Malware Analysis Report

2025-05-06 00:09

Sample ID 250124-qe7dks1pcn
Target 0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe
SHA256 0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654
Tags
upx blackshades defense_evasion discovery persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654

Threat Level: Known bad

The file 0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe was found to be: Known bad.

Malicious Activity Summary

upx blackshades defense_evasion discovery persistence rat

Blackshades

Blackshades payload

Blackshades family

Modifies firewall policy service

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Modifies registry key

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-01-24 13:11

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-01-24 13:11

Reported

2025-01-24 13:13

Platform

win7-20240903-en

Max time kernel

119s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2196 set thread context of 2964 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 set thread context of 2836 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2404 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2444 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Windows\SysWOW64\cmd.exe
PID 2444 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2444 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2444 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2444 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2404 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2404 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2404 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2404 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2196 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2624 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2624 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2624 wrote to memory of 2628 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2880 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2880 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2880 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2880 wrote to memory of 2668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2620 wrote to memory of 2508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2620 wrote to memory of 2508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2620 wrote to memory of 2508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2620 wrote to memory of 2508 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2964 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2964 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 2768 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2768 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2768 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2768 wrote to memory of 1316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe

"C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\QcLwj.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Winlogon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe" /f

C:\Users\Admin\AppData\Roaming\winlogon.exe

"C:\Users\Admin\AppData\Roaming\winlogon.exe"

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 soukchayt2.no-ip.org udp

Files

memory/2404-0-0x0000000000400000-0x000000000058F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\QcLwj.bat

MD5 4da6717f2c70f4bd32ad33a227a2ff47
SHA1 3d7f7159e1f695bd469287d1ad4ffa0841b407a8
SHA256 a12bb2e5d2fb0b3c400ce311fae72995a00b57a97d23e4b9effec47cff189d07
SHA512 6765314054ad9bf2164058248f3d3a17775176925abbe4376aec030dca3a5e59be8b9e96139941fec2b2e1a9bff38f87abdb29ea09a299d8ab7e23ecec4083df

C:\Users\Admin\AppData\Roaming\winlogon.exe

MD5 7657135c687ce5c8b6371ff3df5aa93d
SHA1 aca59350ec9dfe3af7aaa8329c7f61f18a6df96d
SHA256 46e2b1d4daa21fd6954e460771a7e2acfa4ea8074ba9b7f19497e57e71456f8f
SHA512 0fc1bb068b71433c8cc2636aca547e05a0db459229241a389b34430ecd920038bfddfcbd78df91ecbcb362e6af60f3d0ed61dfaf5b7d41ed731b0515d025baff

memory/2404-47-0x0000000000400000-0x000000000058F000-memory.dmp

memory/2196-50-0x0000000000400000-0x000000000058F000-memory.dmp

memory/2404-43-0x00000000031A0000-0x000000000332F000-memory.dmp

memory/2404-42-0x00000000031A0000-0x000000000332F000-memory.dmp

memory/2836-69-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2964-68-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2836-64-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2836-63-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2964-51-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2196-67-0x0000000000400000-0x000000000058F000-memory.dmp

memory/2836-60-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2964-56-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2964-55-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2404-72-0x00000000031A0000-0x000000000332F000-memory.dmp

memory/2964-73-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2836-74-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2964-77-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2964-79-0x0000000000400000-0x000000000045D000-memory.dmp

memory/2964-82-0x0000000000400000-0x000000000045D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-01-24 13:11

Reported

2025-01-24 13:13

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

109s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2964 set thread context of 4736 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 set thread context of 4316 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogon.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3140 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Windows\SysWOW64\cmd.exe
PID 3140 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Windows\SysWOW64\cmd.exe
PID 3140 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Windows\SysWOW64\cmd.exe
PID 1272 wrote to memory of 1176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1272 wrote to memory of 1176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1272 wrote to memory of 1176 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3140 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 3140 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 3140 wrote to memory of 2964 N/A C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 2964 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Users\Admin\AppData\Roaming\winlogon.exe
PID 4736 wrote to memory of 800 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 4736 wrote to memory of 800 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 4736 wrote to memory of 800 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 4736 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 4736 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 4736 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 4736 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 4736 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 4736 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 4736 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 4736 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 4736 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Roaming\winlogon.exe C:\Windows\SysWOW64\cmd.exe
PID 800 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 800 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 800 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3248 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3248 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3248 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1092 wrote to memory of 3552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1092 wrote to memory of 3552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1092 wrote to memory of 3552 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2456 wrote to memory of 4948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2456 wrote to memory of 4948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2456 wrote to memory of 4948 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe

"C:\Users\Admin\AppData\Local\Temp\0c7ef5b38a3667edb2b77df7e68219a68e68d81519b70002380ce5809b9c5654N.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\GQyqJ.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Winlogon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe" /f

C:\Users\Admin\AppData\Roaming\winlogon.exe

"C:\Users\Admin\AppData\Roaming\winlogon.exe"

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Users\Admin\AppData\Roaming\winlogon.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 105.164.16.2.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 188.77.23.2.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 soukchayt2.no-ip.org udp

Files

memory/3140-0-0x0000000000400000-0x000000000058F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\GQyqJ.txt

MD5 4da6717f2c70f4bd32ad33a227a2ff47
SHA1 3d7f7159e1f695bd469287d1ad4ffa0841b407a8
SHA256 a12bb2e5d2fb0b3c400ce311fae72995a00b57a97d23e4b9effec47cff189d07
SHA512 6765314054ad9bf2164058248f3d3a17775176925abbe4376aec030dca3a5e59be8b9e96139941fec2b2e1a9bff38f87abdb29ea09a299d8ab7e23ecec4083df

C:\Users\Admin\AppData\Roaming\winlogon.txt

MD5 ee8c15322d0385bf2df66a275c842cb2
SHA1 dde0ccd1dad7f04c307906578aa7fd7cedb32bd3
SHA256 15213f61ae910e29cba3623bfbc1d26c5a539a76b851ce895fe39dc228760274
SHA512 b5969d19a492d7fd8662bf3d3d45d31134709796b57bdcfa444a081bf0619898de3dea970c48070c07e940492d5eada4056db625cfad68bba1f3b3b7e3925371

memory/3140-29-0x0000000000400000-0x000000000058F000-memory.dmp

memory/4736-35-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4736-31-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4736-34-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4736-40-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4316-47-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4316-50-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4316-46-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2964-51-0x0000000000400000-0x000000000058F000-memory.dmp

memory/4316-41-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4736-38-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4736-52-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4316-53-0x0000000000400000-0x0000000000409000-memory.dmp

memory/4736-54-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4736-56-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4736-59-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4736-61-0x0000000000400000-0x000000000045D000-memory.dmp

memory/4736-77-0x0000000000400000-0x000000000045D000-memory.dmp