Malware Analysis Report

2024-11-15 08:40

Sample ID 220713-g9glzaaheq
Target CFDI_826271_26-01-2022.zip
SHA256 ef781682e4a93247b663991423cb28c6c0111c21f80bc5c2c94a6d239808e446
Tags
betabot backdoor botnet evasion persistence suricata trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ef781682e4a93247b663991423cb28c6c0111c21f80bc5c2c94a6d239808e446

Threat Level: Known bad

The file CFDI_826271_26-01-2022.zip was found to be: Known bad.

Malicious Activity Summary

betabot backdoor botnet evasion persistence suricata trojan

Modifies firewall policy service

suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4

BetaBot

Downloads MZ/PE file

Executes dropped EXE

Sets file to hidden

Sets file execution options in registry

Checks BIOS information in registry

Checks computer location settings

Loads dropped DLL

Drops desktop.ini file(s)

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Program crash

Runs net.exe

Kills process with taskkill

Discovers systems in the same network

Modifies Internet Explorer settings

Modifies registry class

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Modifies Internet Explorer Protected Mode

Views/modifies file attributes

Suspicious behavior: MapViewOfSection

Modifies Internet Explorer Protected Mode Banner

NTFS ADS

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-13 06:30

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-13 06:30

Reported

2022-07-13 06:32

Platform

win7-20220414-en

Max time kernel

147s

Max time network

152s

Command Line

C:\Windows\Explorer.EXE

Signatures

BetaBot

trojan backdoor botnet betabot

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A

suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4

suricata

Downloads MZ/PE file

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "giuabupt.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\y579yu5yc.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\y579yu5yc.exe\DisableExceptionChainValidation C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\y579yu5yc.exe\"" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\y579yu5yc.exe\"" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\y579yu5yc.exe" C:\Windows\SysWOW64\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\ProgramData\Google Updater 2.09\desktop.ini C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 268 set thread context of 572 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 960 set thread context of 0 N/A C:\Users\Admin\AppData\Local\Temp\y579yu5yc_1.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Discovers systems in the same network

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\net.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\explorer.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\VersionManager\DownloadVersionList = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\VersionManager C:\Windows\SysWOW64\explorer.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\y579yu5yc_1.exe:14EDFC78 C:\Windows\SysWOW64\explorer.exe N/A
File created C:\Users\Admin\AppData\Local\Temp\y579yu5yc_1.exe:14EDFC78 C:\Windows\SysWOW64\explorer.exe N/A

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\net.exe N/A
N/A N/A C:\Windows\system32\net.exe N/A
N/A N/A C:\Windows\system32\nltest.exe N/A
N/A N/A C:\Windows\system32\nltest.exe N/A
N/A N/A C:\Windows\system32\net.exe N/A
N/A N/A C:\Windows\system32\choice.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\s191iag1y.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1280 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 1280 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 1280 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 1280 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 1280 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 1280 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 1280 wrote to memory of 992 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 992 wrote to memory of 1416 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 1416 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 1416 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 1416 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 1416 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 1416 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 992 wrote to memory of 1416 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1416 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1684 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 1416 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 1416 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 1416 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 1416 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 1416 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 1416 wrote to memory of 608 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 1416 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1660 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1416 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1416 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1416 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1416 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1416 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1416 wrote to memory of 1688 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1416 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1416 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1688 wrote to memory of 1720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1688 wrote to memory of 1720 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1720 wrote to memory of 652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1720 wrote to memory of 652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1720 wrote to memory of 652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1720 wrote to memory of 652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1720 wrote to memory of 652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1720 wrote to memory of 652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1720 wrote to memory of 652 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1720 wrote to memory of 1524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe

"C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\terminalweu.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\fit3274.bat" "

C:\Windows\SysWOW64\timeout.exe

timeout 7

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

"Gozip.exe" e -p398FsVBddjkd8cwr nmh3745.rar

C:\Windows\SysWOW64\timeout.exe

timeout 6

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\7els.vbs"

C:\Windows\SysWOW64\timeout.exe

timeout 8

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\def.bat" "

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\controllevel"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

miktotik.exe /start

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

miktotik.exe /start

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Gozip.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Gozip.exe

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef"

C:\Windows\SysWOW64\timeout.exe

timeout 4

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\Temp\y579yu5yc_1.exe

/suac

C:\Users\Admin\AppData\Local\Temp\s191iag1y.exe

"C:\Users\Admin\AppData\Local\Temp\s191iag1y.exe"

