Malware Analysis Report

2024-11-30 20:00

Sample ID 210418-62cq4d9by2
Target 6EC77929D5F70F9BC4724D23DDBC2653.exe
SHA256 03e3837f16d46a1a0a13904fae467c105b1aae66b382e8313b20b90269e53ed6
Tags
betabot backdoor botnet evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

03e3837f16d46a1a0a13904fae467c105b1aae66b382e8313b20b90269e53ed6

Threat Level: Known bad

The file 6EC77929D5F70F9BC4724D23DDBC2653.exe was found to be: Known bad.

Malicious Activity Summary

betabot backdoor botnet evasion persistence trojan

Modifies firewall policy service

BetaBot

Sets file to hidden

Executes dropped EXE

Sets file execution options in registry

Loads dropped DLL

Checks BIOS information in registry

Checks whether UAC is enabled

Drops desktop.ini file(s)

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies registry class

Delays execution with timeout.exe

Kills process with taskkill

Enumerates system info in registry

Modifies Internet Explorer Protected Mode

NTFS ADS

Suspicious behavior: MapViewOfSection

Checks processor information in registry

Modifies Internet Explorer Protected Mode Banner

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Views/modifies file attributes

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-04-18 05:50

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-04-18 05:50

Reported

2021-04-18 05:52

Platform

win7v20210410

Max time kernel

148s

Max time network

152s

Command Line

C:\Windows\Explorer.EXE

Signatures

BetaBot

trojan backdoor botnet betabot

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A

Sets file execution options in registry

persistence

Sets file to hidden

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\yokc711s3gmuw31.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\yokc711s3gmuw31.exe\"" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\yokc711s3gmuw31.exe\"" C:\Windows\SysWOW64\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\booking\data\modylsid.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Google Updater 2.09\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1808 set thread context of 788 N/A C:\booking\data\modylsid.exe C:\booking\data\modylsid.exe
PID 864 set thread context of 0 N/A C:\Users\Admin\AppData\Local\Temp\yokc711s3gmuw31_1.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\booking\data\modylsid.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\booking\data\modylsid.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\explorer.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\VersionManager\DownloadVersionList = "0" C:\Windows\SysWOW64\explorer.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\yokc711s3gmuw31_1.exe:14EDFC78 C:\Windows\SysWOW64\explorer.exe N/A
File created C:\Users\Admin\AppData\Local\Temp\yokc711s3gmuw31_1.exe:14EDFC78 C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeRestorePrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeBackupPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeLoadDriverPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeShutdownPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeCreateTokenPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeMachineAccountPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeSecurityPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: 33 N/A C:\booking\data\modylsid.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7skk3s71ys7q.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 296 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe C:\Windows\SysWOW64\WScript.exe
PID 296 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe C:\Windows\SysWOW64\WScript.exe
PID 296 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe C:\Windows\SysWOW64\WScript.exe
PID 296 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe C:\Windows\SysWOW64\WScript.exe
PID 296 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe C:\Windows\SysWOW64\WScript.exe
PID 296 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe C:\Windows\SysWOW64\WScript.exe
PID 296 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe C:\Windows\SysWOW64\WScript.exe
PID 1972 wrote to memory of 1692 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1692 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1692 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1692 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1692 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1692 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1972 wrote to memory of 1692 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1692 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 1856 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 464 N/A C:\Windows\SysWOW64\cmd.exe C:\booking\data\K480101741BH.exe
PID 1692 wrote to memory of 464 N/A C:\Windows\SysWOW64\cmd.exe C:\booking\data\K480101741BH.exe
PID 1692 wrote to memory of 464 N/A C:\Windows\SysWOW64\cmd.exe C:\booking\data\K480101741BH.exe
PID 1692 wrote to memory of 464 N/A C:\Windows\SysWOW64\cmd.exe C:\booking\data\K480101741BH.exe
PID 1692 wrote to memory of 464 N/A C:\Windows\SysWOW64\cmd.exe C:\booking\data\K480101741BH.exe
PID 1692 wrote to memory of 464 N/A C:\Windows\SysWOW64\cmd.exe C:\booking\data\K480101741BH.exe
PID 1692 wrote to memory of 464 N/A C:\Windows\SysWOW64\cmd.exe C:\booking\data\K480101741BH.exe
PID 1692 wrote to memory of 968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 968 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1692 wrote to memory of 756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1692 wrote to memory of 756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1692 wrote to memory of 756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1692 wrote to memory of 756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1692 wrote to memory of 756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1692 wrote to memory of 756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1692 wrote to memory of 872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 756 wrote to memory of 860 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 860 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 860 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 860 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 860 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 860 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 756 wrote to memory of 860 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 860 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 860 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 860 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 860 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 860 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 860 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 860 wrote to memory of 812 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 860 wrote to memory of 904 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe

