Malware Analysis Report

2024-11-15 08:41

Sample ID 220713-hbsr1sahgl
Target CFDI_826271_53535.exe
SHA256 c040a2c32938707e1579fecce89e3c4fa04d019a467f642dd2bb18bab35bf99d
Tags
betabot backdoor botnet evasion persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c040a2c32938707e1579fecce89e3c4fa04d019a467f642dd2bb18bab35bf99d

Threat Level: Known bad

The file CFDI_826271_53535.exe was found to be: Known bad.

Malicious Activity Summary

betabot backdoor botnet evasion persistence trojan

Modifies firewall policy service

BetaBot

Sets file execution options in registry

Executes dropped EXE

Sets file to hidden

Checks computer location settings

Loads dropped DLL

Checks BIOS information in registry

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Enumerates physical storage devices

Program crash

Kills process with taskkill

Modifies registry class

Views/modifies file attributes

Modifies Internet Explorer Protected Mode

Enumerates system info in registry

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Delays execution with timeout.exe

Modifies Internet Explorer Protected Mode Banner

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-13 06:34

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-13 06:34

Reported

2022-07-13 06:36

Platform

win7-20220414-en

Max time kernel

148s

Max time network

105s

Command Line

C:\Windows\Explorer.EXE

Signatures

BetaBot

trojan backdoor botnet betabot

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "sqxsmi.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yoq3u737.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yoq3u737.exe\DisableExceptionChainValidation C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe C:\Windows\SysWOW64\explorer.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\yoq3u737.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\yoq3u737.exe\"" C:\Windows\SysWOW64\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 868 set thread context of 1356 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\explorer.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 656 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 656 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 656 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 656 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 656 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 656 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 656 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 896 wrote to memory of 968 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 896 wrote to memory of 968 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 896 wrote to memory of 968 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 896 wrote to memory of 968 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 896 wrote to memory of 968 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 896 wrote to memory of 968 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 896 wrote to memory of 968 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 968 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 1216 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 968 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 968 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 968 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 968 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 968 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 968 wrote to memory of 1708 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 968 wrote to memory of 328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 968 wrote to memory of 528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 968 wrote to memory of 528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 968 wrote to memory of 528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 968 wrote to memory of 528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 968 wrote to memory of 528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 968 wrote to memory of 528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 968 wrote to memory of 664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 968 wrote to memory of 664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 528 wrote to memory of 1576 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 528 wrote to memory of 1576 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 528 wrote to memory of 1576 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 528 wrote to memory of 1576 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 528 wrote to memory of 1576 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 528 wrote to memory of 1576 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 528 wrote to memory of 1576 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1576 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1576 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1576 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1576 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1576 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1576 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1576 wrote to memory of 696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1576 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe

"C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\terminalweu.vbs"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\fit3274.bat" "

C:\Windows\SysWOW64\timeout.exe

timeout 7

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

"Gozip.exe" e -p398FsVBddjkd8cwr nmh3745.rar

C:\Windows\SysWOW64\timeout.exe

timeout 6

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\7els.vbs"

C:\Windows\SysWOW64\timeout.exe

timeout 8

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\def.bat" "

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\controllevel"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

miktotik.exe /start

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

miktotik.exe /start

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Gozip.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Gozip.exe

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef"

C:\Windows\SysWOW64\timeout.exe

timeout 4

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

Network

Country Destination Domain Proto
US 8.8.8.8:53 update.microsoft.com udp
US 20.109.209.108:80 update.microsoft.com tcp
US 8.8.8.8:53 russk19.icu udp
US 8.8.8.8:53 russk20.icu udp
US 8.8.8.8:53 russk21.icu udp
US 8.8.8.8:53 russk21.icu udp
RU 62.204.41.171:80 russk21.icu tcp

Files

memory/656-54-0x00000000755A1000-0x00000000755A3000-memory.dmp

memory/896-55-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\terminalweu.vbs

MD5 bf045999e4ca77b57de18d5ff25e1272
SHA1 e8dab3a106e479a53c4ea61443c2ff7873d17c67
SHA256 89f2f0f40f06ed45b155adf713b127931ebb41c162e08e0cda75ecb9e10fdf17
SHA512 e191b410d97f021d3dd55ad3565559cf0f3dd6dcc7157f7d6ff60dd610128dfe875cc00f67106653df758e07b6d845fc4e7a7ee290f8d7d8a58d58a90a018f6a

