Overview
overview
10Static
static
10Archive.zip
windows10-1703-x64
1Dropper/Berbew.exe
windows10-1703-x64
10Dropper/Phorphiex.exe
windows10-1703-x64
10out.exe
windows10-1703-x64
3RAT/31.exe
windows10-1703-x64
10RAT/XClient.exe
windows10-1703-x64
10RAT/file.exe
windows10-1703-x64
7Ransomware...-2.exe
windows10-1703-x64
10Ransomware...01.exe
windows10-1703-x64
10Ransomware...lt.exe
windows10-1703-x64
10Stealers/Azorult.exe
windows10-1703-x64
10Stealers/B...on.exe
windows10-1703-x64
10Stealers/Dridex.dll
windows10-1703-x64
10Stealers/M..._2.exe
windows10-1703-x64
10Stealers/lumma.exe
windows10-1703-x64
10Trojan/BetaBot.exe
windows10-1703-x64
10Trojan/Smo...er.exe
windows10-1703-x64
10Resubmissions
12-09-2024 02:23
240912-cvfznswere 1004-09-2024 00:09
240904-afvheascla 1003-09-2024 18:57
240903-xl8csavfrb 1003-09-2024 18:12
240903-ws828asgnm 10Analysis
-
max time kernel
1791s -
max time network
1591s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
04-09-2024 00:09
Behavioral task
behavioral1
Sample
Archive.zip
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win10-20240611-en
Behavioral task
behavioral4
Sample
out.exe
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
RAT/XClient.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
RAT/file.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
Ransomware/Client-2.exe
Resource
win10-20240611-en
Behavioral task
behavioral9
Sample
Ransomware/criticalupdate01.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
Ransomware/default.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
Stealers/Azorult.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
Stealers/BlackMoon.exe
Resource
win10-20240611-en
Behavioral task
behavioral13
Sample
Stealers/Dridex.dll
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10-20240611-en
Behavioral task
behavioral15
Sample
Stealers/lumma.exe
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
Trojan/BetaBot.exe
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
Trojan/SmokeLoader.exe
Resource
win10-20240404-en
General
-
Target
Stealers/BlackMoon.exe
-
Size
387KB
-
MD5
336efa7460c08e3d47f29121742eb010
-
SHA1
f41c36cd83879d170309dede056563d35741b87b
-
SHA256
e6dd3fa33ad938b07c8978691f86b73e9f6fd84104b92f42566498bdb6b2930e
-
SHA512
e8d118fbe907a00d89c2514af4de475a0ea54943076bf90174234f77f2ec093a1246a0d4e78d1104a0dcda150b5441d28f4f3d1e768ecb20ae86383a99863c14
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfN:SgdnJVU4TlnwJ6Goo
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral12/memory/4116-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/996-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4356-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4440-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/192-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/384-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/2524-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/440-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/2948-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4312-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/2136-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4132-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/1476-