Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows7-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
10Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
12-09-2024 02:23
240912-cvfznswere 1004-09-2024 00:09
240904-afvheascla 1003-09-2024 18:57
240903-xl8csavfrb 1003-09-2024 18:12
240903-ws828asgnm 10Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
03-09-2024 18:12
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240802-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 19 IoCs
Processes:
resource yara_rule behavioral19/memory/2108-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2348-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2532-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2892-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2824-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2068-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2728-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/1692-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/1388-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/984-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/768-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/1656-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2360-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/3024-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/1944-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/836-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2208-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/3048-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral19/memory/2268-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bbthbn.exe9vjjp.exentbntn.exe3vpjv.exetnhhtt.exennbntb.exelxfrxll.exepjddj.exefxllrrf.exettbtnb.exeppjdp.exehhhthn.exepppjj.exetbnnnh.exedpvdp.exexxrxrxl.exetbnnth.exe5hnhhh.exejpjvp.exexfxlfrr.exejjjvj.exerrrlxlx.exenbtttn.exepvvjp.exexrrxlrf.exe9nbhbh.exeppjjd.exe9llfxfx.exennhtht.exe1ppdp.exexxrrxxl.exehhhthn.exevjddv.exexxxlfxr.exevpdpd.exejddjv.exe3rrxlrr.exetthbhh.exeddvpj.exepjdjp.exexffrlrr.exe7nhhtb.exepppjv.exevjpjd.exe7fflxlf.exefrlfxfr.exe1thntb.exedddvj.exepppvv.exefflxfll.exe5tnthn.exe9bthbh.exedjdvj.exefxfrrxx.exexrlrxfx.exenbhnbn.exejdppd.exeflfxxfx.exe3llrflf.exe5hthnn.exevjdjj.exevvddj.exefllfrrl.exe3ntbnh.exepid Process 2108 bbthbn.exe 2348 9vjjp.exe 2892 ntbntn.exe 2896 3vpjv.exe 2532 tnhhtt.exe 2824 nnbntb.exe 2692 lxfrxll.exe 3048 pjddj.exe 2728 fxllrrf.exe 2068 ttbtnb.exe 1656 ppjdp.exe 1692 hhhthn.exe 2376 pppjj.exe 1388 tbnnnh.exe 984 dpvdp.exe 768 xxrxrxl.exe 2208 tbnnth.exe 2252 5hnhhh.exe 2360 jpjvp.exe 2064 xfxlfrr.exe 2552 jjjvj.exe 3036 rrrlxlx.exe 3024 nbtttn.exe 2248 pvvjp.exe 836 xrrxlrf.exe 1708 9nbhbh.exe 2632 ppjjd.exe 2352 9llfxfx.exe 1512 nnhtht.exe 1944 1ppdp.exe 2596 xxrrxxl.exe 2544 hhhthn.exe 2412 vjddv.exe 2924 xxxlfxr.exe 2580 vpdpd.exe 2892 jddjv.exe 2768 3rrxlrr.exe 2932 tthbhh.exe 2828 ddvpj.exe 2712 pjdjp.exe 3044 xffrlrr.exe 2692 7nhhtb.exe 2636 pppjv.exe 2220 vjpjd.exe 2512 7fflxlf.exe 372 frlfxfr.exe 1404 1thntb.exe 2408 dddvj.exe 2424 pppvv.exe 980 fflxfll.exe 1388 5tnthn.exe 1904 9bthbh.exe 2152 djdvj.exe 1940 fxfrrxx.exe 1988 xrlrxfx.exe 560 nbhnbn.exe 2360 jdppd.exe 280 flfxxfx.exe 536 3llrflf.exe 1960 5hthnn.exe 872 vjdjj.exe 1444 vvddj.exe 2248 fllfrrl.exe 1312 3ntbnh.exe -
