Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows7-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
10Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
12-09-2024 02:23
240912-cvfznswere 1004-09-2024 00:09
240904-afvheascla 1003-09-2024 18:57
240903-xl8csavfrb 1003-09-2024 18:12
240903-ws828asgnm 10Analysis
-
max time kernel
150s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2024 18:12
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240802-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral20/memory/4956-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1056-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3528-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4832-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/556-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/316-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2184-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3504-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4448-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4724-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1784-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3688-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4152-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4524-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1324-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4360-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4460-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3156-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/3156-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2132-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/2752-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/5088-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1252-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/1196-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral20/memory/4144-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vjdvd.exebnbbtb.exedjddj.exetttnnh.exe7pjpp.exe5flffff.exebthbbb.exe5htnbt.exepvdvd.exerxlrlxx.exettbthn.exehnhnht.exe1ppjd.exerrxrlll.exenhnhbb.exevppjd.exebnbttt.exejjvpj.exefxffxxr.exehtbhbt.exejdjdd.exelxxxxll.exehnnhhn.exe9vdvp.exe7pjdv.exerxlllrr.exehnbbbt.exefrxrlll.exennnnth.exepvdvp.exefffrrlf.exexffxfrr.exenbhbbh.exejjppj.exerxxrrrl.exelllllff.exenhtbbn.exevpdvv.exe3dpdj.exexfxrrxx.exehhhtbb.exenbnhbb.exe3vvpv.exe7fxxrxr.exexrxllll.exettnhbb.exevdpvd.exejpvpj.exerfrllrr.exenbbbtt.exe3btnhh.exevvjjv.exejjppp.exeflfxrrr.exethnnhh.exetntttt.exepvvpj.exefrxlflf.exerxffxxx.exe7ntnhh.exe3tbtnn.exevddvp.exexrxrlfx.exerxrlfff.exepid process 3528 vjdvd.exe 1056 bnbbtb.exe 4144 djddj.exe 1196 tttnnh.exe 1252 7pjpp.exe 5088 5flffff.exe 4832 bthbbb.exe 2752 5htnbt.exe 2132 pvdvd.exe 3156 rxlrlxx.exe 4460 ttbthn.exe 556 hnhnht.exe 4360 1ppjd.exe 1324 rrxrlll.exe 316 nhnhbb.exe 4132 vppjd.exe 3140 bnbttt.exe 4524 jjvpj.exe 4152 fxffxxr.exe 3688 htbhbt.exe 1784 jdjdd.exe 1536 lxxxxll.exe 752 hnnhhn.exe 4724 9vdvp.exe 3504 7pjdv.exe 2184 rxlllrr.exe 4448 hnbbbt.exe 816 frxrlll.exe 4676 nnnnth.exe 644 pvdvp.exe 3716 fffrrlf.exe 4760 xffxfrr.exe 2620 nbhbbh.exe 4572 jjppj.exe 844 rxxrrrl.exe 4444 lllllff.exe 3084 nhtbbn.exe 5016 vpdvv.exe 4692 3dpdj.exe 784 xfxrrxx.exe 2712 hhhtbb.exe 1856 nbnhbb.exe 1556 3vvpv.exe 1480 7fxxrxr.exe 3384 xrxllll.exe 2400 ttnhbb.exe 4316 vdpvd.exe 3032 jpvpj.exe 2728 rfrllrr.exe 4832 nbbbtt.exe 2396 3btnhh.exe 2648 vvjjv.exe 4368 jjppp.exe 2316 flfxrrr.exe 556 thnnhh.exe 4360 tntttt.exe 316 pvvpj.exe 5012 frxlflf.exe 4480 rxffxxx.exe 1576 7ntnhh.exe 3008 3tbtnn.exe 2320 vddvp.exe 1368 xrxrlfx.exe 4036 rxrlfff.exe -