C:\Windows\system32\cmd.exe

"cmd.exe" /c net group "Domain Admins" /domain

C:\Windows\system32\net.exe

net group "Domain Admins" /domain

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 group "Domain Admins" /domain

C:\Windows\system32\cmd.exe

"cmd.exe" /c net group "domain computers" /domain

C:\Windows\system32\net.exe

net group "domain computers" /domain

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 group "domain computers" /domain

C:\Windows\system32\cmd.exe

"cmd.exe" /c nltest /domain_trusts /all_trusts

C:\Windows\system32\nltest.exe

nltest /domain_trusts /all_trusts

C:\Windows\system32\cmd.exe

"cmd.exe" /c nltest /domain_trusts

C:\Windows\system32\nltest.exe

nltest /domain_trusts

C:\Windows\system32\cmd.exe

"cmd.exe" /c net view /all

C:\Windows\system32\net.exe

net view /all

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\s191iag1y.exe" && /C choice /C Y /N /D Y /T 3 & Del "shfolder.dll" && Del LAG1 && Del LAG2

C:\Windows\system32\choice.exe

choice /C Y /N /D Y /T 3

Network

Country Destination Domain Proto
US 8.8.8.8:53 microsoft.com udp
US 20.112.52.29:80 microsoft.com tcp
US 8.8.8.8:53 russk19.icu udp
US 8.8.8.8:53 russk20.icu udp
US 8.8.8.8:53 russk21.icu udp
US 8.8.8.8:53 russk21.icu udp
RU 62.204.41.171:80 russk21.icu tcp
RU 62.204.41.171:80 russk21.icu tcp
US 8.8.8.8:53 russk21.icu udp

Files

memory/1280-54-0x0000000076181000-0x0000000076183000-memory.dmp

memory/992-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\terminalweu.vbs

MD5 bf045999e4ca77b57de18d5ff25e1272
SHA1 e8dab3a106e479a53c4ea61443c2ff7873d17c67
SHA256 89f2f0f40f06ed45b155adf713b127931ebb41c162e08e0cda75ecb9e10fdf17
SHA512 e191b410d97f021d3dd55ad3565559cf0f3dd6dcc7157f7d6ff60dd610128dfe875cc00f67106653df758e07b6d845fc4e7a7ee290f8d7d8a58d58a90a018f6a

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\fit3274.bat

MD5 814380ebb377d7ebca662c6ac563eec0
SHA1 3487cf2382cd0bc87a677e637de1ae40ccfbc13b
SHA256 b58d9796ee64ea6731a6e54fdeb997ebc4ac148e3982e9c48fdc1f79d1531136
SHA512 41737175039c4f62159be44fcd683aff05be9f7ea97b7061222d34528995768cf1656c617991a5d7a5595bd958687a5adbeb208fe961aa2afb4fd2bf2a8d7d66

memory/1416-59-0x0000000000000000-mapping.dmp

memory/1684-61-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Preferences.dat

MD5 b1aa11c4722efbcaaf5ebf5f17880d17
SHA1 b4b8578e13eb1a860524e827ac8bdd5d8ece604b
SHA256 2e7ba0fb3f5edd6091e13e0d3a127210813433e46cea81a61a211d6a95457e27
SHA512 a7668dfca645f63b571aff7ac11709b5578a4cd5947bf468fba11e4f5d455ef1b0917acc12c558e7b27d2eff1a8debb19b2c7783b7742c97c81b54fedcedd7b5

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

memory/608-66-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

memory/1660-69-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\7els.vbs

MD5 8f5293bc4ace65a9f51ba97bddcd7eee
SHA1 e11a5055530092c3a805d757110c4f8761976eef
SHA256 a48489f790e76faeaaed41f123031e708881226c224030213861cba419ca34f4
SHA512 c319cf12985d57b3d00737107a20e0c06a236d654064255dcc7023aa312871b52d399a9e9a55743fb3a446d2624a1049013f0ca8132ed6b6432658c396fa981d

memory/1688-72-0x0000000000000000-mapping.dmp

memory/1504-73-0x0000000000000000-mapping.dmp

memory/1720-77-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\def.bat

MD5 bf223a7df3a7feecfcb49a5d01d781d9
SHA1 d8b2b0f48887e63928576773efe1ab5776d7dfb0
SHA256 494cc4d4211c1ed3f88255a46d501040b885c9b5cca26dcae5e37185d883957e
SHA512 e15ca76450e99b21982efeeba4c148c9f28dddd85ae0fdb43e496813a4556b83022e2bb1d553de1c851065e09c7866bc6a9829da84dc0fcf3b269a03b0857fc2

