Malware Analysis Report

2024-11-30 20:00

Sample ID 210519-axwh5c6kea
Target f7e4a28f_by_Libranalysis
SHA256 3a2c441a96936c089c1444f4cd50436593fcd43a18c80a1699fc6b2d62dd6907
Tags
betabot backdoor botnet evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3a2c441a96936c089c1444f4cd50436593fcd43a18c80a1699fc6b2d62dd6907

Threat Level: Known bad

The file f7e4a28f_by_Libranalysis was found to be: Known bad.

Malicious Activity Summary

betabot backdoor botnet evasion persistence trojan

Modifies firewall policy service

BetaBot

Executes dropped EXE

Sets file to hidden

Sets file execution options in registry

Checks BIOS information in registry

Loads dropped DLL

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Modifies Internet Explorer Protected Mode

Views/modifies file attributes

Delays execution with timeout.exe

Suspicious behavior: MapViewOfSection

Modifies Internet Explorer Protected Mode Banner

Checks processor information in registry

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

Modifies registry class

Kills process with taskkill

Enumerates system info in registry

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2021-05-19 09:02

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2021-05-19 09:02

Reported

2021-05-19 09:04

Platform

win7v20210410

Max time kernel

151s

Max time network

100s

Command Line

C:\Windows\Explorer.EXE

Signatures

BetaBot

trojan backdoor botnet betabot

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\site1\conf\csvr.exe N/A
N/A N/A C:\site1\conf\psi.exe N/A
N/A N/A C:\site1\conf\psi.exe N/A

Sets file execution options in registry

persistence

Sets file to hidden

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\explorer.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\w1799g591.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\w1799g591.exe\"" C:\Windows\SysWOW64\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\site1\conf\psi.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 788 set thread context of 1620 N/A C:\site1\conf\psi.exe C:\site1\conf\psi.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\site1\conf\psi.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\site1\conf\psi.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\explorer.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\explorer.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeRestorePrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeBackupPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeLoadDriverPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeShutdownPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeCreateTokenPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeMachineAccountPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeSecurityPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\site1\conf\psi.exe N/A
Token: 33 N/A C:\site1\conf\psi.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1084 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe C:\Windows\SysWOW64\WScript.exe
PID 1084 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe C:\Windows\SysWOW64\WScript.exe
PID 1084 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe C:\Windows\SysWOW64\WScript.exe
PID 1084 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe C:\Windows\SysWOW64\WScript.exe
PID 1668 wrote to memory of 600 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1668 wrote to memory of 600 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1668 wrote to memory of 600 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1668 wrote to memory of 600 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 600 wrote to memory of 320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 600 wrote to memory of 320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 600 wrote to memory of 320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 600 wrote to memory of 320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 600 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 600 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 600 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 600 wrote to memory of 1472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 600 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\csvr.exe
PID 600 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\csvr.exe
PID 600 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\csvr.exe
PID 600 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\csvr.exe
PID 600 wrote to memory of 620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 600 wrote to memory of 620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 600 wrote to memory of 620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 600 wrote to memory of 620 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 600 wrote to memory of 956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 600 wrote to memory of 956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 600 wrote to memory of 956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 600 wrote to memory of 956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 600 wrote to memory of 932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 600 wrote to memory of 932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 600 wrote to memory of 932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 600 wrote to memory of 932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 956 wrote to memory of 1248 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 956 wrote to memory of 1248 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 956 wrote to memory of 1248 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 956 wrote to memory of 1248 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1248 wrote to memory of 652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1248 wrote to memory of 652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1248 wrote to memory of 652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1248 wrote to memory of 652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1248 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1248 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1248 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1248 wrote to memory of 1664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1248 wrote to memory of 788 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\psi.exe
PID 1248 wrote to memory of 788 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\psi.exe
PID 1248 wrote to memory of 788 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\psi.exe
PID 1248 wrote to memory of 788 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\psi.exe
PID 788 wrote to memory of 1620 N/A C:\site1\conf\psi.exe C:\site1\conf\psi.exe
PID 788 wrote to memory of 1620 N/A C:\site1\conf\psi.exe C:\site1\conf\psi.exe
PID 788 wrote to memory of 1620 N/A C:\site1\conf\psi.exe C:\site1\conf\psi.exe
PID 788 wrote to memory of 1620 N/A C:\site1\conf\psi.exe C:\site1\conf\psi.exe
PID 788 wrote to memory of 1620 N/A C:\site1\conf\psi.exe C:\site1\conf\psi.exe
PID 788 wrote to memory of 1620 N/A C:\site1\conf\psi.exe C:\site1\conf\psi.exe
PID 1248 wrote to memory of 1816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1248 wrote to memory of 1816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1248 wrote to memory of 1816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1248 wrote to memory of 1816 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1248 wrote to memory of 300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1248 wrote to memory of 300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1248 wrote to memory of 300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1248 wrote to memory of 300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 1248 wrote to memory of 1096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1248 wrote to memory of 1096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe

"C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\site1\conf\pe.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\site1\conf\uiy.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "547576083-18759072821432890865-4388350321311224841-69428211218999539241440614081"

C:\Windows\SysWOW64\timeout.exe

timeout 0

C:\Windows\SysWOW64\PING.EXE

ping dhgfg sgudy

C:\site1\conf\csvr.exe

"csvr.exe" e -p1vartanderkoolermaster lol.rar

C:\Windows\SysWOW64\timeout.exe

timeout 6

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\site1\conf\biling.vbs"

C:\Windows\SysWOW64\timeout.exe

timeout 7

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\site1\conf\site.bat" "

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "-7186537421808627365269649056-1381997941791124636-183576623010413814991902985042"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\site1\conf"

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\site1\conf\psi.exe

psi.exe /start

C:\site1\conf\psi.exe

psi.exe /start

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im csvr.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im csvr.exe

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\site1\conf\psi.exe"

C:\Windows\SysWOW64\timeout.exe

timeout 4

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 update.microsoft.com udp
N/A 52.185.71.28:80 update.microsoft.com tcp
N/A 8.8.8.8:53 russk17.icu udp
N/A 8.8.8.8:53 russk17.icu udp
N/A 198.12.112.202:80 russk17.icu tcp
N/A 8.8.8.8:53 russk17.icu udp
N/A 198.12.112.202:80 russk17.icu tcp

Files

memory/1084-59-0x00000000752F1000-0x00000000752F3000-memory.dmp

memory/1084-60-0x0000000000250000-0x0000000000251000-memory.dmp

memory/1668-61-0x0000000000000000-mapping.dmp

C:\site1\conf\pe.vbs

MD5 b022334d0c60338f90e47e2478873d7a
SHA1 19c094781ad40ef0efa617cb1fb92d127bdecb7b
SHA256 c95053b468dd6b1623432f7676b81bbb43480959537da737fe270f4a8d195ca3
SHA512 34e9bc989e52a53e96a6d0e9c11b5d3c8367f3c16ef73101d63dfc3a9464d559430717df109d32dd1dfcdc67763e8824699701785787cbf0a6a38fdf20a7b16c

C:\site1\conf\uiy.bat

MD5 f6eb567c6e72344762fe0f1e4223990b
SHA1 9a200a0c123c22cbca10e6d16f97eeb63835ab2d
SHA256 2ab47d3082c64105d769c62bf96a8c5d05cd19dba6d7728da291041dbeea4a65
SHA512 0f49fef4d52d192ece9d228df8fd3acdf9c801c9f6039c0aa6c717d8710a87c41593fbfe1aa2ce45806f5dcd4e8c12562e2a2a20734a16fab88dc661dacd4805

memory/600-65-0x0000000000000000-mapping.dmp

C:\site1\conf\8rt.jog

MD5 e349fbe030e2524e041f3f60d110b7c7
SHA1 763bfa5803bda9d740ff2e31c350e745397308f9
SHA256 47a1389daec3f031b2232e7e0dcec00b84f0e4e83bff64ccdcd6b9dbd41e64d8
SHA512 ed583faa84bae3f70b0acf89f7b6da08b34633a0bcb766480375ce18c5a26bb15891406f3657eacbb6367d14c97a79bbbdddc39fcb6410eeec33735b34b10129

