Malware Analysis Report

2025-03-15 06:39

Sample ID 240530-kxllyade27
Target e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416
SHA256 e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416
Tags
blackmoon gh0strat banker persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416

Threat Level: Known bad

The file e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416 was found to be: Known bad.

Malicious Activity Summary

blackmoon gh0strat banker persistence rat trojan

Gh0st RAT payload

Blackmoon, KrBanker

Detect Blackmoon payload

Gh0strat

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Enumerates connected drives

Enumerates physical storage devices

Program crash

Unsigned PE

Opens file in notepad (likely ransom note)

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious use of UnmapMainImage

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 08:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 08:58

Reported

2024-05-30 09:01

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\is-A6PSV.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp N/A
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation \??\c:\offdnee\jsbbv.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A \??\c:\offdnee\jsbbv.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qdatem = "C:\\Users\\Public\\79599289\\Applicationkgopj.exe" \??\c:\offdnee\jsbbv.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe \??\c:\offdnee\jsbbv.exe

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000_Classes\Local Settings \??\c:\offdnee\jsbbv.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-A6PSV.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4992 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-A6PSV.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 4992 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-A6PSV.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 4992 wrote to memory of 2188 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-A6PSV.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 2188 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\is-A6PSV.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\is-A6PSV.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\is-A6PSV.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp C:\Windows\SysWOW64\cmd.exe
PID 472 wrote to memory of 4620 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\offdnee\jsbbv.exe
PID 472 wrote to memory of 4620 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\offdnee\jsbbv.exe
PID 472 wrote to memory of 4620 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\offdnee\jsbbv.exe
PID 4620 wrote to memory of 1072 N/A \??\c:\offdnee\jsbbv.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 4620 wrote to memory of 1072 N/A \??\c:\offdnee\jsbbv.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 4620 wrote to memory of 1072 N/A \??\c:\offdnee\jsbbv.exe C:\Windows\SysWOW64\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe

"C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe"

C:\Users\Admin\AppData\Local\Temp\is-A6PSV.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp

"C:\Users\Admin\AppData\Local\Temp\is-A6PSV.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp" /SL5="$8006A,2955638,832512,C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\offdnee\auunfs.bat" "

\??\c:\offdnee\jsbbv.exe

jsbbv.exe

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\jsbbv.txt

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4620 -ip 4620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1988

Network

Country Destination Domain Proto
HK 154.220.255.213:80 154.220.255.213 tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 213.255.220.154.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
HK 206.238.220.253:5569 tcp
US 8.8.8.8:53 253.220.238.206.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 3.173.189.20.in-addr.arpa udp

Files

memory/4992-0-0x0000000000400000-0x00000000004D8000-memory.dmp

memory/4992-2-0x0000000000401000-0x00000000004B7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\is-A6PSV.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp

MD5 b8b541de47d2028e1461bf8da2b986eb
SHA1 8d796773655fbaa6bbd1b5dffbd62717137b8dcc
SHA256 8235b6262165c66d2176cb9aee2928fd67e399ed6265e7df01104e7f7502bfa6
SHA512 8c4cfb0337f858ff8735e983a1422b950589df4427b1a865c3aa95aa9da6b00c1af206baecd2c3a3755b3fef2cc67e8a1483dad29670a53d557a7f22cc2f3b0e

memory/2188-6-0x0000000000400000-0x000000000071C000-memory.dmp

C:\offdnee\nnls_recorder.exe

MD5 09c53e6211a6f2b4c8f88e903b454442
SHA1 6c3756b5e5f0dd580552cc6b47197e5a1c289e9e
SHA256 fb5c8b5c6dbe07ed87de33cc2fd6d0c4dbdc0c09d48c0501984b23fd219b74c0
SHA512 eed140ddebee749544f5adb13b6a2aa4dcbc7ae033896981ef6149ca9521c50c0360aac1b7bf62623bd20c95c81b5417dfc1cdf0877b41dce1726376181c55b3

memory/2188-67-0x0000000000400000-0x000000000071C000-memory.dmp

C:\offdnee\cc.dat

MD5 2aa11fa3b80a06c6eac2dc8fd4ae1ded
SHA1 6d0234f6139ca7edcfe0e09a57ff09652987c30f
SHA256 4ef003d03f19f54e4bc1b39d796628d7a490b29ac2d222df27404225c694e3d7
SHA512 666e68672aa085a61656f9e27e76af0afcfd1a993ef62a172966288438cf3a71fd807fac2a1901582a4acb080f5a5c35936d416b1c4fe5d6016201f706debe24