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\fit3274.bat

MD5 814380ebb377d7ebca662c6ac563eec0
SHA1 3487cf2382cd0bc87a677e637de1ae40ccfbc13b
SHA256 b58d9796ee64ea6731a6e54fdeb997ebc4ac148e3982e9c48fdc1f79d1531136
SHA512 41737175039c4f62159be44fcd683aff05be9f7ea97b7061222d34528995768cf1656c617991a5d7a5595bd958687a5adbeb208fe961aa2afb4fd2bf2a8d7d66

memory/968-59-0x0000000000000000-mapping.dmp

memory/1216-61-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Preferences.dat

MD5 b1aa11c4722efbcaaf5ebf5f17880d17
SHA1 b4b8578e13eb1a860524e827ac8bdd5d8ece604b
SHA256 2e7ba0fb3f5edd6091e13e0d3a127210813433e46cea81a61a211d6a95457e27
SHA512 a7668dfca645f63b571aff7ac11709b5578a4cd5947bf468fba11e4f5d455ef1b0917acc12c558e7b27d2eff1a8debb19b2c7783b7742c97c81b54fedcedd7b5

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

memory/1708-66-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

memory/328-69-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\7els.vbs

MD5 8f5293bc4ace65a9f51ba97bddcd7eee
SHA1 e11a5055530092c3a805d757110c4f8761976eef
SHA256 a48489f790e76faeaaed41f123031e708881226c224030213861cba419ca34f4
SHA512 c319cf12985d57b3d00737107a20e0c06a236d654064255dcc7023aa312871b52d399a9e9a55743fb3a446d2624a1049013f0ca8132ed6b6432658c396fa981d

memory/528-72-0x0000000000000000-mapping.dmp

memory/664-74-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\def.bat

MD5 bf223a7df3a7feecfcb49a5d01d781d9
SHA1 d8b2b0f48887e63928576773efe1ab5776d7dfb0
SHA256 494cc4d4211c1ed3f88255a46d501040b885c9b5cca26dcae5e37185d883957e
SHA512 e15ca76450e99b21982efeeba4c148c9f28dddd85ae0fdb43e496813a4556b83022e2bb1d553de1c851065e09c7866bc6a9829da84dc0fcf3b269a03b0857fc2

memory/1576-77-0x0000000000000000-mapping.dmp

memory/696-79-0x0000000000000000-mapping.dmp

memory/1892-81-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

memory/868-86-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

memory/1356-90-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1356-92-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1356-93-0x00000000004015C6-mapping.dmp

memory/1576-97-0x00000000006C0000-0x000000000075B000-memory.dmp

memory/868-96-0x0000000000400000-0x000000000049B000-memory.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

memory/1396-99-0x0000000000000000-mapping.dmp

memory/1356-98-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1356-102-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1356-104-0x0000000000310000-0x0000000000376000-memory.dmp

memory/1412-106-0x0000000000000000-mapping.dmp

memory/928-108-0x0000000000000000-mapping.dmp

memory/1756-110-0x0000000000000000-mapping.dmp

memory/1356-112-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1356-113-0x0000000000310000-0x0000000000376000-memory.dmp

memory/1356-114-0x0000000000250000-0x000000000025D000-memory.dmp

memory/1356-115-0x00000000003D0000-0x00000000003DC000-memory.dmp

memory/1576-116-0x00000000006C0000-0x000000000075B000-memory.dmp

memory/1392-117-0x0000000000000000-mapping.dmp

memory/1392-119-0x0000000074751000-0x0000000074753000-memory.dmp

memory/1392-120-0x0000000077070000-0x00000000771F0000-memory.dmp

memory/1392-121-0x0000000000610000-0x0000000000766000-memory.dmp

memory/1392-122-0x0000000000290000-0x0000000000310000-memory.dmp

memory/1356-123-0x0000000000310000-0x0000000000376000-memory.dmp

memory/1392-124-0x0000000077070000-0x00000000771F0000-memory.dmp

memory/1392-125-0x0000000000610000-0x0000000000766000-memory.dmp

memory/1392-126-0x0000000000290000-0x0000000000310000-memory.dmp

memory/1376-127-0x0000000002270000-0x0000000002276000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-13 06:34

Reported

2022-07-13 06:36

Platform

win10v2004-20220414-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe"