memory/320-67-0x0000000000000000-mapping.dmp

memory/1472-68-0x0000000000000000-mapping.dmp

\site1\conf\csvr.exe

MD5 397a93800d56a2308bffc872d4a08032
SHA1 6f5334d51195a521e8a03f0e05ac777b96c77bc4
SHA256 efe3abcfde6e9846a99049a68e6a38d0bc42baa3ac1cf6f236c894abef0a7720
SHA512 7fc7b6c8ffe640295085cab4e56ba4c3eea9738a2c9fa27d1032fd60bb3a638e93cd2522058b6212dd7237366510a83c7d1d9b3cbd5f9712852c72959ace53eb

C:\site1\conf\csvr.exe

MD5 397a93800d56a2308bffc872d4a08032
SHA1 6f5334d51195a521e8a03f0e05ac777b96c77bc4
SHA256 efe3abcfde6e9846a99049a68e6a38d0bc42baa3ac1cf6f236c894abef0a7720
SHA512 7fc7b6c8ffe640295085cab4e56ba4c3eea9738a2c9fa27d1032fd60bb3a638e93cd2522058b6212dd7237366510a83c7d1d9b3cbd5f9712852c72959ace53eb

memory/436-71-0x0000000000000000-mapping.dmp

C:\site1\conf\csvr.exe

MD5 397a93800d56a2308bffc872d4a08032
SHA1 6f5334d51195a521e8a03f0e05ac777b96c77bc4
SHA256 efe3abcfde6e9846a99049a68e6a38d0bc42baa3ac1cf6f236c894abef0a7720
SHA512 7fc7b6c8ffe640295085cab4e56ba4c3eea9738a2c9fa27d1032fd60bb3a638e93cd2522058b6212dd7237366510a83c7d1d9b3cbd5f9712852c72959ace53eb

memory/620-74-0x0000000000000000-mapping.dmp

C:\site1\conf\biling.vbs

MD5 70f8a68b9e1e00708c64e1d1fec715f4
SHA1 63247e2afb4b30892d1d23a903393043abc5a214
SHA256 04cff1c0dbbc09f19df77f4b1d2481440c7f408260e95e661ec33ee542bf3cd7
SHA512 dd49ac3beefd21484a6e90d8a9d250e63cd2e78bd7fe3916a668316d6b84ec47bb3e6ba680e5a13200e68648d508da0fa5ee4294c425d3f041cee60e86ef4501

memory/956-77-0x0000000000000000-mapping.dmp

memory/932-78-0x0000000000000000-mapping.dmp

C:\site1\conf\site.bat

MD5 8b653c0a3c307777b9cdc2ec28aac98b
SHA1 936f2c75461b8a98b55e4d88ccc3e41088e2d584
SHA256 f37a565dfd33a94efbb04d04bd8dd1f60b1d42bc9427d3fff4060b51fd318e2f
SHA512 16ca9304fea272ec3b3539024df6496119d26774812f9b0119acef33b2837fa60a91ef0389c84718c51a3483339be671dc548904b39bc35057d868c7e0452cdf

memory/1248-81-0x0000000000000000-mapping.dmp

memory/652-82-0x0000000000000000-mapping.dmp

memory/1664-83-0x0000000000000000-mapping.dmp

\site1\conf\psi.exe

MD5 7c1588678299109e5bdf37f40102ef99
SHA1 f1e513bef9fc691d5f2eba139c6805e32f5268ee
SHA256 a760c1fe14b0202ba3ec08ea035a003600930a61672a1741210580807c7f2d78
SHA512 6ba93ae483503abce54c013a31624d5b96b7bbf5726cdcb9a7665736732f8f68a498e336767609025595c685b793849571030f90e5690534c7d630c7c89931c7