C:\offdnee\clientconf.ini

MD5 ac6ad5d9b99757c3a878f2d275ace198
SHA1 439baa1b33514fb81632aaf44d16a9378c5664fc
SHA256 9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d
SHA512 bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b

memory/4992-69-0x0000000000400000-0x00000000004D8000-memory.dmp

\??\c:\offdnee\jsbbv.exe

MD5 e90a533ecf1cc7684fd37be80e2e2702
SHA1 5d96a64eb8f7be0787229a4cc7a58b5d67d22925
SHA256 716a2299a052791abfb5df3820685dfe2c1734a0e8d356e876c68198efe3ef8f
SHA512 cce9a52eb1dbe233dbd25f0a12908b395c50641d7feb613c856bd79200db41bd555a7e9785ee9de700649deab91aabeba48db93154d24b4d3ea1e0b85ae440ba

C:\offdnee\auunfs.bat

MD5 ece5ab7244e545593129ed6975fea7ad
SHA1 aad3a17e35451b8cb3a16c417d516c426af1d9ee
SHA256 1b5c15952e04aba0d9b9a4b52b2fb6cab7fc3be7fa597aa6b94b2158f54f64dd
SHA512 2261493189db28dde8b8af488bce1865d1d095f198825d665867c9414936fbd37527dcef008b45bbe1f48170a4ceec97c952ab9b72a53d3ec4601c2f80c104a6

memory/4620-79-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/4620-78-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/4620-77-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/4620-87-0x0000000002A70000-0x0000000002B5D000-memory.dmp

memory/4620-85-0x0000000002A70000-0x0000000002B5D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\jsbbv.txt

MD5 d504f3e79833f38f69ab0696a9ed8205
SHA1 88ca3e8ec7886048102125539b22b2e7d3ec3dc5
SHA256 174c0c0d80346d35c31674baf20f06040341ebd6b5103c762e64fb7e1b4a244c
SHA512 bc28d5566b5569f3a69ceb6b7c6db200aa22d6fcc41d4c03b18472143a44b58e8e4afa7d445c573d75f2cd3d375ae3cf568bc23f13e342cc80ee9f84c74638c1

memory/4620-110-0x0000000000400000-0x00000000005C0000-memory.dmp

C:\Users\Public\Documents\sjsw.log

MD5 1f48ec34cbb3f2133f0db123f28781c2
SHA1 4d5b94aab5a281ce91ff1ffb9f7b7529fc5c91ca
SHA256 8274e041222194ac750c128a29ab7e6dd2f7bef46338a5c66c2640be64ad8597
SHA512 7a9573515769c88fb51cdaf2bfb8d946a934e0bfe64b61cad4baa889ede057eb79533d6186af5743ff0531237ddf4a44f216593b0574e96773f8786074eb3214

C:\Users\Public\Documents\ahbvf.dll

MD5 7943effe67a4647e06def2348949020e
SHA1 eabd561f0639a975de259633f63896d82c3f878d
SHA256 3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512 c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

C:\offdnee\zy.txt

MD5 25e6ce21e85fab3d21b6ee6df5089a41
SHA1 7dff799698789779412b1877df1b4b522397c77c
SHA256 023a19f93dd20591263656350af905e009dec56f579e33773e8be3dd22bfa089
SHA512 0530028eca643f0491ba5d5b07a347354ce28bb188d91e12ed8c20a575cb8f2ee967ecddcfd66b9da4172fc8424508a16f37979eb3693598c3e42e13b2e81f0b

memory/4620-115-0x0000000003C50000-0x0000000003D46000-memory.dmp

memory/4620-116-0x0000000003C50000-0x0000000003D46000-memory.dmp

memory/4620-117-0x0000000000400000-0x0000000000428000-memory.dmp

memory/4620-118-0x0000000003C50000-0x0000000003D46000-memory.dmp

memory/4620-119-0x0000000010001000-0x000000001000F000-memory.dmp

memory/4620-122-0x0000000000400000-0x0000000000428000-memory.dmp

memory/4620-120-0x0000000010000000-0x0000000010017000-memory.dmp

memory/4620-131-0x0000000002A70000-0x0000000002B5D000-memory.dmp

memory/4620-132-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/4620-138-0x0000000002A70000-0x0000000002B5D000-memory.dmp

memory/4620-140-0x0000000010000000-0x0000000010003000-memory.dmp

memory/4620-135-0x0000000000400000-0x0000000000428000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 08:58

