Malware Analysis Report

2025-03-15 06:39

Sample ID 240530-krnjcacc61
Target e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416
SHA256 e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416
Tags
blackmoon gh0strat banker persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416

Threat Level: Known bad

The file e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416 was found to be: Known bad.

Malicious Activity Summary

blackmoon gh0strat banker persistence rat trojan

Gh0st RAT payload

Detect Blackmoon payload

Blackmoon, KrBanker

Gh0strat

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Enumerates connected drives

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

Program crash

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Opens file in notepad (likely ransom note)

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 08:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 08:50

Reported

2024-05-30 08:52

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\is-UJ4ML.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation \??\c:\offdnee\jsbbv.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A \??\c:\offdnee\jsbbv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qdatem = "C:\\Users\\Public\\62893048\\Applicationgjrza.exe" \??\c:\offdnee\jsbbv.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\G: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\Q: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\U: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\X: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\Y: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\Z: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\B: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\J: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\K: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\L: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\M: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\S: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\T: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\H: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\P: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\R: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\N: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\O: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\V: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\W: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\I: \??\c:\offdnee\jsbbv.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 \??\c:\offdnee\jsbbv.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz \??\c:\offdnee\jsbbv.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings \??\c:\offdnee\jsbbv.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UJ4ML.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UJ4ML.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A \??\c:\offdnee\jsbbv.exe N/A
Token: SeIncBasePriorityPrivilege N/A \??\c:\offdnee\jsbbv.exe N/A
Token: 33 N/A \??\c:\offdnee\jsbbv.exe N/A
Token: SeIncBasePriorityPrivilege N/A \??\c:\offdnee\jsbbv.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-UJ4ML.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3576 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-UJ4ML.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 3576 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-UJ4ML.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 3576 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-UJ4ML.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 1816 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\is-UJ4ML.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\is-UJ4ML.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp C:\Windows\SysWOW64\cmd.exe
PID 1816 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\is-UJ4ML.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp C:\Windows\SysWOW64\cmd.exe
PID 2876 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\offdnee\jsbbv.exe
PID 2876 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\offdnee\jsbbv.exe
PID 2876 wrote to memory of 1548 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\offdnee\jsbbv.exe
PID 1548 wrote to memory of 3004 N/A \??\c:\offdnee\jsbbv.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 1548 wrote to memory of 3004 N/A \??\c:\offdnee\jsbbv.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 1548 wrote to memory of 3004 N/A \??\c:\offdnee\jsbbv.exe C:\Windows\SysWOW64\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe

"C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe"

C:\Users\Admin\AppData\Local\Temp\is-UJ4ML.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp

"C:\Users\Admin\AppData\Local\Temp\is-UJ4ML.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp" /SL5="$F002A,2955638,832512,C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\offdnee\auunfs.bat" "

\??\c:\offdnee\jsbbv.exe

jsbbv.exe

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\jsbbv.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
HK 154.220.255.213:80 154.220.255.213 tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 213.255.220.154.in-addr.arpa udp
BE 2.17.107.130:443 www.bing.com tcp
US 8.8.8.8:53 130.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
HK 206.238.220.253:5569 tcp
US 8.8.8.8:53 253.220.238.206.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp

Files

memory/3576-0-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/3576-2-0x0000000000401000-0x00000000004B7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-UJ4ML.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp

MD5 b8b541de47d2028e1461bf8da2b986eb
SHA1 8d796773655fbaa6bbd1b5dffbd62717137b8dcc
SHA256 8235b6262165c66d2176cb9aee2928fd67e399ed6265e7df01104e7f7502bfa6
SHA512 8c4cfb0337f858ff8735e983a1422b950589df4427b1a865c3aa95aa9da6b00c1af206baecd2c3a3755b3fef2cc67e8a1483dad29670a53d557a7f22cc2f3b0e

memory/1816-6-0x0000000000400000-0x000000000071C000-memory.dmp

C:\offdnee\nnls_recorder.exe

MD5 09c53e6211a6f2b4c8f88e903b454442
SHA1 6c3756b5e5f0dd580552cc6b47197e5a1c289e9e
SHA256 fb5c8b5c6dbe07ed87de33cc2fd6d0c4dbdc0c09d48c0501984b23fd219b74c0
SHA512 eed140ddebee749544f5adb13b6a2aa4dcbc7ae033896981ef6149ca9521c50c0360aac1b7bf62623bd20c95c81b5417dfc1cdf0877b41dce1726376181c55b3

memory/1816-67-0x0000000000400000-0x000000000071C000-memory.dmp

memory/3576-69-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\offdnee\auunfs.bat