C:\site1\conf\psi.exe

MD5 7c1588678299109e5bdf37f40102ef99
SHA1 f1e513bef9fc691d5f2eba139c6805e32f5268ee
SHA256 a760c1fe14b0202ba3ec08ea035a003600930a61672a1741210580807c7f2d78
SHA512 6ba93ae483503abce54c013a31624d5b96b7bbf5726cdcb9a7665736732f8f68a498e336767609025595c685b793849571030f90e5690534c7d630c7c89931c7

memory/788-87-0x0000000000000000-mapping.dmp

\site1\conf\psi.exe

MD5 7c1588678299109e5bdf37f40102ef99
SHA1 f1e513bef9fc691d5f2eba139c6805e32f5268ee
SHA256 a760c1fe14b0202ba3ec08ea035a003600930a61672a1741210580807c7f2d78
SHA512 6ba93ae483503abce54c013a31624d5b96b7bbf5726cdcb9a7665736732f8f68a498e336767609025595c685b793849571030f90e5690534c7d630c7c89931c7

C:\site1\conf\psi.exe

MD5 7c1588678299109e5bdf37f40102ef99
SHA1 f1e513bef9fc691d5f2eba139c6805e32f5268ee
SHA256 a760c1fe14b0202ba3ec08ea035a003600930a61672a1741210580807c7f2d78
SHA512 6ba93ae483503abce54c013a31624d5b96b7bbf5726cdcb9a7665736732f8f68a498e336767609025595c685b793849571030f90e5690534c7d630c7c89931c7

memory/1620-89-0x0000000000400000-0x0000000000435000-memory.dmp

C:\site1\conf\psi.exe

MD5 7c1588678299109e5bdf37f40102ef99
SHA1 f1e513bef9fc691d5f2eba139c6805e32f5268ee
SHA256 a760c1fe14b0202ba3ec08ea035a003600930a61672a1741210580807c7f2d78
SHA512 6ba93ae483503abce54c013a31624d5b96b7bbf5726cdcb9a7665736732f8f68a498e336767609025595c685b793849571030f90e5690534c7d630c7c89931c7

memory/1620-90-0x00000000004015C6-mapping.dmp

memory/1816-93-0x0000000000000000-mapping.dmp

memory/300-94-0x0000000000000000-mapping.dmp

memory/1096-95-0x0000000000000000-mapping.dmp

memory/1472-96-0x0000000000000000-mapping.dmp

memory/1620-98-0x0000000001CB0000-0x0000000001D16000-memory.dmp

memory/1620-101-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

memory/1620-100-0x00000000001D0000-0x00000000001DD000-memory.dmp

memory/1620-99-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/1620-97-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1620-102-0x0000000001DD0000-0x0000000001DDC000-memory.dmp

memory/436-103-0x0000000000000000-mapping.dmp

memory/436-105-0x00000000746C1000-0x00000000746C3000-memory.dmp

memory/436-107-0x00000000000D0000-0x00000000001F6000-memory.dmp

memory/436-106-0x00000000776F0000-0x0000000077870000-memory.dmp

memory/436-110-0x0000000000530000-0x0000000000531000-memory.dmp

memory/436-112-0x0000000000540000-0x000000000054C000-memory.dmp

memory/1248-114-0x0000000002080000-0x00000000021A6000-memory.dmp

memory/436-115-0x00000000009E0000-0x0000000000A60000-memory.dmp

memory/1288-116-0x0000000002CA0000-0x0000000002CA6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2021-05-19 09:02

Reported

2021-05-19 09:05

Platform

win10v20210408

Max time kernel

147s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe"

Signatures

BetaBot

trojan backdoor botnet betabot

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\site1\conf\csvr.exe N/A
N/A N/A C:\site1\conf\psi.exe N/A
N/A N/A C:\site1\conf\psi.exe N/A