Processes:
resource yara_rule behavioral20/memory/4956-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3528-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3528-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3528-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4956-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1056-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3528-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1196-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1196-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1196-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/5088-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/5088-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/5088-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4832-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/556-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/316-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2184-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3504-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4448-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4724-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1784-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3688-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4152-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4524-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1324-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4360-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4460-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3156-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3156-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/3156-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2132-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/2752-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/5088-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1252-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/1196-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral20/memory/4144-28-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
xrxxrff.exedpdvp.exe9thbnt.exepjjdv.exenhnhhh.exetthhbt.exe1rrlffx.exettbttn.exellrxxlr.exenhtthh.exehhhbnn.exe9hhhtt.exelxrlfxr.exentbbbh.exefxxrrll.exehttttt.exe5djdd.exevvdpp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BlackMoon.exevjdvd.exebnbbtb.exedjddj.exetttnnh.exe7pjpp.exe5flffff.exebthbbb.exe5htnbt.exepvdvd.exerxlrlxx.exettbthn.exehnhnht.exe1ppjd.exerrxrlll.exenhnhbb.exevppjd.exebnbttt.exejjvpj.exefxffxxr.exehtbhbt.exejdjdd.exedescription pid process target process PID 4956 wrote to memory of 3528 4956 BlackMoon.exe vjdvd.exe PID 4956 wrote to memory of 3528 4956 BlackMoon.exe vjdvd.exe PID 4956 wrote to memory of 3528 4956 BlackMoon.exe vjdvd.exe PID 3528 wrote to memory of 1056 3528 vjdvd.exe bnbbtb.exe PID 3528 wrote to memory of 1056 3528 vjdvd.exe bnbbtb.exe PID 3528 wrote to memory of 1056 3528 vjdvd.exe bnbbtb.exe PID 1056 wrote to memory of 4144 1056 bnbbtb.exe djddj.exe PID 1056 wrote to memory of 4144 1056 bnbbtb.exe djddj.exe PID 1056 wrote to memory of 4144 1056 bnbbtb.exe djddj.exe PID 4144 wrote to memory of 1196 4144 djddj.exe tttnnh.exe PID 4144 wrote to memory of 1196 