Processes:
resource yara_rule behavioral19/memory/2108-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2348-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2892-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2892-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2532-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2532-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2896-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2896-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2892-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2824-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2692-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2824-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2824-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2068-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2728-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1692-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1388-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/984-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/768-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1656-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2360-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/3024-233-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/1944-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/836-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2208-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/3048-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/3048-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/3048-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral19/memory/2268-3-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
dvpdp.exehbtbtb.exevjvpj.exehbhbhn.exe1dvdj.exe1vpjv.exe9jvvv.exetnhtht.exenhntbh.exe5hhtbh.exe5thtbb.exehbtnnt.exexxxfxfr.exedvjpd.exebbtbht.exexrrxllx.exe7ntttn.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BlackMoon.exebbthbn.exe9vjjp.exentbntn.exe3vpjv.exetnhhtt.exennbntb.exelxfrxll.exepjddj.exefxllrrf.exettbtnb.exeppjdp.exehhhthn.exepppjj.exetbnnnh.exedpvdp.exedescription pid Process procid_target PID 2268 wrote to memory of 2108 2268 BlackMoon.exe 29 PID 2268 wrote to memory of 2108 2268 BlackMoon.exe 29 PID 2268 wrote to memory of 2108 2268 BlackMoon.exe 29 PID 2268 wrote to memory of 2108 2268 BlackMoon.exe 29 PID 2108 wrote to memory of 2348 2108 bbthbn.exe 30 PID 2108 wrote to memory of 2348 2108 bbthbn.exe 30 PID 2108 wrote to memory of 2348 2108 bbthbn.exe 30 PID 2108 wrote to memory of 2348 2108 bbthbn.exe 30 PID 2348 wrote to memory of 2892 2348 9vjjp.exe 105 PID 2348 wrote to memory of 2892 2348 9vjjp.exe 105 PID 2348 wrote to memory of 2892 2348 9vjjp.exe 105 PID 2348 wrote to memory of 2892 2348 9vjjp.exe 105 PID 2892 wrote to memory of 2896 2892 ntbntn.exe 32 PID 2892 wrote to memory of 2896 2892 ntbntn.exe 32 PID 2892 wrote to memory of 2896 2892 ntbntn.exe 32 PID 2892 wrote to memory of 2896 2892 ntbntn.exe 32 PID 2896 wrote to memory of 2532 2896 3vpjv.exe 33 PID 2896 wrote to memory of 