"C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\booking\data\startbook.vbs" /f=CREATE_NO_WINDOW install.cmd

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\booking\data\start1.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-2112777347119662564316717971201258821549-214332214317250074-13439356551356107061"

C:\Windows\SysWOW64\timeout.exe

timeout 7

C:\booking\data\K480101741BH.exe

"K480101741BH.exe" e -psetup wid.rar

C:\Windows\SysWOW64\timeout.exe

timeout 6

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\booking\data\fbk.vbs"

C:\Windows\SysWOW64\timeout.exe

timeout 8

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\booking\data\445.bat" "

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\booking"

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\booking\data\modylsid.exe

modylsid.exe /start

C:\booking\data\modylsid.exe

modylsid.exe /start

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im K480101741BH.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im K480101741BH.exe

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\booking\data"

C:\Windows\SysWOW64\timeout.exe

timeout 4

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\yokc711s3gmuw31_1.exe

/suac

C:\Users\Admin\AppData\Local\Temp\7skk3s71ys7q.exe

"C:\Users\Admin\AppData\Local\Temp\7skk3s71ys7q.exe"

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 windowsupdate.microsoft.com udp
N/A 52.137.90.34:80 windowsupdate.microsoft.com tcp
N/A 8.8.8.8:53 russk17.icu udp
N/A 8.8.8.8:53 russk17.icu udp
N/A 172.241.27.185:80 russk17.icu tcp
N/A 8.8.8.8:53 amityestatelagos.com udp
N/A 198.54.126.145:80 amityestatelagos.com tcp
N/A 198.54.126.145:443 amityestatelagos.com tcp
N/A 8.8.8.8:53 russk17.icu udp
N/A 172.241.27.185:80 russk17.icu tcp

Files

memory/296-59-0x00000000757E1000-0x00000000757E3000-memory.dmp

memory/1972-60-0x0000000000000000-mapping.dmp

C:\booking\data\startbook.vbs

MD5 594e0cb7f4486880945b986f1adf9f49
SHA1 8155f7be615cd60017a1af07aac17801de2a64ba
SHA256 265d486a8fac96e0c3ce1309c50bcb88b0a37f739e533ed92483fe66b946c220
SHA512 3093b6e45fc17654e2419b08d6519dd891afd1672bcf6e61c77dca19258ae8bf7d46db98facb38e0a27527cae865a8d1445d8546be78af6cbc465e5fd56d87c4

C:\booking\data\start1.bat

MD5 0ccf45b2c7aad8f25d8a8f3a6ff7b620
SHA1 7785a6d2b22a8b64dd549bc0a8a08a85b6404525
SHA256 8df03bfad7860d4f609e48de215c6f40fbb0de78bdaeb08fdf3409e722585efb
SHA512 3fb8dd5fa9cdbb59d5d195e66f6108954c4a89b358a2f75bbb6e03739a67965ead3d91a24a648a4204fc32c6d753815e4cf98e17a2fdc5913704c28fdb159f6c

memory/1692-64-0x0000000000000000-mapping.dmp

memory/1856-66-0x0000000000000000-mapping.dmp

C:\booking\data\lip

MD5 f75ae8515bc7bc47354f22b6b4f20046
SHA1 03b1dc027bac21b149337e07d2d1f4af363cb6f4
SHA256 2e5c9d234c85488239cc3c55ed2053ae166222bdb668defe9c3bd0d93ece632a
SHA512 cdd90aaed29aac6e91fcb964480379e0e114b363c5e286d51e22ea1e617364319989143b205298dd15e875d8f349f2bec54001480e31d01acbb95e4eeaaad255

\booking\data\K480101741BH.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

memory/464-71-0x0000000000000000-mapping.dmp

C:\booking\data\K480101741BH.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