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/5072-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4464-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/1264-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/3068-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/1824-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4416-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/812-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/2900-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/2364-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/2232-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4304-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/4652-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/3388-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/1396-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral12/memory/3472-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lprnpr.exehvnjn.exehljdb.exexlrbhln.exefjrfh.exerhrnfh.exejjvbl.exextbjj.exebxfbnrv.exedflvbfb.exenjpnbv.exeltlnhx.exehhhjh.exebphnbht.exexjrnlb.exexrrnrrx.exenvbrd.exepbvfrrb.exeprvxx.exehhppprt.exehprpdv.exevxjvfv.exejrtljh.exejnlfpff.exexfftlhl.exebdhdtbj.exevbrxnf.exertjlvvp.exexxrbltn.exevnnhndb.exetjjdj.exebpvxdh.exevxjjnr.exetdtvr.exebxdfj.exejxpndfp.exehrxjfj.exedrdbx.exeppbfdx.exetrlrjn.exedxbvvx.exernvrrp.exetjnxpxr.exebplrx.exephhfh.exetnrnr.exenrbpbbf.exerrflbjn.exenrbbhtf.exeldrdxb.exepnrvd.exejlvrdvj.exetprhjt.exevrnbh.exelrjxv.exerjjfbt.exerhdpnbj.exehxxhnn.exehprxx.exebpxhl.exelxvhxl.exevntfdj.exehbfjpv.exerftxrn.exepid process 996 lprnpr.exe 4356 hvnjn.exe 4440 hljdb.exe 192 xlrbhln.exe 384 fjrfh.exe 2524 rhrnfh.exe 440 jjvbl.exe 2948 xtbjj.exe 4312 bxfbnrv.exe 2136 dflvbfb.exe 4132 njpnbv.exe 636 ltlnhx.exe 1476 hhhjh.exe 5072 bphnbht.exe 4464 xjrnlb.exe 1264 xrrnrrx.exe 3068 nvbrd.exe 1824 pbvfrrb.exe 812 prvxx.exe 4416 hhppprt.exe 2900 hprpdv.exe 2364 vxjvfv.exe 2232 jrtljh.exe 4304 jnlfpff.exe 4644 xfftlhl.exe 4652 bdhdtbj.exe 4832 vbrxnf.exe 4680 rtjlvvp.exe 1396 xxrbltn.exe 3388 vnnhndb.exe 3472 tjjdj.exe 5032 bpvxdh.exe 2260 vxjjnr.exe 444 tdtvr.exe 2584 bxdfj.exe 4936 jxpndfp.exe 3012 hrxjfj.exe 4556 drdbx.exe 4224 ppbfdx.exe 3324 trlrjn.exe 3912 dxbvvx.exe 5084 rnvrrp.exe 1116 tjnxpxr.exe 3352 bplrx.exe 228 phhfh.exe 4516 tnrnr.exe 2296 nrbpbbf.exe 1308 rrflbjn.exe 4796 nrbbhtf.exe 2248 ldrdxb.exe 212 pnrvd.exe 1980 jlvrdvj.exe 3492 tprhjt.exe 2212 vrnbh.exe 4064 lrjxv.exe 4388 rjjfbt.exe 2224 rhdpnbj.exe 888 hxxhnn.exe 1244 hprxx.exe 1520 bpxhl.exe 808 lxvhxl.exe 1112 vntfdj.exe 1264 hbfjpv.exe 4760 rftxrn.exe -
Processes:
resource yara_rule behavioral12/memory/4116-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4116-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/996-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4356-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4440-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4440-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4440-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/192-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/192-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/384-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