Malware Analysis Report

2025-04-03 10:15

Sample ID 250202-npw99asjbr
Target 4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe
SHA256 4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281
Tags
discovery blackshades defense_evasion persistence rat upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281

Threat Level: Known bad

The file 4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe was found to be: Known bad.

Malicious Activity Summary

discovery blackshades defense_evasion persistence rat upx

Blackshades family

Modifies firewall policy service

Blackshades payload

Blackshades

Boot or Logon Autostart Execution: Active Setup

Adds policy Run key to start application

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

UPX packed file

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Modifies registry key

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-02 11:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-02 11:34

Reported

2025-02-02 11:36

Platform

win7-20240903-en

Max time kernel

30s

Max time network

16s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe

"C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe"

Network

N/A

Files

memory/2760-2-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2760-14-0x00000000002A0000-0x00000000002A1000-memory.dmp

memory/2760-4-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2760-26-0x0000000000340000-0x0000000000341000-memory.dmp

memory/2760-58-0x00000000003A0000-0x00000000003A1000-memory.dmp

memory/2760-38-0x0000000000360000-0x0000000000361000-memory.dmp

memory/2760-197-0x0000000000440000-0x0000000000442000-memory.dmp

memory/2760-195-0x00000000003F0000-0x00000000003F2000-memory.dmp

memory/2760-68-0x00000000003C0000-0x00000000003C1000-memory.dmp

memory/2760-43155-0x0000000000450000-0x0000000000452000-memory.dmp

memory/2760-43153-0x00000000003F0000-0x00000000003F2000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-02 11:34

Reported

2025-02-02 11:36

Platform

win10v2004-20250129-en

Max time kernel

119s

Max time network

115s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe"

Signatures

Blackshades

rat blackshades

Blackshades family

blackshades

Blackshades payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogonr\\winlogonr.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\DJXMLHG7SI.exe = "C:\\Users\\Admin\\AppData\\Roaming\\DJXMLHG7SI.exe:*:Enabled:Windows Messanger" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List C:\Windows\SysWOW64\reg.exe N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\DJXMLHG7SI.exe" C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A

Boot or Logon Autostart Execution: Active Setup

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{AA7D4AA4-AA9A-CF2C-C399-0A7A12E929AA} C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{AA7D4AA4-AA9A-CF2C-C399-0A7A12E929AA}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\DJXMLHG7SI.exe" C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA7D4AA4-AA9A-CF2C-C399-0A7A12E929AA} C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AA7D4AA4-AA9A-CF2C-C399-0A7A12E929AA}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\DJXMLHG7SI.exe" C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\winlogonr\\winlogonr.exe" C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\DJXMLHG7SI.exe" C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\DJXMLHG7SI.exe" C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 1 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeTcbPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: 31 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: 32 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2640 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe
PID 2640 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe
PID 2640 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe
PID 2640 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe
PID 2640 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe
PID 2640 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe
PID 2640 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe
PID 2640 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe
PID 1412 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Windows\SysWOW64\cmd.exe
PID 1412 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Windows\SysWOW64\cmd.exe
PID 2200 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2200 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2200 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1412 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 1412 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 1412 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 5000 wrote to memory of 4084 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe
PID 4084 wrote to memory of 628 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 628 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 628 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 1568 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 628 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 628 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2864 wrote to memory of 3360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2864 wrote to memory of 3360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2864 wrote to memory of 3360 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1568 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1568 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1568 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4148 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4148 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4148 wrote to memory of 2500 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe

"C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe"

C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe

"C:\Users\Admin\AppData\Local\Temp\4cb3f1c6ec766e8a677938e45caef6db8442b4c7e5f8068005e36e7620930281.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BDFRS.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "winlogon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe" /f

C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe

"C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe"

C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe

"C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe"

C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe

"C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\cmd.exe

cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DJXMLHG7SI.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DJXMLHG7SI.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe:*:Enabled:Windows Messanger" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f

C:\Windows\SysWOW64\reg.exe

REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\DJXMLHG7SI.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\DJXMLHG7SI.exe:*:Enabled:Windows Messanger" /f

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 11.153.16.2.in-addr.arpa udp
GB 95.101.143.184:443 www.bing.com tcp
US 8.8.8.8:53 167.173.78.104.in-addr.arpa udp
US 8.8.8.8:53 184.143.101.95.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 kreuz.hopto.org udp
US 8.8.8.8:53 kreuz.hopto.org udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 1kreuz.hopto.org udp
US 8.8.8.8:53 2kreuz.hopto.org udp
FR 78.159.135.230:43194 2kreuz.hopto.org tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 3kreuz.hopto.org udp
US 8.8.8.8:53 4kreuz.hopto.org udp

Files

memory/2640-2-0x0000000002290000-0x0000000002292000-memory.dmp

memory/2640-3-0x00000000022A0000-0x00000000022A2000-memory.dmp

memory/2640-4-0x00000000022C0000-0x00000000022C2000-memory.dmp

memory/2640-6-0x00000000022E0000-0x00000000022E2000-memory.dmp

memory/2640-5-0x00000000022D0000-0x00000000022D2000-memory.dmp

memory/2640-7-0x00000000022F0000-0x00000000022F2000-memory.dmp

memory/2640-8-0x0000000002A50000-0x0000000002A52000-memory.dmp

memory/1412-9-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2640-10-0x0000000002290000-0x0000000002292000-memory.dmp

memory/1412-12-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1412-13-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1412-14-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\BDFRS.txt

MD5 6831b89d0b8dc3e07588d733e75c122b
SHA1 8c70088c3224bbaf535ed19ec0f6bd5231c543be
SHA256 9fe102f2c6dff35f03787b85f725d12347cf491c897730a7f2e818f65177ffc2
SHA512 699fb44a25032ee4ad0ace1f941c826b333baddb65049c22e80b272909e85f4c8a00fef73fe2d97fa8998a0b6969b13461237bfc1e8f9bf711849d17d0cda6da

C:\Users\Admin\AppData\Roaming\winlogonr\winlogonr.exe

MD5 327b770d5c00d00afccdb8404ce93a03
SHA1 f4af94963c46cece104eae4114ef377f16647162
SHA256 fef4e97c5d2a5384baa3f3083e2ec086affa363b12cdfa0b54eda7da9f991d88
SHA512 3d88f855592bade68d28741a553ee80438a6762595ee8bbb63171e53ac6cf3673c58f57da38961eacb43a42d1c9f23e83a1241c6cc0a5b1904bcd31292d2239f

memory/1412-40-0x0000000000400000-0x000000000040B000-memory.dmp

memory/5000-42-0x0000000000400000-0x000000000043E000-memory.dmp

memory/5000-43-0x0000000000400000-0x000000000043E000-memory.dmp

memory/5000-45-0x0000000000400000-0x000000000043E000-memory.dmp

memory/4084-55-0x0000000000400000-0x000000000047B000-memory.dmp

memory/5000-59-0x0000000000400000-0x000000000043E000-memory.dmp

memory/4084-58-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1412-65-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4084-51-0x0000000000400000-0x000000000047B000-memory.dmp

memory/1052-69-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4084-70-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4084-76-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4084-81-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4084-85-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4084-89-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4084-94-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4084-98-0x0000000000400000-0x000000000047B000-memory.dmp

memory/4084-102-0x0000000000400000-0x000000000047B000-memory.dmp