memory/652-79-0x0000000000000000-mapping.dmp

memory/1524-81-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

memory/268-86-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

memory/572-90-0x0000000000400000-0x0000000000435000-memory.dmp

memory/572-92-0x0000000000400000-0x0000000000435000-memory.dmp

memory/572-93-0x00000000004015C6-mapping.dmp

memory/268-96-0x0000000000400000-0x000000000049B000-memory.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

memory/572-97-0x0000000000400000-0x0000000000435000-memory.dmp

memory/844-100-0x0000000000000000-mapping.dmp

memory/572-101-0x0000000000400000-0x0000000000435000-memory.dmp

memory/572-103-0x0000000001EF0000-0x0000000001F56000-memory.dmp

memory/1720-105-0x0000000000230000-0x00000000002CB000-memory.dmp

memory/1720-106-0x0000000000230000-0x00000000002CB000-memory.dmp

memory/572-107-0x0000000000400000-0x0000000000435000-memory.dmp

memory/572-109-0x0000000000260000-0x000000000026D000-memory.dmp

memory/572-108-0x0000000001EF0000-0x0000000001F56000-memory.dmp

memory/572-110-0x00000000003F0000-0x00000000003FC000-memory.dmp

memory/1284-111-0x0000000000000000-mapping.dmp

memory/1004-113-0x0000000000000000-mapping.dmp

memory/2008-115-0x0000000000000000-mapping.dmp

memory/1600-117-0x0000000000000000-mapping.dmp

memory/1600-119-0x0000000074A41000-0x0000000074A43000-memory.dmp

memory/1600-120-0x0000000077BE0000-0x0000000077D60000-memory.dmp

memory/1600-122-0x0000000000250000-0x000000000025C000-memory.dmp

memory/1600-121-0x00000000002A0000-0x00000000003F6000-memory.dmp

memory/572-123-0x0000000001EF0000-0x0000000001F56000-memory.dmp

memory/1600-124-0x0000000077BE0000-0x0000000077D60000-memory.dmp

memory/1600-125-0x00000000002A0000-0x00000000003F6000-memory.dmp

memory/1212-126-0x0000000002650000-0x0000000002656000-memory.dmp

\Users\Admin\AppData\Local\Temp\y579yu5yc_1.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

C:\Users\Admin\AppData\Local\Temp\y579yu5yc_1.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

memory/960-131-0x0000000000400000-0x000000000049B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\y579yu5yc_1.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

memory/960-128-0x0000000000000000-mapping.dmp

memory/1600-132-0x0000000003A50000-0x0000000003AEB000-memory.dmp

\Users\Admin\AppData\Local\Temp\s191iag1y.exe

MD5 60a1564d18f20769eb65478cc5bc56c0
SHA1 15ba12509eb288ed4e47162714f86777d8819976
SHA256 deccabcc57c6a41b9e2e1f3f97b9425831304f69387299adf1405350d2f5d110
SHA512 e1e2228963e1f0f0b80b9c5deb47da740b6fec376ebb7ae8e23ce31c2cadc02d63959f6bf3c66c949498f66a1eb44def5a8e467cf82d6ac3855bfc9241ebfc71

C:\Users\Admin\AppData\Local\Temp\s191iag1y.exe

MD5 60a1564d18f20769eb65478cc5bc56c0
SHA1 15ba12509eb288ed4e47162714f86777d8819976
SHA256 deccabcc57c6a41b9e2e1f3f97b9425831304f69387299adf1405350d2f5d110
SHA512 e1e2228963e1f0f0b80b9c5deb47da740b6fec376ebb7ae8e23ce31c2cadc02d63959f6bf3c66c949498f66a1eb44def5a8e467cf82d6ac3855bfc9241ebfc71

memory/1728-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\s191iag1y.exe

MD5 60a1564d18f20769eb65478cc5bc56c0
SHA1 15ba12509eb288ed4e47162714f86777d8819976
SHA256 deccabcc57c6a41b9e2e1f3f97b9425831304f69387299adf1405350d2f5d110
SHA512 e1e2228963e1f0f0b80b9c5deb47da740b6fec376ebb7ae8e23ce31c2cadc02d63959f6bf3c66c949498f66a1eb44def5a8e467cf82d6ac3855bfc9241ebfc71

