memory of 4192 4792 ntbnhh.exe 97 PID 4792 wrote to memory of 4192 4792 ntbnhh.exe 97 PID 4192 wrote to memory of 5036 4192 rflllrr.exe 98 PID 4192 wrote to memory of 5036 4192 rflllrr.exe 98 PID 4192 wrote to memory of 5036 4192 rflllrr.exe 98 PID 5036 wrote to memory of 4696 5036 xxxrrxr.exe 99 PID 5036 wrote to memory of 4696 5036 xxxrrxr.exe 99 PID 5036 wrote to memory of 4696 5036 xxxrrxr.exe 99 PID 4696 wrote to memory of 452 4696 tbnhhh.exe 100 PID 4696 wrote to memory of 452 4696 tbnhhh.exe 100 PID 4696 wrote to memory of 452 4696 tbnhhh.exe 100 PID 452 wrote to memory of 3980 452 vjvpp.exe 101 PID 452 wrote to memory of 3980 452 vjvpp.exe 101 PID 452 wrote to memory of 3980 452 vjvpp.exe 101 PID 3980 wrote to memory of 4992 3980 9xrrlxx.exe 102 PID 3980 wrote to memory of 4992 3980 9xrrlxx.exe 102 PID 3980 wrote to memory of 4992 3980 9xrrlxx.exe 102 PID 4992 wrote to memory of 3972 4992 btttnt.exe 103 PID 4992 wrote to memory of 3972 4992 btttnt.exe 103 PID 4992 wrote to memory of 3972 4992 btttnt.exe 103 PID 3972 wrote to memory of 4364 3972 fxllllr.exe 104 PID 3972 wrote to memory of 4364 3972 fxllllr.exe 104 PID 3972 wrote to memory of 4364 3972 fxllllr.exe 104 PID 4364 wrote to memory of 4112 4364 fxrrxxx.exe 105 PID 4364 wrote to memory of 4112 4364 fxrrxxx.exe 105 PID 4364 wrote to memory of 4112 4364 fxrrxxx.exe 105 PID 4112 wrote to memory of 3252 4112 7ddvp.exe 106 PID 4112 wrote to memory of 3252 4112 7ddvp.exe 106 PID 4112 wrote to memory of 3252 4112 7ddvp.exe 106 PID 3252 wrote to memory of 3616 3252 vjddv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xrlffxr.exec:\xrlffxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\hhhhhh.exec:\hhhhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\httthn.exec:\httthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\thnhnb.exec:\thnhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\ffllffl.exec:\ffllffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\nntthh.exec:\nntthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\lrxfxff.exec:\lrxfxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\flxxflf.exec:\flxxflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nnbbtt.exec:\nnbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\tnbtnn.exec:\tnbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\ntbnhh.exec:\ntbnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\rflllrr.exec:\rflllrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\xxxrrxr.exec:\xxxrrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\tbnhhh.exec:\tbnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\vjvpp.exec:\vjvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\9xrrlxx.exec:\9xrrlxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\btttnt.exec:\btttnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\fxllllr.exec:\fxllllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\fxrrxxx.exec:\fxrrxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\7ddvp.exec:\7ddvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\vjddv.exec:\vjddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\pddvp.exec:\pddvp.exe23⤵