Sets file execution options in registry

persistence

Sets file to hidden

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\51y31y5315yq.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\51y31y5315yq.exe\"" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\site1\conf\psi.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3992 set thread context of 2056 N/A C:\site1\conf\psi.exe C:\site1\conf\psi.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\site1\conf\psi.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\site1\conf\psi.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\explorer.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\explorer.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\site1\conf\psi.exe N/A
N/A N/A C:\site1\conf\psi.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeRestorePrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeBackupPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeLoadDriverPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeShutdownPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeCreateTokenPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeMachineAccountPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeSecurityPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\site1\conf\psi.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\site1\conf\psi.exe N/A
Token: 33 N/A C:\site1\conf\psi.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 488 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe C:\Windows\SysWOW64\WScript.exe
PID 488 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe C:\Windows\SysWOW64\WScript.exe
PID 488 wrote to memory of 3172 N/A C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe C:\Windows\SysWOW64\WScript.exe
PID 3172 wrote to memory of 800 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 800 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3172 wrote to memory of 800 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 800 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 800 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 800 wrote to memory of 1236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 800 wrote to memory of 192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 800 wrote to memory of 192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 800 wrote to memory of 192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 800 wrote to memory of 1280 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\csvr.exe
PID 800 wrote to memory of 1280 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\csvr.exe
PID 800 wrote to memory of 1280 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\csvr.exe
PID 800 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 800 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 800 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 800 wrote to memory of 2208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 800 wrote to memory of 2208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 800 wrote to memory of 2208 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 800 wrote to memory of 1160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 800 wrote to memory of 1160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 800 wrote to memory of 1160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2208 wrote to memory of 2040 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 2040 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2208 wrote to memory of 2040 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2040 wrote to memory of 3852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2040 wrote to memory of 3852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2040 wrote to memory of 3852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2040 wrote to memory of 3808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2040 wrote to memory of 3808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2040 wrote to memory of 3808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2040 wrote to memory of 3992 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\psi.exe
PID 2040 wrote to memory of 3992 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\psi.exe
PID 2040 wrote to memory of 3992 N/A C:\Windows\SysWOW64\cmd.exe C:\site1\conf\psi.exe
PID 3992 wrote to memory of 2056 N/A C:\site1\conf\psi.exe C:\site1\conf\psi.exe
PID 3992 wrote to memory of 2056 N/A C:\site1\conf\psi.exe C:\site1\conf\psi.exe
PID 3992 wrote to memory of 2056 N/A C:\site1\conf\psi.exe C:\site1\conf\psi.exe
PID 3992 wrote to memory of 2056 N/A C:\site1\conf\psi.exe C:\site1\conf\psi.exe
PID 3992 wrote to memory of 2056 N/A C:\site1\conf\psi.exe C:\site1\conf\psi.exe
PID 2040 wrote to memory of 796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2040 wrote to memory of 796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2040 wrote to memory of 796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2040 wrote to memory of 3700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2040 wrote to memory of 3700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2040 wrote to memory of 3700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 2056 wrote to memory of 3924 N/A C:\site1\conf\psi.exe C:\Windows\SysWOW64\explorer.exe
PID 2056 wrote to memory of 3924 N/A C:\site1\conf\psi.exe C:\Windows\SysWOW64\explorer.exe
PID 2056 wrote to memory of 3924 N/A C:\site1\conf\psi.exe C:\Windows\SysWOW64\explorer.exe
PID 2040 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2040 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2040 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2040 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2040 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2040 wrote to memory of 3708 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3924 wrote to memory of 800 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 3924 wrote to memory of 800 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 3924 wrote to memory of 1160 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\timeout.exe
PID 3924 wrote to memory of 1160 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\timeout.exe
PID 3924 wrote to memory of 2040 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 3924 wrote to memory of 2040 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 3924 wrote to memory of 3708 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\timeout.exe
PID 3924 wrote to memory of 3708 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\timeout.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe

"C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\site1\conf\pe.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\site1\conf\uiy.bat" "

C:\Windows\SysWOW64\timeout.exe

timeout 0

C:\Windows\SysWOW64\PING.EXE

ping dhgfg sgudy

C:\site1\conf\csvr.exe

"csvr.exe" e -p1vartanderkoolermaster lol.rar

C:\Windows\SysWOW64\timeout.exe

timeout 6

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\site1\conf\biling.vbs"

C:\Windows\SysWOW64\timeout.exe

timeout 7

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\site1\conf\site.bat" "

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\site1\conf"