4144 djddj.exe tttnnh.exe PID 4144 wrote to memory of 1196 4144 djddj.exe tttnnh.exe PID 1196 wrote to memory of 1252 1196 tttnnh.exe 7pjpp.exe PID 1196 wrote to memory of 1252 1196 tttnnh.exe 7pjpp.exe PID 1196 wrote to memory of 1252 1196 tttnnh.exe 7pjpp.exe PID 1252 wrote to memory of 5088 1252 7pjpp.exe 5flffff.exe PID 1252 wrote to memory of 5088 1252 7pjpp.exe 5flffff.exe PID 1252 wrote to memory of 5088 1252 7pjpp.exe 5flffff.exe PID 5088 wrote to memory of 4832 5088 5flffff.exe fxlfxxr.exe PID 5088 wrote to memory of 4832 5088 5flffff.exe fxlfxxr.exe PID 5088 wrote to memory of 4832 5088 5flffff.exe fxlfxxr.exe PID 4832 wrote to memory of 2752 4832 bthbbb.exe 5htnbt.exe PID 4832 wrote to memory of 2752 4832 bthbbb.exe 5htnbt.exe PID 4832 wrote to memory of 2752 4832 bthbbb.exe 5htnbt.exe PID 2752 wrote to memory of 2132 2752 5htnbt.exe pvdvd.exe PID 2752 wrote to memory of 2132 2752 5htnbt.exe pvdvd.exe PID 2752 wrote to memory of 2132 2752 5htnbt.exe pvdvd.exe PID 2132 wrote to memory of 3156 2132 pvdvd.exe rxlrlxx.exe PID 2132 wrote to memory of 3156 2132 pvdvd.exe rxlrlxx.exe PID 2132 wrote to memory of 3156 2132 pvdvd.exe rxlrlxx.exe PID 3156 wrote to memory of 4460 3156 rxlrlxx.exe ttbthn.exe PID 3156 wrote to memory of 4460 3156 rxlrlxx.exe ttbthn.exe PID 3156 wrote to memory of 4460 3156 rxlrlxx.exe ttbthn.exe PID 4460 wrote to memory of 556 4460 ttbthn.exe hnhnht.exe PID 4460 wrote to memory of 556 4460 ttbthn.exe hnhnht.exe PID 4460 wrote to memory of 556 4460 ttbthn.exe hnhnht.exe PID 556 wrote to memory of 4360 556 hnhnht.exe tntttt.exe PID 556 wrote to memory of 4360 556 hnhnht.exe tntttt.exe PID 556 wrote to memory of 4360 556 hnhnht.exe tntttt.exe PID 4360 wrote to memory of 1324 4360 1ppjd.exe rrxrlll.exe PID 4360 wrote to memory of 1324 4360 1ppjd.exe rrxrlll.exe PID 4360 wrote to memory of 1324 4360 1ppjd.exe rrxrlll.exe PID 1324 wrote to memory of 316 1324 rrxrlll.exe bttttt.exe PID 1324 wrote to memory of 316 1324 rrxrlll.exe bttttt.exe PID 1324 wrote to memory of 316 1324 rrxrlll.exe bttttt.exe PID 316 wrote to memory of 4132 316 nhnhbb.exe vppjd.exe PID 316 wrote to memory of 4132 316 nhnhbb.exe vppjd.exe PID 316 wrote to memory of 4132 316 nhnhbb.exe vppjd.exe PID 4132 wrote to memory of 3140 4132 vppjd.exe bnbttt.exe PID 4132 wrote to memory of 3140 4132 vppjd.exe bnbttt.exe PID 4132 wrote to memory of 3140 4132 vppjd.exe bnbttt.exe PID 3140 wrote to memory of 4524 3140 bnbttt.exe jjvpj.exe PID 3140 wrote to memory of 4524 3140 bnbttt.exe jjvpj.exe PID 3140 wrote to memory of 4524 3140 bnbttt.exe jjvpj.exe PID 4524 wrote to memory of 4152 4524 jjvpj.exe fxffxxr.exe PID 4524 wrote to memory of 4152 4524 jjvpj.exe fxffxxr.exe PID 4524 wrote to memory of 4152 4524 jjvpj.exe fxffxxr.exe PID 4152 wrote to memory of 3688 4152 fxffxxr.exe htbhbt.exe PID 4152 wrote to memory of 3688 4152 fxffxxr.exe htbhbt.exe PID 4152 wrote to memory of 3688 4152 fxffxxr.exe htbhbt.exe PID 3688 wrote to memory of 1784 3688 htbhbt.exe jdjdd.exe PID 3688 wrote to memory of 1784 3688 htbhbt.exe jdjdd.exe PID 3688 wrote to memory of 1784 3688 htbhbt.exe jdjdd.exe PID 1784 wrote to memory of 1536 1784 jdjdd.exe