- Executes dropped EXE
PID:3616 -
\??\c:\rlrrrrf.exec:\rlrrrrf.exe24⤵
- Executes dropped EXE
PID:2260 -
\??\c:\thtnhh.exec:\thtnhh.exe25⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jdpjj.exec:\jdpjj.exe26⤵
- Executes dropped EXE
PID:1908 -
\??\c:\lxlrrrr.exec:\lxlrrrr.exe27⤵
- Executes dropped EXE
PID:4772 -
\??\c:\nbhbtt.exec:\nbhbtt.exe28⤵
- Executes dropped EXE
PID:1128 -
\??\c:\dvppj.exec:\dvppj.exe29⤵
- Executes dropped EXE
PID:2684 -
\??\c:\bbtnnn.exec:\bbtnnn.exe30⤵
- Executes dropped EXE
PID:4356 -
\??\c:\jpdjj.exec:\jpdjj.exe31⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xxllxfr.exec:\xxllxfr.exe32⤵
- Executes dropped EXE
PID:3412 -
\??\c:\lfxrllf.exec:\lfxrllf.exe33⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rxffxfl.exec:\rxffxfl.exe34⤵
- Executes dropped EXE
PID:3860 -
\??\c:\5ffffrx.exec:\5ffffrx.exe35⤵
- Executes dropped EXE
PID:4264 -
\??\c:\1tthht.exec:\1tthht.exe36⤵
- Executes dropped EXE
PID:3676 -
\??\c:\1djjp.exec:\1djjp.exe37⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ffrrflf.exec:\ffrrflf.exe38⤵
- Executes dropped EXE
PID:2288 -
\??\c:\9nnnhn.exec:\9nnnhn.exe39⤵
- Executes dropped EXE
PID:3520 -
\??\c:\tntttb.exec:\tntttb.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4744 -
\??\c:\jjppj.exec:\jjppj.exe41⤵
- Executes dropped EXE
PID:748 -
\??\c:\flllflf.exec:\flllflf.exe42⤵
- Executes dropped EXE
PID:4960 -
\??\c:\vdjpj.exec:\vdjpj.exe43⤵
- Executes dropped EXE
PID:4444 -
\??\c:\xfllfrr.exec:\xfllfrr.exe44⤵
- Executes dropped EXE
PID:1428 -
\??\c:\rlrlxfr.exec:\rlrlxfr.exe45⤵
- Executes dropped EXE
PID:3512 -
\??\c:\hbttbh.exec:\hbttbh.exe46⤵
- Executes dropped EXE
PID:4512 -
\??\c:\lxrflxx.exec:\lxrflxx.exe47⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bbnnnn.exec:\bbnnnn.exe48⤵
- Executes dropped EXE
PID:3056 -
\??\c:\9ppjj.exec:\9ppjj.exe49⤵
- Executes dropped EXE
PID:376 -
\??\c:\pjpvv.exec:\pjpvv.exe50⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fxxffff.exec:\fxxffff.exe51⤵
- Executes dropped EXE
PID:1612 -
\??\c:\5tttnt.exec:\5tttnt.exe52⤵
- Executes dropped EXE
PID:5096 -
\??\c:\ddvpp.exec:\ddvpp.exe53⤵
- Executes dropped EXE
PID:4124 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe54⤵
- Executes dropped EXE
PID:5020 -
\??\c:\nnnnnt.exec:\nnnnnt.exe55⤵
- Executes dropped EXE
PID:4788 -
\??\c:\nnnhhb.exec:\nnnhhb.exe56⤵
- Executes dropped EXE
PID:2228 -
\??\c:\ddvvp.exec:\ddvvp.exe57⤵
- Executes dropped EXE
PID:4792 -
\??\c:\rrffflr.exec:\rrffflr.exe58⤵
- Executes dropped EXE
PID:864 -
\??\c:\ffrrrxf.exec:\ffrrrxf.exe59⤵
- Executes dropped EXE
PID:1036 -
\??\c:\bbtthn.exec:\bbtthn.exe60⤵
- Executes dropped EXE
PID:5036 -