C:\booking\data\K480101741BH.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

memory/968-74-0x0000000000000000-mapping.dmp

C:\booking\data\fbk.vbs

MD5 12c302b2a7afa9d52bbc04875144319f
SHA1 5c5b5a2024a0f2838a0d94268282ad95ba388b25
SHA256 3e8e92c822501efaae4e4ae0c4e63d6822bc5aa5e2178ab5f5cf6bb74c77e283
SHA512 18b197db47f2bb2853de592a672a321f4188722eb48fd6165f9bc6d9f3dfe69dff2c0fdc49f9e5cfe939722c9ce47dd5dc31424619660c6e745122f5590a022f

memory/756-77-0x0000000000000000-mapping.dmp

memory/872-79-0x0000000000000000-mapping.dmp

C:\booking\data\445.bat

MD5 3c4875cff185c701a9f28f58ead13d33
SHA1 7585bca806fdeb727177c3fba6c371aa8d9c2951
SHA256 ad8c7a4cc068b36c5227b9076fe60e0529f080a6a849f8764750e2c173a0bf96
SHA512 ad9404fad164a57eb9577ff2569f5e237901d2a03059267d032d5b853dd2d8f5bf50375c981baf2064ee3b0b9cb8929eccc32c920843bba43fb4f7cdde7cd972

memory/860-82-0x0000000000000000-mapping.dmp

memory/812-84-0x0000000000000000-mapping.dmp

memory/904-86-0x0000000000000000-mapping.dmp

\booking\data\modylsid.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

C:\booking\data\modylsid.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

\booking\data\modylsid.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

memory/1808-91-0x0000000000000000-mapping.dmp

C:\booking\data\modylsid.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

memory/788-95-0x0000000000400000-0x0000000000435000-memory.dmp

memory/788-96-0x00000000004015C6-mapping.dmp

\booking\data\modylsid.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

C:\booking\data\modylsid.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

memory/1948-99-0x0000000000000000-mapping.dmp

memory/1140-101-0x0000000000000000-mapping.dmp

memory/1112-103-0x0000000000000000-mapping.dmp

memory/568-105-0x0000000000000000-mapping.dmp

memory/788-108-0x0000000000440000-0x00000000004A6000-memory.dmp

memory/788-107-0x0000000000400000-0x0000000000435000-memory.dmp

memory/788-109-0x0000000000240000-0x0000000000241000-memory.dmp

memory/788-111-0x0000000000510000-0x0000000000511000-memory.dmp

memory/788-112-0x0000000001EF0000-0x0000000001EFC000-memory.dmp

memory/788-110-0x0000000000250000-0x000000000025D000-memory.dmp

memory/1796-113-0x0000000000000000-mapping.dmp

memory/1796-115-0x0000000073FF1000-0x0000000073FF3000-memory.dmp

memory/1796-117-0x0000000000510000-0x0000000000636000-memory.dmp

memory/1796-121-0x0000000000660000-0x000000000066C000-memory.dmp

memory/1796-122-0x0000000000650000-0x0000000000651000-memory.dmp

memory/1796-116-0x00000000770B0000-0x0000000077230000-memory.dmp

memory/1692-124-0x00000000022B0000-0x00000000023D6000-memory.dmp

memory/1796-125-0x00000000007F0000-0x0000000000870000-memory.dmp

\Users\Admin\AppData\Local\Temp\yokc711s3gmuw31_1.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

memory/864-127-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\yokc711s3gmuw31_1.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

C:\Users\Admin\AppData\Local\Temp\yokc711s3gmuw31_1.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

memory/1636-130-0x0000000003A60000-0x0000000003A66000-memory.dmp

\Users\Admin\AppData\Local\Temp\7skk3s71ys7q.exe

MD5 85f0fb9dafac47fb151d2a33f6556112
SHA1 0e021df3e0a91983c34bc9620bbcd6c9aa74edd7
SHA256 fea0fdad9f440f68feb5c3b6f4952a952375397a6220c253fe7d3eeb15523397
SHA512 1a11801302042dde8706cb0a0f6ad27650d74396bf270bc0a0cc3969370d2324de20f46c4a619b6f275586e87fe489b80dfe69c70712c175c881740a14bfa9b1