memory/1728-137-0x0000000000130000-0x0000000000138000-memory.dmp

memory/1236-138-0x0000000000000000-mapping.dmp

memory/1936-139-0x0000000000000000-mapping.dmp

memory/832-140-0x0000000000000000-mapping.dmp

memory/1120-141-0x0000000000000000-mapping.dmp

memory/108-142-0x0000000000000000-mapping.dmp

memory/1764-143-0x0000000000000000-mapping.dmp

memory/1272-144-0x0000000000000000-mapping.dmp

memory/1968-145-0x0000000000000000-mapping.dmp

memory/952-146-0x0000000000000000-mapping.dmp

memory/1696-147-0x0000000000000000-mapping.dmp

memory/588-148-0x0000000000000000-mapping.dmp

memory/1464-149-0x0000000000000000-mapping.dmp

memory/1728-150-0x000007FEFC281000-0x000007FEFC283000-memory.dmp

memory/1740-151-0x0000000000000000-mapping.dmp

memory/1788-152-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-13 06:30

Reported

2022-07-13 06:32

Platform

win10v2004-20220414-en

Max time kernel

91s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe"

Signatures

BetaBot

trojan backdoor botnet betabot

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile C:\Windows\SysWOW64\explorer.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssym9yu7919c9.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ssym9yu7919c9.exe\DisableExceptionChainValidation C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "ncyrqdv.exe" C:\Windows\SysWOW64\explorer.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\explorer.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\ssym9yu7919c9.exe\"" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\ssym9yu7919c9.exe" C:\Windows\SysWOW64\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2852 set thread context of 5084 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\explorer.exe

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\explorer.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\explorer.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4780 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 4780 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 4780 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 4684 wrote to memory of 1632 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 1632 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4684 wrote to memory of 1632 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1632 wrote to memory of 3388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1632 wrote to memory of 3388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1632 wrote to memory of 3388 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1632 wrote to memory of 1324 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 1632 wrote to memory of 1324 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 1632 wrote to memory of 1324 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 1632 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1632 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1632 wrote to memory of 1128 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1632 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1632 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1632 wrote to memory of 2316 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 1632 wrote to memory of 400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1632 wrote to memory of 400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1632 wrote to memory of 400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2316 wrote to memory of 224 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2316 wrote to memory of 224 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2316 wrote to memory of 224 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 224 wrote to memory of 3068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 224 wrote to memory of 3068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 224 wrote to memory of 3068 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 224 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 224 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 224 wrote to memory of 3848 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 224 wrote to memory of 2852 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 224 wrote to memory of 2852 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 224 wrote to memory of 2852 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 2852 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 2852 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 2852 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 2852 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 2852 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 224 wrote to memory of 840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 224 wrote to memory of 840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 224 wrote to memory of 840 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 224 wrote to memory of 3076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 224 wrote to memory of 3076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 224 wrote to memory of 3076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 224 wrote to memory of 3312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 224 wrote to memory of 3312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 224 wrote to memory of 3312 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 224 wrote to memory of 3252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 224 wrote to memory of 3252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 224 wrote to memory of 3252 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 5084 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Windows\SysWOW64\explorer.exe
PID 5084 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Windows\SysWOW64\explorer.exe
PID 5084 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Windows\SysWOW64\explorer.exe
PID 2120 wrote to memory of 1632 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 1632 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 400 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\timeout.exe
PID 2120 wrote to memory of 400 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\timeout.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe

"C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\terminalweu.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\fit3274.bat" "

C:\Windows\SysWOW64\timeout.exe

timeout 7

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

"Gozip.exe" e -p398FsVBddjkd8cwr nmh3745.rar

C:\Windows\SysWOW64\timeout.exe

timeout 6

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\7els.vbs"

C:\Windows\SysWOW64\timeout.exe

timeout 8

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\def.bat" "

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\controllevel"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

miktotik.exe /start

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

miktotik.exe /start

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Gozip.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Gozip.exe

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef"

C:\Windows\SysWOW64\timeout.exe

timeout 4

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2120 -ip 2120

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 1120

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
NL 104.110.191.140:80 tcp
US 93.184.220.29:80 tcp
US 52.168.117.170:443 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
FR 2.18.109.224:443 tcp
US 104.18.25.243:80 tcp

Files

memory/4684-130-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\terminalweu.vbs