\??\c:\jvjdd.exec:\jvjdd.exe61⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe62⤵
- Executes dropped EXE
PID:3156 -
\??\c:\rxrlrlx.exec:\rxrlrlx.exe63⤵
- Executes dropped EXE
PID:1716 -
\??\c:\1hnhbb.exec:\1hnhbb.exe64⤵
- Executes dropped EXE
PID:3848 -
\??\c:\pjvpp.exec:\pjvpp.exe65⤵
- Executes dropped EXE
PID:908 -
\??\c:\ddjdd.exec:\ddjdd.exe66⤵PID:3972
-
\??\c:\rfllffl.exec:\rfllffl.exe67⤵PID:64
-
\??\c:\1tnnhh.exec:\1tnnhh.exe68⤵PID:4452
-
\??\c:\pdvpj.exec:\pdvpj.exe69⤵PID:4800
-
\??\c:\5ppvp.exec:\5ppvp.exe70⤵PID:3692
-
\??\c:\frflxfx.exec:\frflxfx.exe71⤵PID:4460
-
\??\c:\bnbhtb.exec:\bnbhtb.exe72⤵PID:3032
-
\??\c:\dvjjj.exec:\dvjjj.exe73⤵PID:3268
-
\??\c:\dpvpp.exec:\dpvpp.exe74⤵PID:2728
-
\??\c:\xxfffff.exec:\xxfffff.exe75⤵PID:2800
-
\??\c:\hhnthb.exec:\hhnthb.exe76⤵PID:4772
-
\??\c:\jjvvd.exec:\jjvvd.exe77⤵PID:1128
-
\??\c:\dddpj.exec:\dddpj.exe78⤵PID:1616
-
\??\c:\3fxffll.exec:\3fxffll.exe79⤵PID:4356
-
\??\c:\tthbhh.exec:\tthbhh.exe80⤵PID:3004
-
\??\c:\jpppv.exec:\jpppv.exe81⤵PID:2452
-
\??\c:\lrxxxff.exec:\lrxxxff.exe82⤵PID:3188
-
\??\c:\htnnnn.exec:\htnnnn.exe83⤵PID:5080
-
\??\c:\nnhtnh.exec:\nnhtnh.exe84⤵
- System Location Discovery: System Language Discovery
PID:4496 -
\??\c:\9pddd.exec:\9pddd.exe85⤵PID:4308
-
\??\c:\7rfxxff.exec:\7rfxxff.exe86⤵PID:4424
-
\??\c:\nthntn.exec:\nthntn.exe87⤵PID:748
-
\??\c:\ttnntb.exec:\ttnntb.exe88⤵PID:3956
-
\??\c:\vvdjj.exec:\vvdjj.exe89⤵PID:3656
-
\??\c:\lxlrxlx.exec:\lxlrxlx.exe90⤵PID:4780
-
\??\c:\ttbnhn.exec:\ttbnhn.exe91⤵PID:1956
-
\??\c:\7jppj.exec:\7jppj.exe92⤵PID:3644
-
\??\c:\5xfxxff.exec:\5xfxxff.exe93⤵PID:2860
-
\??\c:\flrlfll.exec:\flrlfll.exe94⤵PID:3056
-
\??\c:\ttttbh.exec:\ttttbh.exe95⤵PID:376
-
\??\c:\jvdjd.exec:\jvdjd.exe96⤵PID:2720
-
\??\c:\llffffl.exec:\llffffl.exe97⤵PID:4668
-
\??\c:\xlffffl.exec:\xlffffl.exe98⤵PID:5096
-
\??\c:\tbnnhn.exec:\tbnnhn.exe99⤵PID:1068
-
\??\c:\jdvpj.exec:\jdvpj.exe100⤵PID:2984
-
\??\c:\llxrrxx.exec:\llxrrxx.exe101⤵PID:552
-
\??\c:\tnbbbb.exec:\tnbbbb.exe102⤵PID:3464
-
\??\c:\nbttbh.exec:\nbttbh.exe103⤵PID:4032
-
\??\c:\ddddv.exec:\ddddv.exe104⤵PID:864
-
\??\c:\fflflll.exec:\fflflll.exe105⤵PID:4804
-
\??\c:\nnnnnn.exec:\nnnnnn.exe106⤵PID:1228
-
\??\c:\djdjj.exec:\djdjj.exe107⤵PID:3980
-
\??\c:\llfflrx.exec:\llfflrx.exe108⤵PID:636
-
\??\c:\bntttb.exec:\bntttb.exe109⤵PID:5116
-
\??\c:\1tbtnt.exec:\1tbtnt.exe110⤵PID:4176
-
\??\c:\vjvvv.exec:\vjvvv.exe111⤵PID:628
-
\??\c:\xlffxff.exec:\xlffxff.exe112⤵PID:3972
-
\??\c:\5nnnhn.exec:\5nnnhn.exe113⤵PID:64
-
\??\c:\llrlffx.exec:\llrlffx.exe114⤵PID:5012
-
\??\c:\hhttnn.exec:\hhttnn.exe115⤵PID:528
-
\??\c:\3pvvp.exec:\3pvvp.exe116⤵PID:2424
-
\??\c:\lfrxrll.exec:\lfrxrll.exe117⤵PID:808
-
\??\c:\3bttth.exec:\3bttth.exe118⤵PID:4592
-
\??\c:\7hnttb.exec:\7hnttb.exe119⤵PID:1484
-
\??\c:\dpvpp.exec:\dpvpp.exe120⤵PID:3984
-
\??\c:\rlxxflr.exec:\rlxxflr.exe121⤵PID:1532
-
\??\c:\nhttbt.exec:\nhttbt.exe122⤵PID:2252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-