C:\Users\Admin\AppData\Local\Temp\7skk3s71ys7q.exe

MD5 85f0fb9dafac47fb151d2a33f6556112
SHA1 0e021df3e0a91983c34bc9620bbcd6c9aa74edd7
SHA256 fea0fdad9f440f68feb5c3b6f4952a952375397a6220c253fe7d3eeb15523397
SHA512 1a11801302042dde8706cb0a0f6ad27650d74396bf270bc0a0cc3969370d2324de20f46c4a619b6f275586e87fe489b80dfe69c70712c175c881740a14bfa9b1

memory/268-132-0x0000000000000000-mapping.dmp

memory/1196-136-0x0000000003BD0000-0x0000000003BD6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-04-18 05:50

Reported

2021-04-18 05:52

Platform

win10v20210408

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe"

Signatures

BetaBot

trojan backdoor botnet betabot

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A

Sets file execution options in registry

persistence

Sets file to hidden

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\1s75i91qs3.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\1s75i91qs3.exe\"" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\1s75i91qs3.exe\"" C:\Windows\SysWOW64\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\booking\data\modylsid.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\SysWOW64\cmd.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Google Updater 2.09\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 932 set thread context of 2660 N/A C:\booking\data\modylsid.exe C:\booking\data\modylsid.exe
PID 1352 set thread context of 0 N/A C:\Users\Admin\AppData\Local\Temp\1s75i91qs3_1.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\booking\data\modylsid.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\booking\data\modylsid.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\explorer.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\VersionManager\DownloadVersionList = "0" C:\Windows\SysWOW64\explorer.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\1s75i91qs3_1.exe:14EDFC78 C:\Windows\SysWOW64\explorer.exe N/A
File created C:\Users\Admin\AppData\Local\Temp\1s75i91qs3_1.exe:14EDFC78 C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\booking\data\modylsid.exe N/A
N/A N/A C:\booking\data\modylsid.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeRestorePrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeBackupPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeLoadDriverPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeShutdownPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeCreateTokenPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeMachineAccountPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeSecurityPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\booking\data\modylsid.exe N/A
Token: 33 N/A C:\booking\data\modylsid.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 33 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 34 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 35 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: 36 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\959m3m1kk7o7aq1.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 784 wrote to memory of 200 N/A C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe C:\Windows\SysWOW64\WScript.exe
PID 784 wrote to memory of 200 N/A C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe C:\Windows\SysWOW64\WScript.exe
PID 784 wrote to memory of 200 N/A C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe C:\Windows\SysWOW64\WScript.exe
PID 200 wrote to memory of 4092 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 200 wrote to memory of 4092 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 200 wrote to memory of 4092 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4092 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4092 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4092 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4092 wrote to memory of 3856 N/A C:\Windows\SysWOW64\cmd.exe C:\booking\data\K480101741BH.exe
PID 4092 wrote to memory of 3856 N/A C:\Windows\SysWOW64\cmd.exe C:\booking\data\K480101741BH.exe
PID 4092 wrote to memory of 3856 N/A C:\Windows\SysWOW64\cmd.exe C:\booking\data\K480101741BH.exe
PID 4092 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4092 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4092 wrote to memory of 2528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4092 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4092 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4092 wrote to memory of 2844 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4092 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4092 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4092 wrote to memory of 2848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2844 wrote to memory of 1456 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 1456 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2844 wrote to memory of 1456 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1456 wrote to memory of 3712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1456 wrote to memory of 3712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1456 wrote to memory of 3712 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1456 wrote to memory of 3532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1456 wrote to memory of 3532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1456 wrote to memory of 3532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1456 wrote to memory of 932 N/A C:\Windows\SysWOW64\cmd.exe C:\booking\data\modylsid.exe
PID 1456 wrote to memory of 932 N/A C:\Windows\SysWOW64\cmd.exe C:\booking\data\modylsid.exe
PID 1456 wrote to memory of 932 N/A C:\Windows\SysWOW64\cmd.exe C:\booking\data\modylsid.exe
PID 932 wrote to memory of 2660 N/A C:\booking\data\modylsid.exe C:\booking\data\modylsid.exe
PID 932 wrote to memory of 2660 N/A C:\booking\data\modylsid.exe C:\booking\data\modylsid.exe
PID 932 wrote to memory of 2660 N/A C:\booking\data\modylsid.exe C:\booking\data\modylsid.exe
PID 932 wrote to memory of 2660 N/A C:\booking\data\modylsid.exe C:\booking\data\modylsid.exe
PID 932 wrote to memory of 2660 N/A C:\booking\data\modylsid.exe C:\booking\data\modylsid.exe
PID 1456 wrote to memory of 3736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1456 wrote to memory of 3736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1456 wrote to memory of 3736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1456 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1456 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1456 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1456 wrote to memory of 2384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1456 wrote to memory of 2384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1456 wrote to memory of 2384 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1456 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1456 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1456 wrote to memory of 2324 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2660 wrote to memory of 2464 N/A C:\booking\data\modylsid.exe C:\Windows\SysWOW64\explorer.exe
PID 2660 wrote to memory of 2464 N/A C:\booking\data\modylsid.exe C:\Windows\SysWOW64\explorer.exe
PID 2660 wrote to memory of 2464 N/A C:\booking\data\modylsid.exe C:\Windows\SysWOW64\explorer.exe
PID 2464 wrote to memory of 4092 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 2464 wrote to memory of 4092 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 2464 wrote to memory of 2848 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\timeout.exe
PID 2464 wrote to memory of 2848 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\timeout.exe
PID 2464 wrote to memory of 1456 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 2464 wrote to memory of 1456 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 2464 wrote to memory of 2324 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\timeout.exe
PID 2464 wrote to memory of 2324 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\timeout.exe
PID 2464 wrote to memory of 1352 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\1s75i91qs3_1.exe
PID 2464 wrote to memory of 1352 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\1s75i91qs3_1.exe
PID 2464 wrote to memory of 1352 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\1s75i91qs3_1.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe

"C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\booking\data\startbook.vbs" /f=CREATE_NO_WINDOW install.cmd

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\booking\data\start1.bat" "

C:\Windows\SysWOW64\timeout.exe

timeout 7

C:\booking\data\K480101741BH.exe

"K480101741BH.exe" e -psetup wid.rar

C:\Windows\SysWOW64\timeout.exe

timeout 6

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\booking\data\fbk.vbs"

C:\Windows\SysWOW64\timeout.exe

timeout 8

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\booking\data\445.bat" "

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\booking"

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\booking\data\modylsid.exe

modylsid.exe /start

C:\booking\data\modylsid.exe

modylsid.exe /start

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im K480101741BH.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im K480101741BH.exe

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\booking\data"

C:\Windows\SysWOW64\timeout.exe

timeout 4

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\1s75i91qs3_1.exe

/suac

C:\Users\Admin\AppData\Local\Temp\959m3m1kk7o7aq1.exe

"C:\Users\Admin\AppData\Local\Temp\959m3m1kk7o7aq1.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData\Google Updater 2.09\'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 microsoft.com udp
N/A 104.215.148.63:80 microsoft.com tcp
N/A 8.8.8.8:53 russk17.icu udp
N/A 8.8.8.8:53 russk17.icu udp
N/A 172.241.27.185:80 russk17.icu tcp
N/A 8.8.8.8:53 amityestatelagos.com udp
N/A 198.54.126.145:80 amityestatelagos.com tcp
N/A 198.54.126.145:443 amityestatelagos.com tcp
N/A 172.241.27.185:80 russk17.icu tcp

Files

memory/200-114-0x0000000000000000-mapping.dmp

C:\booking\data\startbook.vbs

MD5 594e0cb7f4486880945b986f1adf9f49
SHA1 8155f7be615cd60017a1af07aac17801de2a64ba
SHA256 265d486a8fac96e0c3ce1309c50bcb88b0a37f739e533ed92483fe66b946c220
SHA512 3093b6e45fc17654e2419b08d6519dd891afd1672bcf6e61c77dca19258ae8bf7d46db98facb38e0a27527cae865a8d1445d8546be78af6cbc465e5fd56d87c4

