Malware Analysis Report

2025-05-06 00:16

Sample ID 250124-jfcf9symdp
Target 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
SHA256 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464
Tags
upx blackshades discovery rat persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464

Threat Level: Known bad

The file 4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe was found to be: Known bad.

Malicious Activity Summary

upx blackshades discovery rat persistence

Blackshades

Blackshades payload

Blackshades family

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Drops file in Windows directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Modifies registry key

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-24 07:36

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-24 07:36

Reported

2025-01-24 07:38

Platform

win7-20240903-en

Max time kernel

3s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2784 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 2784 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 2784 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 2784 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 2784 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 2784 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 2784 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 2784 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 2784 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 2784 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 2784 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 2784 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe

"C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe

"C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\TSFNE.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 jadedcolossal.pointto.us udp

Files

memory/2784-0-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2784-5-0x0000000000250000-0x0000000000251000-memory.dmp

memory/2784-3-0x0000000000250000-0x0000000000251000-memory.dmp

memory/2784-15-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2784-25-0x0000000000404000-0x0000000000405000-memory.dmp

memory/2784-88-0x0000000000640000-0x0000000000641000-memory.dmp

memory/2784-78-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2784-70-0x00000000003D0000-0x00000000003D1000-memory.dmp

memory/2784-60-0x00000000003B0000-0x00000000003B1000-memory.dmp

memory/2784-40-0x00000000002B0000-0x00000000002B1000-memory.dmp

memory/2784-28-0x0000000000290000-0x0000000000291000-memory.dmp

memory/2784-98-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2572-103-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2572-122-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2572-118-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2572-117-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2572-115-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2572-113-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2784-127-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2572-111-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2988-133-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2784-145-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2988-143-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2784-141-0x0000000000404000-0x0000000000405000-memory.dmp

memory/2784-132-0x0000000002BC0000-0x0000000002CEE000-memory.dmp

memory/2572-109-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2572-107-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2572-105-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TSFNE.bat

MD5 163f8e838efe1d166ffff7408b814e28
SHA1 52fa0ccba649587e7d24d21d182657078fa6d028
SHA256 dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
SHA512 b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d

C:\Windows\javaruntime.exe

MD5 459cf02ce816ce425dd3f1a83b1b151e
SHA1 081d9e072310a2b459e93c1f811f093f81a7171c
SHA256 83549d791e9eceab7abec53e7b2640b3011bf30f76736ed333237af5483dfbef
SHA512 412b9cb74aaa52ecd41fa69b4564a4da9527eee3ced352a91c11fc8f14a6c1861ffedf98075fe1254a93f33f6c98180b59818d265156f79bdb00b3e2c63c1bcd

memory/2572-181-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2988-179-0x0000000003700000-0x000000000382E000-memory.dmp

memory/2988-178-0x0000000003700000-0x000000000382E000-memory.dmp

memory/2988-177-0x0000000003700000-0x000000000382E000-memory.dmp

memory/1520-182-0x0000000000400000-0x000000000052E000-memory.dmp

memory/1520-284-0x00000000031E0000-0x000000000330E000-memory.dmp

memory/2320-290-0x0000000000400000-0x000000000040B000-memory.dmp

memory/292-310-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1520-309-0x00000000031E0000-0x000000000330E000-memory.dmp

memory/2988-305-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2988-317-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1520-314-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2320-321-0x0000000000400000-0x000000000040B000-memory.dmp

memory/292-324-0x0000000000400000-0x000000000047B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-24 07:36

Reported

2025-01-24 07:38

Platform

win10v2004-20241007-en

Max time kernel

6s

Max time network

116s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\javaruntime.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaruntime = "C:\\Windows\\javaruntime.exe" C:\Windows\SysWOW64\reg.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\javaruntime.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe N/A
File opened for modification C:\Windows\javaruntime.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\javaruntime.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3920 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 3920 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 3920 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 3920 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 3920 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 3920 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 3920 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 3920 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 3920 wrote to memory of 1988 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\svchost.exe
PID 3920 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 3920 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 3920 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 3920 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 3920 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 3920 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 3920 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 3920 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe
PID 4548 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\cmd.exe
PID 4548 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\cmd.exe
PID 4548 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4684 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4684 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4548 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\javaruntime.exe
PID 4548 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\javaruntime.exe
PID 4548 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe C:\Windows\javaruntime.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe

"C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe

"C:\Users\Admin\AppData\Local\Temp\4a71b5473baa46863f36a803636e5b6084d7112d2301f6c9c9c5d05442d68464.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BMOJH.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\system32\svchost.exe"

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\javaruntime.exe

"C:\Windows\javaruntime.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 188.77.23.2.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp
US 8.8.8.8:53 jadedcolossal.pointto.us udp

Files

memory/3920-0-0x0000000000400000-0x000000000052E000-memory.dmp

memory/3920-3-0x00000000022A0000-0x00000000022A2000-memory.dmp

memory/3920-4-0x00000000022B0000-0x00000000022B2000-memory.dmp

memory/3920-5-0x00000000022F0000-0x00000000022F2000-memory.dmp

memory/1988-6-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1988-8-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1988-12-0x0000000000400000-0x000000000040C000-memory.dmp

memory/1988-9-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3920-13-0x0000000000400000-0x000000000052E000-memory.dmp

memory/4548-16-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4548-18-0x0000000000400000-0x000000000040B000-memory.dmp

memory/3920-21-0x0000000000400000-0x000000000052E000-memory.dmp

memory/4548-14-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BMOJH.txt

MD5 163f8e838efe1d166ffff7408b814e28
SHA1 52fa0ccba649587e7d24d21d182657078fa6d028
SHA256 dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
SHA512 b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d

C:\Windows\javaruntime.exe

MD5 04a87c84b3965e19ee437f4e846c87bb
SHA1 3470c2a0b7fd3def145c6f0b8cc04f2fa68d6ac1
SHA256 1694d01bf45b9992ef1ecfec3593c7d7fcd04a83d924e885be293fec817e60a0
SHA512 f49bc0a7eb66fbefdf270caa25a034ae5d81f0110bc45533449eeff3ad65f5744f1e772c27e8357a597d298ddcf44e565f01ac6cf104bd23c5e54033142a302d

memory/1988-45-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2224-46-0x0000000000400000-0x000000000052E000-memory.dmp

memory/2996-49-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2996-47-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2996-54-0x0000000000400000-0x000000000040C000-memory.dmp

memory/4548-53-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2224-70-0x0000000000400000-0x000000000052E000-memory.dmp

memory/1076-64-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1076-63-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1076-61-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4548-73-0x0000000000400000-0x000000000040B000-memory.dmp

memory/5092-74-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1076-77-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1076-79-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1076-82-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1076-84-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1076-86-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1076-89-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1076-91-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1076-93-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1076-98-0x0000000000400000-0x000000000047B000-memory.dmp