lxxxxll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\vjdvd.exec:\vjdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\bnbbtb.exec:\bnbbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\djddj.exec:\djddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\tttnnh.exec:\tttnnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\7pjpp.exec:\7pjpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\5flffff.exec:\5flffff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\bthbbb.exec:\bthbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\5htnbt.exec:\5htnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\pvdvd.exec:\pvdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\rxlrlxx.exec:\rxlrlxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\ttbthn.exec:\ttbthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\hnhnht.exec:\hnhnht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\1ppjd.exec:\1ppjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\rrxrlll.exec:\rrxrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\nhnhbb.exec:\nhnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\vppjd.exec:\vppjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\bnbttt.exec:\bnbttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\jjvpj.exec:\jjvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\fxffxxr.exec:\fxffxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\htbhbt.exec:\htbhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\jdjdd.exec:\jdjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\lxxxxll.exec:\lxxxxll.exe23⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hnnhhn.exec:\hnnhhn.exe24⤵
- Executes dropped EXE
PID:752 -
\??\c:\9vdvp.exec:\9vdvp.exe25⤵
- Executes dropped EXE
PID:4724 -
\??\c:\7pjdv.exec:\7pjdv.exe26⤵
- Executes dropped EXE
PID:3504 -
\??\c:\rxlllrr.exec:\rxlllrr.exe27⤵
- Executes dropped EXE
PID:2184 -
\??\c:\hnbbbt.exec:\hnbbbt.exe28⤵
- Executes dropped EXE
PID:4448 -
\??\c:\frxrlll.exec:\frxrlll.exe29⤵
- Executes dropped EXE
PID:816 -
\??\c:\nnnnth.exec:\nnnnth.exe30⤵
- Executes dropped EXE
PID:4676 -
\??\c:\pvdvp.exec:\pvdvp.exe31⤵
- Executes dropped EXE
PID:644 -
\??\c:\fffrrlf.exec:\fffrrlf.exe32⤵
- Executes dropped EXE
PID:3716 -
\??\c:\xffxfrr.exec:\xffxfrr.exe33⤵
- Executes dropped EXE
PID:4760 -
\??\c:\nbhbbh.exec:\nbhbbh.exe34⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jjppj.exec:\jjppj.exe35⤵
- Executes dropped EXE
PID:4572 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe36⤵
- Executes dropped EXE
PID:844 -
\??\c:\lllllff.exec:\lllllff.exe37⤵
- Executes dropped EXE
PID:4444 -
\??\c:\nhtbbn.exec:\nhtbbn.exe38⤵
- Executes dropped EXE
PID:3084 -
\??\c:\vpdvv.exec:\vpdvv.exe39⤵
- Executes dropped EXE
PID:5016 -
\??\c:\3dpdj.exec:\3dpdj.exe40⤵
- Executes dropped EXE
PID:4692 -
\??\c:\xfxrrxx.exec:\xfxrrxx.exe41⤵
- Executes dropped EXE
PID:784 -
\??\c:\hhhtbb.exec:\hhhtbb.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nbnhbb.exec:\nbnhbb.exe43⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3vvpv.exec:\3vvpv.exe44⤵
- Executes dropped EXE
PID:1556 -
\??\c:\7fxxrxr.exec:\7fxxrxr.exe45⤵
- Executes dropped EXE
PID:1480 -
\??\c:\xrxllll.exec:\xrxllll.exe46⤵
- Executes dropped EXE
PID:3384 -
\??\c:\ttnhbb.exec:\ttnhbb.exe47⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vdpvd.exec:\vdpvd.exe48⤵
- Executes dropped EXE
PID:4316 -
\??\c:\jpvpj.exec:\jpvpj.exe49⤵
- Executes dropped EXE
PID:3032 -
\??\c:\rfrllrr.exec:\rfrllrr.exe50⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nbbbtt.exec:\nbbbtt.exe51⤵
- Executes dropped EXE
PID:4832 -
\??\c:\3btnhh.exec:\3btnhh.exe52⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vvjjv.exec:\vvjjv.exe53⤵
- Executes dropped EXE
PID:2648 -
\??\c:\jjppp.exec:\jjppp.exe54⤵