2532 2896 3vpjv.exe 33 PID 2896 wrote to memory of 2532 2896 3vpjv.exe 33 PID 2896 wrote to memory of 2532 2896 3vpjv.exe 33 PID 2532 wrote to memory of 2824 2532 tnhhtt.exe 34 PID 2532 wrote to memory of 2824 2532 tnhhtt.exe 34 PID 2532 wrote to memory of 2824 2532 tnhhtt.exe 34 PID 2532 wrote to memory of 2824 2532 tnhhtt.exe 34 PID 2824 wrote to memory of 2692 2824 nnbntb.exe 70 PID 2824 wrote to memory of 2692 2824 nnbntb.exe 70 PID 2824 wrote to memory of 2692 2824 nnbntb.exe 70 PID 2824 wrote to memory of 2692 2824 nnbntb.exe 70 PID 2692 wrote to memory of 3048 2692 lxfrxll.exe 36 PID 2692 wrote to memory of 3048 2692 lxfrxll.exe 36 PID 2692 wrote to memory of 3048 2692 lxfrxll.exe 36 PID 2692 wrote to memory of 3048 2692 lxfrxll.exe 36 PID 3048 wrote to memory of 2728 3048 pjddj.exe 37 PID 3048 wrote to memory of 2728 3048 pjddj.exe 37 PID 3048 wrote to memory of 2728 3048 pjddj.exe 37 PID 3048 wrote to memory of 2728 3048 pjddj.exe 37 PID 2728 wrote to memory of 2068 2728 fxllrrf.exe 38 PID 2728 wrote to memory of 2068 2728 fxllrrf.exe 38 PID 2728 wrote to memory of 2068 2728 fxllrrf.exe 38 PID 2728 wrote to memory of 2068 2728 fxllrrf.exe 38 PID 2068 wrote to memory of 1656 2068 ttbtnb.exe 39 PID 2068 wrote to memory of 1656 2068 ttbtnb.exe 39 PID 2068 wrote to memory of 1656 2068 ttbtnb.exe 39 PID 2068 wrote to memory of 1656 2068 ttbtnb.exe 39 PID 1656 wrote to memory of 1692 1656 ppjdp.exe 40 PID 1656 wrote to memory of 1692 1656 ppjdp.exe 40 PID 1656 wrote to memory of 1692 1656 ppjdp.exe 40 PID 1656 wrote to memory of 1692 1656 ppjdp.exe 40 PID 1692 wrote to memory of 2376 1692 hhhthn.exe 199 PID 1692 wrote to memory of 2376 1692 hhhthn.exe 199 PID 1692 wrote to memory of 2376 1692 hhhthn.exe 199 PID 1692 wrote to memory of 2376 1692 hhhthn.exe 199 PID 2376 wrote to memory of 1388 2376 pppjj.exe 79 PID 2376 wrote to memory of 1388 2376 pppjj.exe 79 PID 2376 wrote to memory of 1388 2376 pppjj.exe 79 PID 2376 wrote to memory of 1388 2376 pppjj.exe 79 PID 1388 wrote to memory of 984 1388 tbnnnh.exe 43 PID 1388 wrote to memory of 984 1388 tbnnnh.exe 43 PID 1388 wrote to memory of 984 1388 tbnnnh.exe 43 PID 1388 wrote to memory of 984 1388 tbnnnh.exe 43 PID 984 wrote to memory of 768 984 dpvdp.exe 244 PID 984 wrote to memory of 768 984 dpvdp.exe 244 PID 984 wrote to memory of 768 984 dpvdp.exe 244 PID 984 wrote to memory of 768 984 dpvdp.exe 244
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\bbthbn.exec:\bbthbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\9vjjp.exec:\9vjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\ntbntn.exec:\ntbntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\3vpjv.exec:\3vpjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\tnhhtt.exec:\tnhhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\nnbntb.exec:\nnbntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lxfrxll.exec:\lxfrxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\pjddj.exec:\pjddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\fxllrrf.exec:\fxllrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\ttbtnb.exec:\ttbtnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\ppjdp.exec:\ppjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\hhhthn.exec:\hhhthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\pppjj.exec:\pppjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\tbnnnh.exec:\tbnnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\dpvdp.exec:\dpvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe17⤵