MD5 bf045999e4ca77b57de18d5ff25e1272
SHA1 e8dab3a106e479a53c4ea61443c2ff7873d17c67
SHA256 89f2f0f40f06ed45b155adf713b127931ebb41c162e08e0cda75ecb9e10fdf17
SHA512 e191b410d97f021d3dd55ad3565559cf0f3dd6dcc7157f7d6ff60dd610128dfe875cc00f67106653df758e07b6d845fc4e7a7ee290f8d7d8a58d58a90a018f6a

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\fit3274.bat

MD5 814380ebb377d7ebca662c6ac563eec0
SHA1 3487cf2382cd0bc87a677e637de1ae40ccfbc13b
SHA256 b58d9796ee64ea6731a6e54fdeb997ebc4ac148e3982e9c48fdc1f79d1531136
SHA512 41737175039c4f62159be44fcd683aff05be9f7ea97b7061222d34528995768cf1656c617991a5d7a5595bd958687a5adbeb208fe961aa2afb4fd2bf2a8d7d66

memory/1632-133-0x0000000000000000-mapping.dmp

memory/3388-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Preferences.dat

MD5 b1aa11c4722efbcaaf5ebf5f17880d17
SHA1 b4b8578e13eb1a860524e827ac8bdd5d8ece604b
SHA256 2e7ba0fb3f5edd6091e13e0d3a127210813433e46cea81a61a211d6a95457e27
SHA512 a7668dfca645f63b571aff7ac11709b5578a4cd5947bf468fba11e4f5d455ef1b0917acc12c558e7b27d2eff1a8debb19b2c7783b7742c97c81b54fedcedd7b5

memory/1324-136-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

memory/1128-138-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\7els.vbs

MD5 8f5293bc4ace65a9f51ba97bddcd7eee
SHA1 e11a5055530092c3a805d757110c4f8761976eef
SHA256 a48489f790e76faeaaed41f123031e708881226c224030213861cba419ca34f4
SHA512 c319cf12985d57b3d00737107a20e0c06a236d654064255dcc7023aa312871b52d399a9e9a55743fb3a446d2624a1049013f0ca8132ed6b6432658c396fa981d

memory/2316-140-0x0000000000000000-mapping.dmp

memory/400-141-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\def.bat

MD5 bf223a7df3a7feecfcb49a5d01d781d9
SHA1 d8b2b0f48887e63928576773efe1ab5776d7dfb0
SHA256 494cc4d4211c1ed3f88255a46d501040b885c9b5cca26dcae5e37185d883957e
SHA512 e15ca76450e99b21982efeeba4c148c9f28dddd85ae0fdb43e496813a4556b83022e2bb1d553de1c851065e09c7866bc6a9829da84dc0fcf3b269a03b0857fc2

memory/224-143-0x0000000000000000-mapping.dmp

memory/3068-144-0x0000000000000000-mapping.dmp

memory/3848-145-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

memory/2852-146-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

memory/5084-149-0x0000000000000000-mapping.dmp

memory/5084-150-0x0000000000400000-0x0000000000435000-memory.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

memory/2852-153-0x0000000000400000-0x000000000049B000-memory.dmp

memory/5084-154-0x0000000000400000-0x0000000000435000-memory.dmp

memory/840-155-0x0000000000000000-mapping.dmp

memory/5084-156-0x0000000000400000-0x0000000000435000-memory.dmp

memory/5084-157-0x0000000002110000-0x0000000002176000-memory.dmp

memory/5084-159-0x0000000000400000-0x0000000000435000-memory.dmp

memory/5084-161-0x00000000024D0000-0x00000000024DD000-memory.dmp

memory/5084-160-0x0000000002110000-0x0000000002176000-memory.dmp

memory/5084-162-0x0000000002690000-0x000000000269C000-memory.dmp

memory/3076-163-0x0000000000000000-mapping.dmp

memory/3312-164-0x0000000000000000-mapping.dmp

memory/3252-165-0x0000000000000000-mapping.dmp

memory/2120-166-0x0000000000000000-mapping.dmp

memory/2120-167-0x0000000000850000-0x0000000000C83000-memory.dmp

memory/2120-168-0x00000000010F0000-0x0000000001246000-memory.dmp

memory/5084-169-0x0000000002110000-0x0000000002176000-memory.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

memory/1632-171-0x0000000003790000-0x00000000038E6000-memory.dmp

memory/2120-172-0x00000000010F0000-0x0000000001246000-memory.dmp