MD5 ece5ab7244e545593129ed6975fea7ad
SHA1 aad3a17e35451b8cb3a16c417d516c426af1d9ee
SHA256 1b5c15952e04aba0d9b9a4b52b2fb6cab7fc3be7fa597aa6b94b2158f54f64dd
SHA512 2261493189db28dde8b8af488bce1865d1d095f198825d665867c9414936fbd37527dcef008b45bbe1f48170a4ceec97c952ab9b72a53d3ec4601c2f80c104a6

C:\offdnee\cc.dat

MD5 2aa11fa3b80a06c6eac2dc8fd4ae1ded
SHA1 6d0234f6139ca7edcfe0e09a57ff09652987c30f
SHA256 4ef003d03f19f54e4bc1b39d796628d7a490b29ac2d222df27404225c694e3d7
SHA512 666e68672aa085a61656f9e27e76af0afcfd1a993ef62a172966288438cf3a71fd807fac2a1901582a4acb080f5a5c35936d416b1c4fe5d6016201f706debe24

C:\offdnee\clientconf.ini

MD5 ac6ad5d9b99757c3a878f2d275ace198
SHA1 439baa1b33514fb81632aaf44d16a9378c5664fc
SHA256 9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d
SHA512 bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b

C:\offdnee\jsbbv.exe

MD5 e90a533ecf1cc7684fd37be80e2e2702
SHA1 5d96a64eb8f7be0787229a4cc7a58b5d67d22925
SHA256 716a2299a052791abfb5df3820685dfe2c1734a0e8d356e876c68198efe3ef8f
SHA512 cce9a52eb1dbe233dbd25f0a12908b395c50641d7feb613c856bd79200db41bd555a7e9785ee9de700649deab91aabeba48db93154d24b4d3ea1e0b85ae440ba

memory/1548-80-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/1548-78-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/1548-79-0x0000000000400000-0x00000000005C0000-memory.dmp

C:\Users\Public\Documents\ahbvf.dll

MD5 7943effe67a4647e06def2348949020e
SHA1 eabd561f0639a975de259633f63896d82c3f878d
SHA256 3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512 c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

memory/1548-88-0x0000000002A50000-0x0000000002B3D000-memory.dmp

memory/1548-91-0x0000000000400000-0x00000000005C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jsbbv.txt

MD5 d504f3e79833f38f69ab0696a9ed8205
SHA1 88ca3e8ec7886048102125539b22b2e7d3ec3dc5
SHA256 174c0c0d80346d35c31674baf20f06040341ebd6b5103c762e64fb7e1b4a244c
SHA512 bc28d5566b5569f3a69ceb6b7c6db200aa22d6fcc41d4c03b18472143a44b58e8e4afa7d445c573d75f2cd3d375ae3cf568bc23f13e342cc80ee9f84c74638c1

C:\Users\Public\Documents\sjsw.log

MD5 68d973a1bd3e6785a4c2269fd2a6b7ab
SHA1 5799bb713a247876977ebbb3c6227f9659fe4d82
SHA256 777179ccb22b62bae6f176a9b17097dd323be66aaa743ef30329d371de2bd770
SHA512 37a1e69798e2703605a35bf737f1e1034339e16b47f922c8b9730171d1d9083c7f1fb4e567afcfeb6b6b8c6b7faee40b91987d9c5f509255504a28e34bfa93e2

memory/1548-86-0x0000000002A50000-0x0000000002B3D000-memory.dmp

C:\offdnee\zy.txt

MD5 25e6ce21e85fab3d21b6ee6df5089a41
SHA1 7dff799698789779412b1877df1b4b522397c77c
SHA256 023a19f93dd20591263656350af905e009dec56f579e33773e8be3dd22bfa089
SHA512 0530028eca643f0491ba5d5b07a347354ce28bb188d91e12ed8c20a575cb8f2ee967ecddcfd66b9da4172fc8424508a16f37979eb3693598c3e42e13b2e81f0b

memory/1548-77-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/1548-116-0x0000000003D90000-0x0000000003E86000-memory.dmp

memory/1548-117-0x0000000003D90000-0x0000000003E86000-memory.dmp

memory/1548-118-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1548-119-0x0000000003D90000-0x0000000003E86000-memory.dmp

memory/1548-120-0x0000000010001000-0x000000001000F000-memory.dmp

memory/1548-123-0x0000000000400000-0x0000000000428000-memory.dmp

memory/1548-121-0x0000000010000000-0x0000000010017000-memory.dmp

memory/1548-132-0x0000000002A50000-0x0000000002B3D000-memory.dmp

memory/1548-133-0x0000000002A50000-0x0000000002B3D000-memory.dmp

memory/1548-135-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/1548-137-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/1548-138-0x0000000010000000-0x0000000010003000-memory.dmp

memory/1548-140-0x0000000000400000-0x00000000005C0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 08:50