C:\booking\data\start1.bat

MD5 0ccf45b2c7aad8f25d8a8f3a6ff7b620
SHA1 7785a6d2b22a8b64dd549bc0a8a08a85b6404525
SHA256 8df03bfad7860d4f609e48de215c6f40fbb0de78bdaeb08fdf3409e722585efb
SHA512 3fb8dd5fa9cdbb59d5d195e66f6108954c4a89b358a2f75bbb6e03739a67965ead3d91a24a648a4204fc32c6d753815e4cf98e17a2fdc5913704c28fdb159f6c

memory/4092-117-0x0000000000000000-mapping.dmp

memory/3708-118-0x0000000000000000-mapping.dmp

C:\booking\data\lip

MD5 f75ae8515bc7bc47354f22b6b4f20046
SHA1 03b1dc027bac21b149337e07d2d1f4af363cb6f4
SHA256 2e5c9d234c85488239cc3c55ed2053ae166222bdb668defe9c3bd0d93ece632a
SHA512 cdd90aaed29aac6e91fcb964480379e0e114b363c5e286d51e22ea1e617364319989143b205298dd15e875d8f349f2bec54001480e31d01acbb95e4eeaaad255

memory/3856-120-0x0000000000000000-mapping.dmp

C:\booking\data\K480101741BH.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

memory/2528-122-0x0000000000000000-mapping.dmp

C:\booking\data\fbk.vbs

MD5 12c302b2a7afa9d52bbc04875144319f
SHA1 5c5b5a2024a0f2838a0d94268282ad95ba388b25
SHA256 3e8e92c822501efaae4e4ae0c4e63d6822bc5aa5e2178ab5f5cf6bb74c77e283
SHA512 18b197db47f2bb2853de592a672a321f4188722eb48fd6165f9bc6d9f3dfe69dff2c0fdc49f9e5cfe939722c9ce47dd5dc31424619660c6e745122f5590a022f

memory/2844-124-0x0000000000000000-mapping.dmp

memory/2848-125-0x0000000000000000-mapping.dmp

C:\booking\data\445.bat

MD5 3c4875cff185c701a9f28f58ead13d33
SHA1 7585bca806fdeb727177c3fba6c371aa8d9c2951
SHA256 ad8c7a4cc068b36c5227b9076fe60e0529f080a6a849f8764750e2c173a0bf96
SHA512 ad9404fad164a57eb9577ff2569f5e237901d2a03059267d032d5b853dd2d8f5bf50375c981baf2064ee3b0b9cb8929eccc32c920843bba43fb4f7cdde7cd972

memory/1456-127-0x0000000000000000-mapping.dmp

memory/3712-128-0x0000000000000000-mapping.dmp

memory/3532-129-0x0000000000000000-mapping.dmp

memory/932-130-0x0000000000000000-mapping.dmp

C:\booking\data\modylsid.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

C:\booking\data\modylsid.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

memory/2660-133-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2660-134-0x00000000004015C6-mapping.dmp

C:\booking\data\modylsid.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

memory/3736-136-0x0000000000000000-mapping.dmp

memory/2792-137-0x0000000000000000-mapping.dmp

memory/2660-138-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2660-140-0x0000000000440000-0x00000000004EE000-memory.dmp

memory/2660-141-0x0000000002630000-0x0000000002631000-memory.dmp

memory/2660-139-0x0000000002180000-0x00000000021E6000-memory.dmp

memory/2660-142-0x0000000002660000-0x000000000266C000-memory.dmp

memory/2384-143-0x0000000000000000-mapping.dmp

memory/2324-144-0x0000000000000000-mapping.dmp

memory/2464-145-0x0000000000000000-mapping.dmp

memory/2464-146-0x0000000000E80000-0x00000000012BF000-memory.dmp

memory/2464-147-0x0000000000460000-0x0000000000586000-memory.dmp

memory/2464-148-0x0000000000CF0000-0x0000000000CFD000-memory.dmp

memory/2660-151-0x0000000002650000-0x0000000002651000-memory.dmp

C:\booking\data\K480101741BH.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

memory/1456-154-0x0000000003B20000-0x0000000003C46000-memory.dmp

memory/4092-155-0x00000000050E0000-0x0000000005206000-memory.dmp

memory/2464-156-0x0000000006040000-0x0000000006042000-memory.dmp

memory/1352-157-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\1s75i91qs3_1.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

C:\Users\Admin\AppData\Local\Temp\1s75i91qs3_1.exe

MD5 3b65b072503385254773acf8b3192a7e
SHA1 50b06faf9b45ca1fbb3d30d8c0974a153d17855b
SHA256 e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70
SHA512 8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