/384-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/2524-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/384-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/440-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/440-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/2948-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4312-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/2136-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4132-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/1476-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/5072-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4464-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/1264-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/3068-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/1824-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4416-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/812-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/2900-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/2364-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/2232-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4304-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/4652-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/3388-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/1396-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral12/memory/3472-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
pjdbjhj.exeldrjp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdbjhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldrjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BlackMoon.exelprnpr.exehvnjn.exehljdb.exexlrbhln.exefjrfh.exerhrnfh.exejjvbl.exextbjj.exebxfbnrv.exedflvbfb.exenjpnbv.exeltlnhx.exehhhjh.exebphnbht.exexjrnlb.exexrrnrrx.exenvbrd.exepbvfrrb.exeprvxx.exehhppprt.exehprpdv.exedescription pid process target process PID 4116 wrote to memory of 996 4116 BlackMoon.exe lprnpr.exe PID 4116 wrote to memory of 996 4116 BlackMoon.exe lprnpr.exe PID 4116 wrote to memory of 996 4116 BlackMoon.exe lprnpr.exe PID 996 wrote to memory of 4356 996 lprnpr.exe hvnjn.exe PID 996 wrote to memory of 4356 996 lprnpr.exe hvnjn.exe PID 996 wrote to memory of 4356 996 lprnpr.exe hvnjn.exe PID 4356 wrote to memory of 4440 4356 hvnjn.exe hljdb.exe PID 4356 wrote to memory of 4440 4356 hvnjn.exe hljdb.exe PID 4356 wrote to memory of 4440 4356 hvnjn.exe hljdb.exe PID 4440 wrote to memory of 192 4440 hljdb.exe xlrbhln.exe PID 4440 wrote to memory of 192 4440 hljdb.exe xlrbhln.exe PID 4440 wrote to memory of 192 4440 hljdb.exe xlrbhln.exe PID 192 wrote to memory of 384 192 xlrbhln.exe fjrfh.exe PID 192 wrote to memory of 384 192 xlrbhln.exe fjrfh.exe PID 192 wrote to memory of 384 192 xlrbhln.exe fjrfh.exe PID 384 wrote to memory of 2524 384 fjrfh.exe rhrnfh.exe PID 384 wrote to memory of 2524 384 fjrfh.exe rhrnfh.exe PID 384 wrote to memory of 2524 384 fjrfh.exe rhrnfh.exe PID 2524 wrote to memory of 440 2524 rhrnfh.exe jjvbl.exe PID 2524 wrote to memory of 440 2524 rhrnfh.exe jjvbl.exe PID 2524 wrote to memory of 440 2524 rhrnfh.exe jjvbl.exe PID 440 wrote to memory of 2948 440 jjvbl.exe xtbjj.exe PID 440 wrote to memory of 2948 440 