Reported

2024-05-30 09:01

Platform

win7-20231129-en

Max time kernel

117s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Gh0st RAT payload

Description Indicator Process Target
N/A N/A N/A N/A

Gh0strat

rat gh0strat

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\qdatem = "C:\\Users\\Public\\95120790\\Applicationlsabu.exe" \??\c:\offdnee\jsbbv.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\R: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\S: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\U: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\W: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\B: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\E: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\L: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\O: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\Z: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\T: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\V: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\H: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\K: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\M: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\N: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\G: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\I: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\P: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\Y: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\J: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\Q: \??\c:\offdnee\jsbbv.exe N/A
File opened (read-only) \??\X: \??\c:\offdnee\jsbbv.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 \??\c:\offdnee\jsbbv.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz \??\c:\offdnee\jsbbv.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A \??\c:\offdnee\jsbbv.exe N/A
Token: SeIncBasePriorityPrivilege N/A \??\c:\offdnee\jsbbv.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A
N/A N/A \??\c:\offdnee\jsbbv.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A \??\c:\offdnee\jsbbv.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2264 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 2264 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 2264 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 2264 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 2264 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 2264 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 2264 wrote to memory of 956 N/A C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp
PID 956 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp C:\Windows\SysWOW64\cmd.exe
PID 956 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp C:\Windows\SysWOW64\cmd.exe
PID 956 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp C:\Windows\SysWOW64\cmd.exe
PID 956 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp C:\Windows\SysWOW64\cmd.exe
PID 2540 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\offdnee\jsbbv.exe
PID 2540 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\offdnee\jsbbv.exe
PID 2540 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\offdnee\jsbbv.exe
PID 2540 wrote to memory of 2612 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\offdnee\jsbbv.exe
PID 2612 wrote to memory of 2856 N/A \??\c:\offdnee\jsbbv.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 2612 wrote to memory of 2856 N/A \??\c:\offdnee\jsbbv.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 2612 wrote to memory of 2856 N/A \??\c:\offdnee\jsbbv.exe C:\Windows\SysWOW64\NOTEPAD.EXE
PID 2612 wrote to memory of 2856 N/A \??\c:\offdnee\jsbbv.exe C:\Windows\SysWOW64\NOTEPAD.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe

"C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe"

C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp

"C:\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp" /SL5="$70120,2955638,832512,C:\Users\Admin\AppData\Local\Temp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\offdnee\auunfs.bat" "

\??\c:\offdnee\jsbbv.exe

jsbbv.exe

C:\Windows\SysWOW64\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\jsbbv.txt

Network

Country Destination Domain Proto
HK 154.220.255.213:80 154.220.255.213 tcp
HK 206.238.220.253:5569 tcp
HK 206.238.220.253:5569 tcp

Files

memory/2264-2-0x0000000000401000-0x00000000004B7000-memory.dmp

memory/2264-0-0x0000000000400000-0x00000000004D8000-memory.dmp

\Users\Admin\AppData\Local\Temp\is-OFEU5.tmp\e8a42131a7aa2b3f08cedbd402e4877bf2eea179425b14f1b4665b654bed2416.tmp

MD5 b8b541de47d2028e1461bf8da2b986eb
SHA1 8d796773655fbaa6bbd1b5dffbd62717137b8dcc
SHA256 8235b6262165c66d2176cb9aee2928fd67e399ed6265e7df01104e7f7502bfa6
SHA512 8c4cfb0337f858ff8735e983a1422b950589df4427b1a865c3aa95aa9da6b00c1af206baecd2c3a3755b3fef2cc67e8a1483dad29670a53d557a7f22cc2f3b0e

memory/956-9-0x0000000000400000-0x000000000071C000-memory.dmp

C:\offdnee\is-NCTK7.tmp

MD5 09c53e6211a6f2b4c8f88e903b454442
SHA1 6c3756b5e5f0dd580552cc6b47197e5a1c289e9e
SHA256 fb5c8b5c6dbe07ed87de33cc2fd6d0c4dbdc0c09d48c0501984b23fd219b74c0
SHA512 eed140ddebee749544f5adb13b6a2aa4dcbc7ae033896981ef6149ca9521c50c0360aac1b7bf62623bd20c95c81b5417dfc1cdf0877b41dce1726376181c55b3

C:\offdnee\auunfs.bat

MD5 ece5ab7244e545593129ed6975fea7ad
SHA1 aad3a17e35451b8cb3a16c417d516c426af1d9ee
SHA256 1b5c15952e04aba0d9b9a4b52b2fb6cab7fc3be7fa597aa6b94b2158f54f64dd
SHA512 2261493189db28dde8b8af488bce1865d1d095f198825d665867c9414936fbd37527dcef008b45bbe1f48170a4ceec97c952ab9b72a53d3ec4601c2f80c104a6

memory/956-76-0x0000000000400000-0x000000000071C000-memory.dmp

memory/2264-78-0x0000000000400000-0x00000000004D8000-memory.dmp

C:\offdnee\clientconf.ini

MD5 ac6ad5d9b99757c3a878f2d275ace198
SHA1 439baa1b33514fb81632aaf44d16a9378c5664fc
SHA256 9b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d
SHA512 bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b