- Executes dropped EXE
PID:768 -
\??\c:\tbnnth.exec:\tbnnth.exe18⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5hnhhh.exec:\5hnhhh.exe19⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jpjvp.exec:\jpjvp.exe20⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xfxlfrr.exec:\xfxlfrr.exe21⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jjjvj.exec:\jjjvj.exe22⤵
- Executes dropped EXE
PID:2552 -
\??\c:\rrrlxlx.exec:\rrrlxlx.exe23⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nbtttn.exec:\nbtttn.exe24⤵
- Executes dropped EXE
PID:3024 -
\??\c:\pvvjp.exec:\pvvjp.exe25⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xrrxlrf.exec:\xrrxlrf.exe26⤵
- Executes dropped EXE
PID:836 -
\??\c:\9nbhbh.exec:\9nbhbh.exe27⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ppjjd.exec:\ppjjd.exe28⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9llfxfx.exec:\9llfxfx.exe29⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nnhtht.exec:\nnhtht.exe30⤵
- Executes dropped EXE
PID:1512 -
\??\c:\1ppdp.exec:\1ppdp.exe31⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe32⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hhhthn.exec:\hhhthn.exe33⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vjddv.exec:\vjddv.exe34⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xxxlfxr.exec:\xxxlfxr.exe35⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vpdpd.exec:\vpdpd.exe36⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jddjv.exec:\jddjv.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\3rrxlrr.exec:\3rrxlrr.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\tthbhh.exec:\tthbhh.exe39⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ddvpj.exec:\ddvpj.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\pjdjp.exec:\pjdjp.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xffrlrr.exec:\xffrlrr.exe42⤵
- Executes dropped EXE
PID:3044 -
\??\c:\7nhhtb.exec:\7nhhtb.exe43⤵
- Executes dropped EXE
PID:2692 -
\??\c:\pppjv.exec:\pppjv.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vjpjd.exec:\vjpjd.exe45⤵
- Executes dropped EXE
PID:2220 -
\??\c:\7fflxlf.exec:\7fflxlf.exe46⤵
- Executes dropped EXE
PID:2512 -
\??\c:\frlfxfr.exec:\frlfxfr.exe47⤵
- Executes dropped EXE
PID:372 -
\??\c:\1thntb.exec:\1thntb.exe48⤵
- Executes dropped EXE
PID:1404 -
\??\c:\dddvj.exec:\dddvj.exe49⤵
- Executes dropped EXE
PID:2408 -
\??\c:\pppvv.exec:\pppvv.exe50⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fflxfll.exec:\fflxfll.exe51⤵
- Executes dropped EXE
PID:980 -
\??\c:\5tnthn.exec:\5tnthn.exe52⤵
- Executes dropped EXE
PID:1388 -
\??\c:\9bthbh.exec:\9bthbh.exe53⤵
- Executes dropped EXE
PID:1904 -
\??\c:\djdvj.exec:\djdvj.exe54⤵
- Executes dropped EXE
PID:2152 -
\??\c:\fxfrrxx.exec:\fxfrrxx.exe55⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xrlrxfx.exec:\xrlrxfx.exe56⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nbhnbn.exec:\nbhnbn.exe57⤵