jjvbl.exe xtbjj.exe PID 440 wrote to memory of 2948 440 jjvbl.exe xtbjj.exe PID 2948 wrote to memory of 4312 2948 xtbjj.exe bxfbnrv.exe PID 2948 wrote to memory of 4312 2948 xtbjj.exe bxfbnrv.exe PID 2948 wrote to memory of 4312 2948 xtbjj.exe bxfbnrv.exe PID 4312 wrote to memory of 2136 4312 bxfbnrv.exe dflvbfb.exe PID 4312 wrote to memory of 2136 4312 bxfbnrv.exe dflvbfb.exe PID 4312 wrote to memory of 2136 4312 bxfbnrv.exe dflvbfb.exe PID 2136 wrote to memory of 4132 2136 dflvbfb.exe njpnbv.exe PID 2136 wrote to memory of 4132 2136 dflvbfb.exe njpnbv.exe PID 2136 wrote to memory of 4132 2136 dflvbfb.exe njpnbv.exe PID 4132 wrote to memory of 636 4132 njpnbv.exe ltlnhx.exe PID 4132 wrote to memory of 636 4132 njpnbv.exe ltlnhx.exe PID 4132 wrote to memory of 636 4132 njpnbv.exe ltlnhx.exe PID 636 wrote to memory of 1476 636 ltlnhx.exe hhhjh.exe PID 636 wrote to memory of 1476 636 ltlnhx.exe hhhjh.exe PID 636 wrote to memory of 1476 636 ltlnhx.exe hhhjh.exe PID 1476 wrote to memory of 5072 1476 hhhjh.exe bphnbht.exe PID 1476 wrote to memory of 5072 1476 hhhjh.exe bphnbht.exe PID 1476 wrote to memory of 5072 1476 hhhjh.exe bphnbht.exe PID 5072 wrote to memory of 4464 5072 bphnbht.exe xjrnlb.exe PID 5072 wrote to memory of 4464 5072 bphnbht.exe xjrnlb.exe PID 5072 wrote to memory of 4464 5072 bphnbht.exe xjrnlb.exe PID 4464 wrote to memory of 1264 4464 xjrnlb.exe xrrnrrx.exe PID 4464 wrote to memory of 1264 4464 xjrnlb.exe xrrnrrx.exe PID 4464 wrote to memory of 1264 4464 xjrnlb.exe xrrnrrx.exe PID 1264 wrote to memory of 3068 1264 xrrnrrx.exe nvbrd.exe PID 1264 wrote to memory of 3068 1264 xrrnrrx.exe nvbrd.exe PID 1264 wrote to memory of 3068 1264 xrrnrrx.exe nvbrd.exe PID 3068 wrote to memory of 1824 3068 nvbrd.exe pbvfrrb.exe PID 3068 wrote to memory of 1824 3068 nvbrd.exe pbvfrrb.exe PID 3068 wrote to memory of 1824 3068 nvbrd.exe pbvfrrb.exe PID 1824 wrote to memory of 812 1824 pbvfrrb.exe prvxx.exe PID 1824 wrote to memory of 812 1824 pbvfrrb.exe prvxx.exe PID 1824 wrote to memory of 812 1824 pbvfrrb.exe prvxx.exe PID 812 wrote to memory of 4416 812 prvxx.exe hhppprt.exe PID 812 wrote to memory of 4416 812 prvxx.exe hhppprt.exe PID 812 wrote to memory of 4416 812 prvxx.exe hhppprt.exe PID 4416 wrote to memory of 2900 4416 hhppprt.exe hprpdv.exe PID 4416 wrote to memory of 2900 4416 hhppprt.exe hprpdv.exe PID 4416 wrote to memory of 2900 4416 hhppprt.exe hprpdv.exe PID 2900 wrote to memory of 2364 2900 hprpdv.exe vxjvfv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"C:\Users\Admin\AppData\Local\Temp\Stealers\BlackMoon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\lprnpr.exec:\lprnpr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\hvnjn.exec:\hvnjn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\hljdb.exec:\hljdb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\xlrbhln.exec:\xlrbhln.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:192 -