- Executes dropped EXE
PID:4368 -
\??\c:\flfxrrr.exec:\flfxrrr.exe55⤵
- Executes dropped EXE
PID:2316 -
\??\c:\thnnhh.exec:\thnnhh.exe56⤵
- Executes dropped EXE
PID:556 -
\??\c:\tntttt.exec:\tntttt.exe57⤵
- Executes dropped EXE
PID:4360 -
\??\c:\pvvpj.exec:\pvvpj.exe58⤵
- Executes dropped EXE
PID:316 -
\??\c:\frxlflf.exec:\frxlflf.exe59⤵
- Executes dropped EXE
PID:5012 -
\??\c:\rxffxxx.exec:\rxffxxx.exe60⤵
- Executes dropped EXE
PID:4480 -
\??\c:\7ntnhh.exec:\7ntnhh.exe61⤵
- Executes dropped EXE
PID:1576 -
\??\c:\3tbtnn.exec:\3tbtnn.exe62⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vddvp.exec:\vddvp.exe63⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xrxrlfx.exec:\xrxrlfx.exe64⤵
- Executes dropped EXE
PID:1368 -
\??\c:\rxrlfff.exec:\rxrlfff.exe65⤵
- Executes dropped EXE
PID:4036 -
\??\c:\bntnnh.exec:\bntnnh.exe66⤵PID:724
-
\??\c:\nbbbtt.exec:\nbbbtt.exe67⤵PID:1624
-
\??\c:\pvjjj.exec:\pvjjj.exe68⤵PID:1812
-
\??\c:\xffxlfr.exec:\xffxlfr.exe69⤵PID:2480
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe70⤵PID:5024
-
\??\c:\httttt.exec:\httttt.exe71⤵
- System Location Discovery: System Language Discovery
PID:3096 -
\??\c:\jvdvv.exec:\jvdvv.exe72⤵PID:3372
-
\??\c:\vpddv.exec:\vpddv.exe73⤵PID:3624
-
\??\c:\rlxrllf.exec:\rlxrllf.exe74⤵PID:3104
-
\??\c:\rrllfxx.exec:\rrllfxx.exe75⤵PID:1416
-
\??\c:\nhbnbb.exec:\nhbnbb.exe76⤵PID:1860
-
\??\c:\3hhbtt.exec:\3hhbtt.exe77⤵PID:1608
-
\??\c:\1pjdp.exec:\1pjdp.exe78⤵PID:4496
-
\??\c:\jjpjj.exec:\jjpjj.exe79⤵PID:1188
-
\??\c:\7flfffx.exec:\7flfffx.exe80⤵PID:2040
-
\??\c:\nbnhbb.exec:\nbnhbb.exe81⤵PID:600
-
\??\c:\nhtnhn.exec:\nhtnhn.exe82⤵PID:4436
-
\??\c:\vvdvd.exec:\vvdvd.exe83⤵PID:3100
-
\??\c:\1pdvp.exec:\1pdvp.exe84⤵PID:4548
-
\??\c:\llrrllf.exec:\llrrllf.exe85⤵PID:3472
-
\??\c:\rrxrxfx.exec:\rrxrxfx.exe86⤵PID:780
-
\??\c:\bnbbbb.exec:\bnbbbb.exe87⤵PID:4508
-
\??\c:\tbnhbb.exec:\tbnhbb.exe88⤵PID:2996
-
\??\c:\5pdvv.exec:\5pdvv.exe89⤵PID:2796
-
\??\c:\dvddj.exec:\dvddj.exe90⤵PID:1240
-
\??\c:\ffrlfff.exec:\ffrlfff.exe91⤵PID:3680
-
\??\c:\hbtnhh.exec:\hbtnhh.exe92⤵PID:4544
-
\??\c:\bntbtt.exec:\bntbtt.exe93⤵PID:972
-
\??\c:\pppjj.exec:\pppjj.exe94⤵PID:3628
-
\??\c:\ddvjp.exec:\ddvjp.exe95⤵PID:2520
-
\??\c:\rxlrfxx.exec:\rxlrfxx.exe96⤵PID:5088
-
\??\c:\xfffxxf.exec:\xfffxxf.exe97⤵PID:4184
-
\??\c:\tbbhbh.exec:\tbbhbh.exe98⤵PID:4752
-
\??\c:\jjpdv.exec:\jjpdv.exe99⤵PID:3380
-
\??\c:\jddvv.exec:\jddvv.exe100⤵PID:1680
-
\??\c:\frfxrlf.exec:\frfxrlf.exe101⤵PID:2648
-
\??\c:\fffxxrl.exec:\fffxxrl.exe102⤵PID:2932
-
\??\c:\tnbthb.exec:\tnbthb.exe103⤵PID:2348
-
\??\c:\ddddv.exec:\ddddv.exe104⤵PID:3808
-
\??\c:\ddjdv.exec:\ddjdv.exe105⤵PID:3900
-
\??\c:\ffrflrx.exec:\ffrflrx.exe106⤵PID:2800
-
\??\c:\llrfrll.exec:\llrfrll.exe107⤵PID:2856
-
\??\c:\bnbtnn.exec:\bnbtnn.exe108⤵PID:64
-
\??\c:\vdpjd.exec:\vdpjd.exe109⤵PID:1652
-
\??\c:\vvvjp.exec:\vvvjp.exe110⤵PID:2892
-
\??\c:\xrrrrxx.exec:\xrrrrxx.exe111⤵PID:4092
-
\??\c:\bbbtnn.exec:\bbbtnn.exe112⤵PID:3252
-
\??\c:\bthhbb.exec:\bthhbb.exe113⤵PID:4584
-
\??\c:\djddv.exec:\djddv.exe114⤵PID:1864
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe115⤵PID:3372
-
\??\c:\xlrlffx.exec:\xlrlffx.exe116⤵PID:3652
-
\??\c:\7tbtnn.exec:\7tbtnn.exe117⤵PID:2288
-
\??\c:\nthbbb.exec:\nthbbb.exe118⤵PID:1928
-
\??\c:\jdvvp.exec:\jdvvp.exe119⤵PID:4168
-
\??\c:\9lxrfff.exec:\9lxrfff.exe120⤵PID:704
-
\??\c:\fxfxrfx.exec:\fxfxrfx.exe121⤵PID:4432
-
\??\c:\bnhnhn.exec:\bnhnhn.exe122⤵PID:404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-