- Executes dropped EXE
PID:560 -
\??\c:\jdppd.exec:\jdppd.exe58⤵
- Executes dropped EXE
PID:2360 -
\??\c:\flfxxfx.exec:\flfxxfx.exe59⤵
- Executes dropped EXE
PID:280 -
\??\c:\3llrflf.exec:\3llrflf.exe60⤵
- Executes dropped EXE
PID:536 -
\??\c:\5hthnn.exec:\5hthnn.exe61⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vjdjj.exec:\vjdjj.exe62⤵
- Executes dropped EXE
PID:872 -
\??\c:\vvddj.exec:\vvddj.exe63⤵
- Executes dropped EXE
PID:1444 -
\??\c:\fllfrrl.exec:\fllfrrl.exe64⤵
- Executes dropped EXE
PID:2248 -
\??\c:\3ntbnh.exec:\3ntbnh.exe65⤵
- Executes dropped EXE
PID:1312 -
\??\c:\tbhtnn.exec:\tbhtnn.exe66⤵PID:2572
-
\??\c:\ppjvj.exec:\ppjvj.exe67⤵PID:1336
-
\??\c:\fllrrxl.exec:\fllrrxl.exe68⤵PID:2356
-
\??\c:\fxrllxf.exec:\fxrllxf.exe69⤵PID:2456
-
\??\c:\1thntb.exec:\1thntb.exe70⤵PID:1736
-
\??\c:\pppdp.exec:\pppdp.exe71⤵PID:888
-
\??\c:\3xxlrxf.exec:\3xxlrxf.exe72⤵PID:2428
-
\??\c:\nhtntn.exec:\nhtntn.exe73⤵PID:1968
-
\??\c:\vvdjd.exec:\vvdjd.exe74⤵PID:2144
-
\??\c:\9pdpj.exec:\9pdpj.exe75⤵PID:2056
-
\??\c:\3rlxllr.exec:\3rlxllr.exe76⤵PID:3012
-
\??\c:\thhtht.exec:\thhtht.exe77⤵PID:2580
-
\??\c:\1bbnbb.exec:\1bbnbb.exe78⤵PID:2892
-
\??\c:\vvdjp.exec:\vvdjp.exe79⤵PID:2800
-
\??\c:\lrrfxxl.exec:\lrrfxxl.exe80⤵PID:2716
-
\??\c:\lffrxlx.exec:\lffrxlx.exe81⤵PID:2724
-
\??\c:\ttthbn.exec:\ttthbn.exe82⤵PID:2540
-
\??\c:\dddvj.exec:\dddvj.exe83⤵PID:2328
-
\??\c:\dddjv.exec:\dddjv.exe84⤵PID:3044
-
\??\c:\ffxxlrf.exec:\ffxxlrf.exe85⤵PID:3032
-
\??\c:\httthb.exec:\httthb.exe86⤵PID:2944
-
\??\c:\nhhhnn.exec:\nhhhnn.exe87⤵PID:780
-
\??\c:\ddvpj.exec:\ddvpj.exe88⤵PID:2468
-
\??\c:\vdjpj.exec:\vdjpj.exe89⤵PID:2780
-
\??\c:\rrrfrfr.exec:\rrrfrfr.exe90⤵PID:652
-
\??\c:\bhbhnb.exec:\bhbhnb.exe91⤵PID:2148
-
\??\c:\vdpdp.exec:\vdpdp.exe92⤵PID:1924
-
\??\c:\1vdpv.exec:\1vdpv.exe93⤵PID:1248
-
\??\c:\frrxlxr.exec:\frrxlxr.exe94⤵PID:2568
-
\??\c:\bbbnnt.exec:\bbbnnt.exe95⤵PID:2072
-
\??\c:\5bbbnb.exec:\5bbbnb.exe96⤵PID:584
-
\??\c:\vvpdd.exec:\vvpdd.exe97⤵PID:1940
-
\??\c:\lllrlrl.exec:\lllrlrl.exe98⤵PID:2052
-
\??\c:\hhtbtt.exec:\hhtbtt.exe99⤵PID:1484
-
\??\c:\5htthn.exec:\5htthn.exe100⤵PID:2548
-
\??\c:\pvvpj.exec:\pvvpj.exe101⤵PID:2324
-
\??\c:\fffrxlf.exec:\fffrxlf.exe102⤵PID:3036
-
\??\c:\9ffllrf.exec:\9ffllrf.exe103⤵PID:2336
-
\??\c:\bbbtnh.exec:\bbbtnh.exe104⤵PID:1896
-
\??\c:\jdddj.exec:\jdddj.exe105⤵PID:1660
-
\??\c:\vvpdv.exec:\vvpdv.exe106⤵PID:1504
-
\??\c:\fxrrffl.exec:\fxrrffl.exe107⤵PID:1312
-
\??\c:\hbbhbh.exec:\hbbhbh.exe108⤵PID:264
-
\??\c:\jjjvp.exec:\jjjvp.exe109⤵PID:884
-
\??\c:\jjdvv.exec:\jjdvv.exe110⤵PID:1512
-
\??\c:\lfffllr.exec:\lfffllr.exe111⤵PID:2092
-
\??\c:\ttbhth.exec:\ttbhth.exe112⤵PID:2268
-
\??\c:\hbtnnt.exec:\hbtnnt.exe113⤵
- System Location Discovery: System Language Discovery
PID:2312 -
\??\c:\vvvdv.exec:\vvvdv.exe114⤵PID:2808
-
\??\c:\fxrflrx.exec:\fxrflrx.exe115⤵PID:2860
-
\??\c:\bttbnt.exec:\bttbnt.exe116⤵PID:2764
-
\??\c:\ttnnbh.exec:\ttnnbh.exe117⤵PID:2904
-
\??\c:\dvvjd.exec:\dvvjd.exe118⤵PID:580
-
\??\c:\fllxlxx.exec:\fllxlxx.exe119⤵PID:2748
-
\??\c:\fffrlxl.exec:\fffrlxl.exe120⤵PID:304
-
\??\c:\tbhtth.exec:\tbhtth.exe121⤵PID:2784
-
\??\c:\3pvpv.exec:\3pvpv.exe122⤵PID:2736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-