C:\Windows\SysWOW64\timeout.exe

timeout 2

C:\site1\conf\psi.exe

psi.exe /start

C:\site1\conf\psi.exe

psi.exe /start

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im csvr.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im csvr.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\site1\conf\psi.exe"

C:\Windows\SysWOW64\timeout.exe

timeout 4

Network

Country Destination Domain Proto
N/A 8.8.8.8:53 google.com udp
N/A 8.8.8.8:53 russk19.icu udp
N/A 8.8.8.8:53 russk20.icu udp
N/A 8.8.8.8:53 russk21.icu udp
N/A 8.8.8.8:53 moscow13.at udp

Files

memory/488-114-0x00000000008A0000-0x00000000008A1000-memory.dmp

memory/3172-115-0x0000000000000000-mapping.dmp

C:\site1\conf\pe.vbs

MD5 b022334d0c60338f90e47e2478873d7a
SHA1 19c094781ad40ef0efa617cb1fb92d127bdecb7b
SHA256 c95053b468dd6b1623432f7676b81bbb43480959537da737fe270f4a8d195ca3
SHA512 34e9bc989e52a53e96a6d0e9c11b5d3c8367f3c16ef73101d63dfc3a9464d559430717df109d32dd1dfcdc67763e8824699701785787cbf0a6a38fdf20a7b16c

C:\site1\conf\uiy.bat

MD5 f6eb567c6e72344762fe0f1e4223990b
SHA1 9a200a0c123c22cbca10e6d16f97eeb63835ab2d
SHA256 2ab47d3082c64105d769c62bf96a8c5d05cd19dba6d7728da291041dbeea4a65
SHA512 0f49fef4d52d192ece9d228df8fd3acdf9c801c9f6039c0aa6c717d8710a87c41593fbfe1aa2ce45806f5dcd4e8c12562e2a2a20734a16fab88dc661dacd4805

memory/800-118-0x0000000000000000-mapping.dmp

C:\site1\conf\8rt.jog

MD5 e349fbe030e2524e041f3f60d110b7c7
SHA1 763bfa5803bda9d740ff2e31c350e745397308f9
SHA256 47a1389daec3f031b2232e7e0dcec00b84f0e4e83bff64ccdcd6b9dbd41e64d8
SHA512 ed583faa84bae3f70b0acf89f7b6da08b34633a0bcb766480375ce18c5a26bb15891406f3657eacbb6367d14c97a79bbbdddc39fcb6410eeec33735b34b10129

memory/1236-120-0x0000000000000000-mapping.dmp

memory/192-121-0x0000000000000000-mapping.dmp

memory/1280-122-0x0000000000000000-mapping.dmp

C:\site1\conf\csvr.exe

MD5 397a93800d56a2308bffc872d4a08032
SHA1 6f5334d51195a521e8a03f0e05ac777b96c77bc4
SHA256 efe3abcfde6e9846a99049a68e6a38d0bc42baa3ac1cf6f236c894abef0a7720
SHA512 7fc7b6c8ffe640295085cab4e56ba4c3eea9738a2c9fa27d1032fd60bb3a638e93cd2522058b6212dd7237366510a83c7d1d9b3cbd5f9712852c72959ace53eb

memory/1540-124-0x0000000000000000-mapping.dmp

C:\site1\conf\biling.vbs

MD5 70f8a68b9e1e00708c64e1d1fec715f4
SHA1 63247e2afb4b30892d1d23a903393043abc5a214
SHA256 04cff1c0dbbc09f19df77f4b1d2481440c7f408260e95e661ec33ee542bf3cd7
SHA512 dd49ac3beefd21484a6e90d8a9d250e63cd2e78bd7fe3916a668316d6b84ec47bb3e6ba680e5a13200e68648d508da0fa5ee4294c425d3f041cee60e86ef4501