C:\offdnee\cc.dat

MD5 2aa11fa3b80a06c6eac2dc8fd4ae1ded
SHA1 6d0234f6139ca7edcfe0e09a57ff09652987c30f
SHA256 4ef003d03f19f54e4bc1b39d796628d7a490b29ac2d222df27404225c694e3d7
SHA512 666e68672aa085a61656f9e27e76af0afcfd1a993ef62a172966288438cf3a71fd807fac2a1901582a4acb080f5a5c35936d416b1c4fe5d6016201f706debe24

\offdnee\jsbbv.exe

MD5 e90a533ecf1cc7684fd37be80e2e2702
SHA1 5d96a64eb8f7be0787229a4cc7a58b5d67d22925
SHA256 716a2299a052791abfb5df3820685dfe2c1734a0e8d356e876c68198efe3ef8f
SHA512 cce9a52eb1dbe233dbd25f0a12908b395c50641d7feb613c856bd79200db41bd555a7e9785ee9de700649deab91aabeba48db93154d24b4d3ea1e0b85ae440ba

memory/2540-90-0x0000000002230000-0x00000000023F0000-memory.dmp

memory/2612-92-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/2540-89-0x0000000002230000-0x00000000023F0000-memory.dmp

memory/2612-93-0x0000000000400000-0x00000000005C0000-memory.dmp

C:\offdnee\zy.txt

MD5 25e6ce21e85fab3d21b6ee6df5089a41
SHA1 7dff799698789779412b1877df1b4b522397c77c
SHA256 023a19f93dd20591263656350af905e009dec56f579e33773e8be3dd22bfa089
SHA512 0530028eca643f0491ba5d5b07a347354ce28bb188d91e12ed8c20a575cb8f2ee967ecddcfd66b9da4172fc8424508a16f37979eb3693598c3e42e13b2e81f0b

\Users\Public\Documents\ahbvf.dll

MD5 7943effe67a4647e06def2348949020e
SHA1 eabd561f0639a975de259633f63896d82c3f878d
SHA256 3fac47db92d581b2daef7a4f9493be2fe441041e5158101d80873d05808d5cfa
SHA512 c9db1962e7457c94426c2a5c7f439736697d4399db6982c45357459d58805daa4a9d297912135488b6990e265ffa59d687fd5ba43717aab46ccc212083ef5003

memory/2612-100-0x00000000021D0000-0x00000000022BD000-memory.dmp

memory/2612-99-0x00000000021D0000-0x00000000022BD000-memory.dmp

C:\Users\Public\Documents\sjsw.log

MD5 cc6ca6f3d8bf1f7d9bcdd7ebbe72e4fe
SHA1 1641a01ff8555e32aa10de54dc6f21f7552c423d
SHA256 cd1be6f0225c3ff42c767bf5eb101ba1f496c9a91adbbf3bb21ec75c04977e22
SHA512 3a184959815447153d351f3bbfc1baae9c58e9f67900ef812d462e54d78ac5df65caf3decfa06384fa1e30323b4bd0c21dc937934b31e5c820d8745d8780b49a

C:\Users\Admin\AppData\Local\Temp\jsbbv.txt

MD5 d504f3e79833f38f69ab0696a9ed8205
SHA1 88ca3e8ec7886048102125539b22b2e7d3ec3dc5
SHA256 174c0c0d80346d35c31674baf20f06040341ebd6b5103c762e64fb7e1b4a244c
SHA512 bc28d5566b5569f3a69ceb6b7c6db200aa22d6fcc41d4c03b18472143a44b58e8e4afa7d445c573d75f2cd3d375ae3cf568bc23f13e342cc80ee9f84c74638c1

memory/2612-123-0x0000000000400000-0x00000000005C0000-memory.dmp

memory/2540-125-0x0000000002230000-0x00000000023F0000-memory.dmp

memory/2612-129-0x00000000049F0000-0x0000000004AE6000-memory.dmp

memory/2612-130-0x00000000049F0000-0x0000000004AE6000-memory.dmp

memory/2612-131-0x0000000000400000-0x0000000000428000-memory.dmp

memory/2612-132-0x00000000049F0000-0x0000000004AE6000-memory.dmp

memory/2612-136-0x0000000000400000-0x0000000000428000-memory.dmp

memory/2612-133-0x0000000010000000-0x0000000010017000-memory.dmp

memory/2612-145-0x00000000021D0000-0x00000000022BD000-memory.dmp

memory/2612-146-0x00000000021D0000-0x00000000022BD000-memory.dmp