C:\Users\Admin\AppData\Local\Temp\959m3m1kk7o7aq1.exe

MD5 85f0fb9dafac47fb151d2a33f6556112
SHA1 0e021df3e0a91983c34bc9620bbcd6c9aa74edd7
SHA256 fea0fdad9f440f68feb5c3b6f4952a952375397a6220c253fe7d3eeb15523397
SHA512 1a11801302042dde8706cb0a0f6ad27650d74396bf270bc0a0cc3969370d2324de20f46c4a619b6f275586e87fe489b80dfe69c70712c175c881740a14bfa9b1

C:\Users\Admin\AppData\Local\Temp\959m3m1kk7o7aq1.exe

MD5 85f0fb9dafac47fb151d2a33f6556112
SHA1 0e021df3e0a91983c34bc9620bbcd6c9aa74edd7
SHA256 fea0fdad9f440f68feb5c3b6f4952a952375397a6220c253fe7d3eeb15523397
SHA512 1a11801302042dde8706cb0a0f6ad27650d74396bf270bc0a0cc3969370d2324de20f46c4a619b6f275586e87fe489b80dfe69c70712c175c881740a14bfa9b1

memory/2924-161-0x0000000000000000-mapping.dmp

memory/3044-167-0x0000000000000000-mapping.dmp

memory/3164-166-0x0000000000000000-mapping.dmp

memory/2128-165-0x0000000000000000-mapping.dmp

memory/3856-168-0x0000000000000000-mapping.dmp

memory/3164-178-0x000002216FED0000-0x000002216FED2000-memory.dmp

memory/3164-180-0x000002216FED3000-0x000002216FED5000-memory.dmp

memory/2128-183-0x00000213FC710000-0x00000213FC712000-memory.dmp

memory/2128-185-0x00000213FC713000-0x00000213FC715000-memory.dmp

memory/3044-188-0x0000018538DF0000-0x0000018538DF2000-memory.dmp

memory/3044-189-0x0000018538DF3000-0x0000018538DF5000-memory.dmp

memory/2128-193-0x00000213FD200000-0x00000213FD201000-memory.dmp

memory/3044-203-0x0000018551E00000-0x0000018551E01000-memory.dmp

memory/3856-217-0x000001FF68DD0000-0x000001FF68DD2000-memory.dmp

memory/3856-218-0x000001FF68DD3000-0x000001FF68DD5000-memory.dmp

memory/3164-238-0x000002216FED6000-0x000002216FED8000-memory.dmp

memory/3856-239-0x000001FF68DD6000-0x000001FF68DD8000-memory.dmp

memory/3044-240-0x0000018538DF6000-0x0000018538DF8000-memory.dmp

memory/2128-241-0x00000213FC716000-0x00000213FC718000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 31f894d386c4374ba64eacfd1ab2b47f
SHA1 72181aca9d0cdc4232cf75f5275afc136b1e1aa4
SHA256 8e66dd7b34130dba19567a5cf542c750400c582325e97e26e74e02e6be13baf2
SHA512 c669fcc5fdc4ecc08cdebd0188aa81df9cc202be5f7174a56288cf7771a8fbbb3be3e07145d8c329f60a6ee354506fc81893c5130a8fb34785069597c789256c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 31f894d386c4374ba64eacfd1ab2b47f
SHA1 72181aca9d0cdc4232cf75f5275afc136b1e1aa4
SHA256 8e66dd7b34130dba19567a5cf542c750400c582325e97e26e74e02e6be13baf2
SHA512 c669fcc5fdc4ecc08cdebd0188aa81df9cc202be5f7174a56288cf7771a8fbbb3be3e07145d8c329f60a6ee354506fc81893c5130a8fb34785069597c789256c

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 759ef4704efebb1d21ecebc379a0b999
SHA1 271572feece625083caf1d1418ee90e55aaf2b3b
SHA256 faafdb35e42dad41e7a052804d093529d094a2cd0b94b85ec45099605790a666
SHA512 6081a208946d31ebc7d0ae9f58944584bd43f44712b8daf82209c75dbf7b4713a8eb048ef27af6eec57ed5754b8ffae214784f09be6e24ea2890936064db9a40

memory/3044-246-0x0000018538DF8000-0x0000018538DF9000-memory.dmp

memory/2128-247-0x00000213FC718000-0x00000213FC719000-memory.dmp

memory/3856-248-0x000001FF68DD8000-0x000001FF68DD9000-memory.dmp

memory/3164-249-0x000002216FED8000-0x000002216FED9000-memory.dmp