\??\c:\fjrfh.exec:\fjrfh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\rhrnfh.exec:\rhrnfh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\jjvbl.exec:\jjvbl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\xtbjj.exec:\xtbjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\bxfbnrv.exec:\bxfbnrv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\dflvbfb.exec:\dflvbfb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\njpnbv.exec:\njpnbv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\ltlnhx.exec:\ltlnhx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\hhhjh.exec:\hhhjh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\bphnbht.exec:\bphnbht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\xjrnlb.exec:\xjrnlb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\xrrnrrx.exec:\xrrnrrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\nvbrd.exec:\nvbrd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\pbvfrrb.exec:\pbvfrrb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\prvxx.exec:\prvxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\hhppprt.exec:\hhppprt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\hprpdv.exec:\hprpdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\vxjvfv.exec:\vxjvfv.exe23⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jrtljh.exec:\jrtljh.exe24⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jnlfpff.exec:\jnlfpff.exe25⤵
- Executes dropped EXE
PID:4304 -
\??\c:\xfftlhl.exec:\xfftlhl.exe26⤵
- Executes dropped EXE
PID:4644 -
\??\c:\bdhdtbj.exec:\bdhdtbj.exe27⤵
- Executes dropped EXE
PID:4652 -
\??\c:\vbrxnf.exec:\vbrxnf.exe28⤵
- Executes dropped EXE
PID:4832 -
\??\c:\rtjlvvp.exec:\rtjlvvp.exe29⤵
- Executes dropped EXE
PID:4680 -
\??\c:\xxrbltn.exec:\xxrbltn.exe30⤵
- Executes dropped EXE
PID:1396 -
\??\c:\vnnhndb.exec:\vnnhndb.exe31⤵
- Executes dropped EXE
PID:3388 -
\??\c:\tjjdj.exec:\tjjdj.exe32⤵
- Executes dropped EXE
PID:3472 -
\??\c:\bpvxdh.exec:\bpvxdh.exe33⤵
- Executes dropped EXE
PID:5032 -
\??\c:\vxjjnr.exec:\vxjjnr.exe34⤵
- Executes dropped EXE
PID:2260 -
\??\c:\tdtvr.exec:\tdtvr.exe35⤵
- Executes dropped EXE
PID:444 -
\??\c:\bxdfj.exec:\bxdfj.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jxpndfp.exec:\jxpndfp.exe37⤵
- Executes dropped EXE
PID:4936 -
\??\c:\hrxjfj.exec:\hrxjfj.exe38⤵
- Executes dropped EXE
PID:3012 -
\??\c:\drdbx.exec:\drdbx.exe39⤵
- Executes dropped EXE
PID:4556 -
\??\c:\ppbfdx.exec:\ppbfdx.exe40⤵
- Executes dropped EXE
PID:4224 -
\??\c:\trlrjn.exec:\trlrjn.exe41⤵
- Executes dropped EXE
PID:3324 -
\??\c:\dxbvvx.exec:\dxbvvx.exe42⤵
- Executes dropped EXE
PID:3912 -
\??\c:\rnvrrp.exec:\rnvrrp.exe43⤵
- Executes dropped EXE
PID:5084 -
\??\c:\tjnxpxr.exec:\tjnxpxr.exe44⤵
- Executes dropped EXE
PID:1116 -
\??\c:\bplrx.exec:\bplrx.exe45⤵
- Executes dropped EXE
PID:3352 -
\??\c:\phhfh.exec:\phhfh.exe46⤵
- Executes dropped EXE
PID:228 -
\??\c:\tnrnr.exec:\tnrnr.exe47⤵
- Executes dropped EXE
PID:4516 -
\??\c:\nrbpbbf.exec:\nrbpbbf.exe48⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rrflbjn.exec:\rrflbjn.exe49⤵
- Executes dropped EXE
PID:1308 -
\??\c:\nrbbhtf.exec:\nrbbhtf.exe50⤵
- Executes dropped EXE
PID:4796 -
\??\c:\ldrdxb.exec:\ldrdxb.exe51⤵
- Executes dropped EXE
PID:2248 -
\??\c:\pnrvd.exec:\pnrvd.exe52⤵
- Executes dropped EXE
PID:212 -
\??\c:\jlvrdvj.exec:\jlvrdvj.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\tprhjt.exec:\tprhjt.exe54⤵
- Executes dropped EXE
PID:3492 -
\??\c:\vrnbh.exec:\vrnbh.exe55⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lrjxv.exec:\lrjxv.exe56⤵