Reported

2024-05-30 08:52

Platform

win11-20240426-en

Max time kernel

92s

Max time network

99s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Loads dropped DLL

Description Indicator Process Target
N/A N/A \??\c:\offdnee\jsbbv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdatem = "C:\\Users\\Public\\98468222\\Applicationietbj.exe" \??\c:\offdnee\jsbbv.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\N: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\Q: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\R: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\V: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\Y: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\Z: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\E: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\J: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\L: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\U: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\B: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\G: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\H: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\K: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\O: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\P: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\W: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\X: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\M: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\S: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\T: \??\c:\offdnee\jsbbv.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe \??\c:\offdnee\jsbbv.exe

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 \??\c:\offdnee\jsbbv.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz \??\c:\offdnee\jsbbv.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000_Classes\Local Settings \??\c:\offdnee\jsbbv.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-IJHU8.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-IJHU8.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-IJHU8.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 224 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-IJHU8.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 224 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-IJHU8.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 224 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-IJHU8.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 2200 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\is-IJHU8.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\is-IJHU8.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\is-IJHU8.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\offdnee\jsbbv.exe
PID 2276 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\offdnee\jsbbv.exe
PID 2276 wrote to memory of 3932 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\offdnee\jsbbv.exe
PID 3932 wrote to memory of 2068 N/A \??\c:\offdnee\jsbbv.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 3932 wrote to memory of 2068 N/A \??\c:\offdnee\jsbbv.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 3932 wrote to memory of 2068 N/A \??\c:\offdnee\jsbbv.exe C:\Windows\SysWOW64\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe

"C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe"

C:\Users\Admin\AppData\Local\Temp\is-IJHU8.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp

"C:\Users\Admin\AppData\Local\Temp\is-IJHU8.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp" /SL5="$5020C,2955638,832512,C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\offdnee\auunfs.bat" "

\??\c:\offdnee\jsbbv.exe

jsbbv.exe

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\jsbbv.txt

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3932 -ip 3932

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3932 -s 2136

Network

Country Destination Domain Proto
HK 154.220.255.213:80 154.220.255.213 tcp
US 8.8.8.8:53 213.255.220.154.in-addr.arpa udp
HK 206.238.220.253:5569 tcp
US 8.8.8.8:53 253.220.238.206.in-addr.arpa udp
IE 52.111.236.21:443 tcp

Files

memory/224-0-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/224-2-0x0000000000401000-0x00000000004B7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-IJHU8.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp

MD5 b8b541de47d2028e1461bf8da2b986eb
SHA1 8d796773655fbaa6bbd1b5dffbd62717137b8dcc
SHA256 8235b6262165c66d2176cb9aee2928fd67e399ed6265e7df01104e7f7502bfa6
SHA512 8c4cfb0337f858ff8735e983a1422b950589df4427b1a865c3aa95aa9da6b00c1af206baecd2c3a3755b3fef2cc67e8a1483dad29670a53d557a7f22cc2f3b0e

memory/2200-7-0x0000000000400000-0x000000000071C000-memory.dmp

C:\offdnee\nnls_recorder.exe

MD5 09c53e6211a6f2b4c8f88e903b454442
SHA1 6c3756b5e5f0dd580552cc6b47197e5a1c289e9e
SHA256 fb5c8b5c6dbe07ed87de33cc2fd6d0c4dbdc0c09d48c0501984b23fd219b74c0
SHA512 eed140ddebee749544f5adb13b6a2aa4dcbc7ae033896981ef6149ca9521c50c0360aac1b7bf62623bd20c95c81b5417dfc1cdf0877b41dce1726376181c55b3

memory/2200-66-0x0000000000400000-0x000000000071C000-memory.dmp

C:\offdnee\auunfs.bat

MD5 ece5ab7244e545593129ed6975fea7ad
SHA1 aad3a17e35451b8cb3a16c417d516c426af1d9ee
SHA256 1b5c15952e04aba0d9b9a4b52b2fb6cab7fc3be7fa597aa6b94b2158f54f64dd
SHA512 2261493189db28dde8b8af488bce1865d1d095f198825d665867c9414936fbd37527dcef008b45bbe1f48170a4ceec97c952ab9b72a53d3ec4601c2f80c104a6

memory/224-72-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\offdnee\cc.dat