memory/2208-126-0x0000000000000000-mapping.dmp

memory/1160-127-0x0000000000000000-mapping.dmp

C:\site1\conf\site.bat

MD5 8b653c0a3c307777b9cdc2ec28aac98b
SHA1 936f2c75461b8a98b55e4d88ccc3e41088e2d584
SHA256 f37a565dfd33a94efbb04d04bd8dd1f60b1d42bc9427d3fff4060b51fd318e2f
SHA512 16ca9304fea272ec3b3539024df6496119d26774812f9b0119acef33b2837fa60a91ef0389c84718c51a3483339be671dc548904b39bc35057d868c7e0452cdf

memory/2040-129-0x0000000000000000-mapping.dmp

memory/3852-130-0x0000000000000000-mapping.dmp

memory/3808-131-0x0000000000000000-mapping.dmp

memory/3992-132-0x0000000000000000-mapping.dmp

C:\site1\conf\psi.exe

MD5 7c1588678299109e5bdf37f40102ef99
SHA1 f1e513bef9fc691d5f2eba139c6805e32f5268ee
SHA256 a760c1fe14b0202ba3ec08ea035a003600930a61672a1741210580807c7f2d78
SHA512 6ba93ae483503abce54c013a31624d5b96b7bbf5726cdcb9a7665736732f8f68a498e336767609025595c685b793849571030f90e5690534c7d630c7c89931c7

C:\site1\conf\psi.exe

MD5 7c1588678299109e5bdf37f40102ef99
SHA1 f1e513bef9fc691d5f2eba139c6805e32f5268ee
SHA256 a760c1fe14b0202ba3ec08ea035a003600930a61672a1741210580807c7f2d78
SHA512 6ba93ae483503abce54c013a31624d5b96b7bbf5726cdcb9a7665736732f8f68a498e336767609025595c685b793849571030f90e5690534c7d630c7c89931c7

memory/2056-135-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2056-136-0x00000000004015C6-mapping.dmp

C:\site1\conf\psi.exe

MD5 7c1588678299109e5bdf37f40102ef99
SHA1 f1e513bef9fc691d5f2eba139c6805e32f5268ee
SHA256 a760c1fe14b0202ba3ec08ea035a003600930a61672a1741210580807c7f2d78
SHA512 6ba93ae483503abce54c013a31624d5b96b7bbf5726cdcb9a7665736732f8f68a498e336767609025595c685b793849571030f90e5690534c7d630c7c89931c7

memory/796-138-0x0000000000000000-mapping.dmp

memory/2056-139-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2056-140-0x0000000002160000-0x00000000021C6000-memory.dmp

memory/2056-141-0x00000000004B0000-0x00000000004BD000-memory.dmp

memory/2056-142-0x0000000002630000-0x0000000002631000-memory.dmp

memory/2056-143-0x0000000002660000-0x000000000266C000-memory.dmp

memory/3700-144-0x0000000000000000-mapping.dmp

memory/764-145-0x0000000000000000-mapping.dmp

memory/3708-146-0x0000000000000000-mapping.dmp

memory/3924-147-0x0000000000000000-mapping.dmp

memory/3924-148-0x00000000008A0000-0x0000000000CDF000-memory.dmp

memory/3924-149-0x0000000003000000-0x0000000003126000-memory.dmp

memory/3924-150-0x0000000002D00000-0x0000000002D23000-memory.dmp

memory/3924-151-0x0000000002D00000-0x0000000002D23000-memory.dmp

memory/2056-153-0x0000000002650000-0x0000000002651000-memory.dmp

C:\site1\conf\csvr.exe

MD5 397a93800d56a2308bffc872d4a08032
SHA1 6f5334d51195a521e8a03f0e05ac777b96c77bc4
SHA256 efe3abcfde6e9846a99049a68e6a38d0bc42baa3ac1cf6f236c894abef0a7720
SHA512 7fc7b6c8ffe640295085cab4e56ba4c3eea9738a2c9fa27d1032fd60bb3a638e93cd2522058b6212dd7237366510a83c7d1d9b3cbd5f9712852c72959ace53eb

memory/800-156-0x00000000058D0000-0x00000000059F6000-memory.dmp

memory/2040-157-0x00000000034C0000-0x00000000035E6000-memory.dmp

memory/3924-159-0x0000000006170000-0x0000000006172000-memory.dmp