- Executes dropped EXE
PID:4064 -
\??\c:\rjjfbt.exec:\rjjfbt.exe57⤵
- Executes dropped EXE
PID:4388 -
\??\c:\rhdpnbj.exec:\rhdpnbj.exe58⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hxxhnn.exec:\hxxhnn.exe59⤵
- Executes dropped EXE
PID:888 -
\??\c:\hprxx.exec:\hprxx.exe60⤵
- Executes dropped EXE
PID:1244 -
\??\c:\bpxhl.exec:\bpxhl.exe61⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lxvhxl.exec:\lxvhxl.exe62⤵
- Executes dropped EXE
PID:808 -
\??\c:\vntfdj.exec:\vntfdj.exe63⤵
- Executes dropped EXE
PID:1112 -
\??\c:\hbfjpv.exec:\hbfjpv.exe64⤵
- Executes dropped EXE
PID:1264 -
\??\c:\rftxrn.exec:\rftxrn.exe65⤵
- Executes dropped EXE
PID:4760 -
\??\c:\rvvhjrn.exec:\rvvhjrn.exe66⤵PID:4804
-
\??\c:\jphjpf.exec:\jphjpf.exe67⤵PID:4444
-
\??\c:\tvrfhhn.exec:\tvrfhhn.exe68⤵PID:1492
-
\??\c:\fvjbvv.exec:\fvjbvv.exe69⤵PID:4792
-
\??\c:\xjbjtfx.exec:\xjbjtfx.exe70⤵PID:4248
-
\??\c:\tdhltr.exec:\tdhltr.exe71⤵PID:4992
-
\??\c:\vfrnhj.exec:\vfrnhj.exe72⤵PID:2868
-
\??\c:\xxbldvb.exec:\xxbldvb.exe73⤵PID:2992
-
\??\c:\hvxtj.exec:\hvxtj.exe74⤵PID:4668
-
\??\c:\htlnj.exec:\htlnj.exe75⤵PID:2440
-
\??\c:\trpvx.exec:\trpvx.exe76⤵PID:1248
-
\??\c:\pblbnt.exec:\pblbnt.exe77⤵PID:832
-
\??\c:\xrfjj.exec:\xrfjj.exe78⤵PID:1148
-
\??\c:\vhjdhhf.exec:\vhjdhhf.exe79⤵PID:4468
-
\??\c:\npdbxdj.exec:\npdbxdj.exe80⤵PID:1396
-
\??\c:\vrdtn.exec:\vrdtn.exe81⤵PID:2132
-
\??\c:\rrbtpr.exec:\rrbtpr.exe82⤵PID:2276
-
\??\c:\lfljndb.exec:\lfljndb.exe83⤵PID:2588
-
\??\c:\nbnjt.exec:\nbnjt.exe84⤵PID:4544
-
\??\c:\jthplnj.exec:\jthplnj.exe85⤵PID:2504
-
\??\c:\jlplpnv.exec:\jlplpnv.exe86⤵PID:1040
-
\??\c:\vrbdjd.exec:\vrbdjd.exe87⤵PID:3196
-
\??\c:\nrnlbp.exec:\nrnlbp.exe88⤵PID:2552
-
\??\c:\hprbft.exec:\hprbft.exe89⤵PID:804
-
\??\c:\trdxvdx.exec:\trdxvdx.exe90⤵PID:4188
-
\??\c:\txjxt.exec:\txjxt.exe91⤵PID:3316
-
\??\c:\ppxvt.exec:\ppxvt.exe92⤵PID:1008
-
\??\c:\nfnfj.exec:\nfnfj.exe93⤵PID:2936
-
\??\c:\nhtjjjj.exec:\nhtjjjj.exe94⤵PID:296
-
\??\c:\blvnj.exec:\blvnj.exe95⤵PID:324
-
\??\c:\xhpttj.exec:\xhpttj.exe96⤵PID:2172
-
\??\c:\vbdbv.exec:\vbdbv.exe97⤵PID:828
-
\??\c:\bhjxl.exec:\bhjxl.exe98⤵PID:1464
-
\??\c:\hdlrh.exec:\hdlrh.exe99⤵PID:384
-
\??\c:\pnjhbx.exec:\pnjhbx.exe100⤵PID:4800
-
\??\c:\ndnvbh.exec:\ndnvbh.exe101⤵PID:4384
-
\??\c:\vvfrp.exec:\vvfrp.exe102⤵PID:316
-
\??\c:\rbtdh.exec:\rbtdh.exe103⤵PID:300
-
\??\c:\fdjhr.exec:\fdjhr.exe104⤵PID:1904
-
\??\c:\fdpdb.exec:\fdpdb.exe105⤵PID:1712
-
\??\c:\xxlxlxn.exec:\xxlxlxn.exe106⤵PID:4428
-
\??\c:\bjrvv.exec:\bjrvv.exe107⤵PID:2512
-
\??\c:\hnfhhj.exec:\hnfhhj.exe108⤵PID:2516
-
\??\c:\hlbjrjl.exec:\hlbjrjl.exe109⤵PID:3788
-
\??\c:\fxhblfl.exec:\fxhblfl.exe110⤵PID:312
-
\??\c:\jnntx.exec:\jnntx.exe111⤵PID:4184
-
\??\c:\txlvvjd.exec:\txlvvjd.exe112⤵PID:4732
-
\??\c:\llpfj.exec:\llpfj.exe113⤵PID:3192
-
\??\c:\rvvfx.exec:\rvvfx.exe114⤵PID:2368
-
\??\c:\hxhjt.exec:\hxhjt.exe115⤵PID:3636
-
\??\c:\bnjxhtt.exec:\bnjxhtt.exe116⤵PID:4924
-
\??\c:\xrdnpxd.exec:\xrdnpxd.exe117⤵PID:4848
-
\??\c:\fpphfl.exec:\fpphfl.exe118⤵PID:4436
-
\??\c:\tplpxl.exec:\tplpxl.exe119⤵PID:4856
-
\??\c:\nxtbh.exec:\nxtbh.exe120⤵PID:4100
-
\??\c:\bjjrr.exec:\bjjrr.exe121⤵PID:4260
-
\??\c:\fjjjxb.exec:\fjjjxb.exe122⤵PID:4300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-