MD5 2aa11fa3b80a06c6eac2dc8fd4ae1ded
SHA1 6d0234f6139ca7edcfe0e09a57ff09652987c30f
SHA256 4ef003d03f19f54e4bc1b39d796628d7a490b29ac2d222df27404225c694e3d7
SHA512 666e68672aa085a61656f9e27e76af0afcfd1a993ef62a172966288438cf3a71fd807fac2a1901582a4acb080f5a5c35936d416b1c4fe5d6016201f706debe24

C:\offdnee\clientconf.ini

MD5 ac6ad5d9b99757c3a878f2d275ace198
SHA1 439baa1b33514fb81632aaf44d16a9378c5664fc
SHA256 9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d
SHA512 bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b

\??\c:\offdnee\jsbbv.exe

MD5 e90a533ecf1cc7684fd37be80e2e2702
SHA1 5d96a64eb8f7be0787229a4cc7a58b5d67d22925
SHA256 716a2299a052791abfb5df3820685dfe2c1734a0e8d356e876c68198efe3ef8f
SHA512 cce9a52eb1dbe233dbd25f0a12908b395c50641d7feb613c856bd79200db41bd555a7e9785ee9de700649deab91aabeba48db93154d24b4d3ea1e0b85ae440ba

memory/3932-79-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/3932-78-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/3932-77-0x0000000000400000-0x00000000005C0000-memory.dmp

C:\Users\Public\Documents\ahbvf.dll

MD5 7943effe67a4647e06def2348949020e
SHA1 eabd561f0639a975de259633f63896d82c3f878d
SHA256 3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512 c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

memory/3932-87-0x0000000002950000-0x0000000002A3D000-memory.dmp

memory/3932-85-0x0000000002950000-0x0000000002A3D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jsbbv.txt

MD5 d504f3e79833f38f69ab0696a9ed8205
SHA1 88ca3e8ec7886048102125539b22b2e7d3ec3dc5
SHA256 174c0c0d80346d35c31674baf20f06040341ebd6b5103c762e64fb7e1b4a244c
SHA512 bc28d5566b5569f3a69ceb6b7c6db200aa22d6fcc41d4c03b18472143a44b58e8e4afa7d445c573d75f2cd3d375ae3cf568bc23f13e342cc80ee9f84c74638c1

memory/3932-110-0x0000000000400000-0x00000000005C0000-memory.dmp

C:\Users\Public\Documents\sjsw.log

MD5 cc1331c9f905b612d109cab37ce0da4c
SHA1 c2cab00e368629a23e760b01dced918ed5397701
SHA256 b5ebdb67f17829029c954b5863b9be577dcb270a639497030ea3491025c8df34
SHA512 99dfccd550a9589df9a1aef50d8aa1c1ae89b7e28aeb463a9f8f82743848b2c1e17c14ecddb64d0a6d1f7ab8ee577ecf7cf3188f5b18dbd5aa9dd2d37417b278

C:\offdnee\zy.txt

MD5 25e6ce21e85fab3d21b6ee6df5089a41
SHA1 7dff799698789779412b1877df1b4b522397c77c
SHA256 023a19f93dd20591263656350af905e009dec56f579e33773e8be3dd22bfa089
SHA512 0530028eca643f0491ba5d5b07a347354ce28bb188d91e12ed8c20a575cb8f2ee967ecddcfd66b9da4172fc8424508a16f37979eb3693598c3e42e13b2e81f0b

memory/3932-76-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/3932-114-0x0000000003D20000-0x0000000003E16000-memory.dmp

memory/3932-115-0x0000000003D20000-0x0000000003E16000-memory.dmp

memory/3932-117-0x0000000003D20000-0x0000000003E16000-memory.dmp

memory/3932-116-0x0000000000400000-0x0000000000428000-memory.dmp

memory/3932-121-0x0000000000400000-0x0000000000428000-memory.dmp

memory/3932-119-0x0000000010000000-0x0000000010017000-memory.dmp

memory/3932-118-0x0000000010001000-0x000000001000F000-memory.dmp

memory/3932-131-0x0000000010000000-0x0000000010003000-memory.dmp

memory/3932-132-0x0000000002950000-0x0000000002A3D000-memory.dmp

memory/3932-133-0x0000000002950000-0x0000000002A3D000-memory.dmp

memory/3932-136-0x0000000000400000-0x0000000000428000-memory.dmp