Signatures

BetaBot

trojan backdoor botnet betabot

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A

Sets file execution options in registry

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1s1395w1q.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1s1395w1q.exe\DisableExceptionChainValidation C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "oqzipbwe.exe" C:\Windows\SysWOW64\explorer.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\explorer.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.09 = "C:\\ProgramData\\Google Updater 2.09\\1s1395w1q.exe" C:\Windows\SysWOW64\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.09 = "\"C:\\ProgramData\\Google Updater 2.09\\1s1395w1q.exe\"" C:\Windows\SysWOW64\explorer.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4288 set thread context of 4656 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\explorer.exe

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\explorer.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Modifies Internet Explorer Protected Mode

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer Protected Mode Banner

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" C:\Windows\SysWOW64\explorer.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main C:\Windows\SysWOW64\explorer.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3272 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 3272 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 3272 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe C:\Windows\SysWOW64\WScript.exe
PID 3756 wrote to memory of 4376 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3756 wrote to memory of 4376 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3756 wrote to memory of 4376 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4376 wrote to memory of 4232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4376 wrote to memory of 4232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4376 wrote to memory of 4232 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4376 wrote to memory of 1920 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 4376 wrote to memory of 1920 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 4376 wrote to memory of 1920 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe
PID 4376 wrote to memory of 4896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4376 wrote to memory of 4896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4376 wrote to memory of 4896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4376 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4376 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4376 wrote to memory of 3768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\WScript.exe
PID 4376 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4376 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4376 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3768 wrote to memory of 4812 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3768 wrote to memory of 4812 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3768 wrote to memory of 4812 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4812 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4812 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4812 wrote to memory of 436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4812 wrote to memory of 3568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4812 wrote to memory of 3568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4812 wrote to memory of 3568 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4812 wrote to memory of 4288 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 4812 wrote to memory of 4288 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 4812 wrote to memory of 4288 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 4288 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 4288 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 4288 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 4288 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 4288 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe
PID 4812 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4812 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4812 wrote to memory of 2248 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4812 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4812 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4812 wrote to memory of 4608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4812 wrote to memory of 3872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4812 wrote to memory of 3872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4812 wrote to memory of 3872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 4812 wrote to memory of 3416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4812 wrote to memory of 3416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4812 wrote to memory of 3416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4656 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Windows\SysWOW64\explorer.exe
PID 4656 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Windows\SysWOW64\explorer.exe
PID 4656 wrote to memory of 2044 N/A C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe C:\Windows\SysWOW64\explorer.exe
PID 2044 wrote to memory of 4376 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 2044 wrote to memory of 4376 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\cmd.exe
PID 2044 wrote to memory of 4192 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\timeout.exe
PID 2044 wrote to memory of 4192 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\timeout.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe

"C:\Users\Admin\AppData\Local\Temp\CFDI_826271_53535.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\terminalweu.vbs"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\fit3274.bat" "

C:\Windows\SysWOW64\timeout.exe

timeout 7

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

"Gozip.exe" e -p398FsVBddjkd8cwr nmh3745.rar

C:\Windows\SysWOW64\timeout.exe

timeout 6

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\7els.vbs"

C:\Windows\SysWOW64\timeout.exe

timeout 8

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\def.bat" "

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\controllevel"

C:\Windows\SysWOW64\timeout.exe

timeout 1

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

miktotik.exe /start

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

miktotik.exe /start

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Gozip.exe

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im Gozip.exe

C:\Windows\SysWOW64\attrib.exe

attrib -s -h "C:\Users\Admin\AppData\Roaming\controllevel\foldersDef"

C:\Windows\SysWOW64\timeout.exe

timeout 4

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2044 -ip 2044

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 1108

Network

Country Destination Domain Proto
US 67.26.205.254:80 tcp
US 67.26.205.254:80 tcp
US 20.42.65.88:443 tcp
US 67.26.205.254:80 tcp
US 67.26.205.254:80 tcp
US 67.26.205.254:80 tcp
US 8.8.8.8:53 97.97.242.52.in-addr.arpa udp

Files

memory/3756-130-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\terminalweu.vbs

MD5 bf045999e4ca77b57de18d5ff25e1272
SHA1 e8dab3a106e479a53c4ea61443c2ff7873d17c67
SHA256 89f2f0f40f06ed45b155adf713b127931ebb41c162e08e0cda75ecb9e10fdf17
SHA512 e191b410d97f021d3dd55ad3565559cf0f3dd6dcc7157f7d6ff60dd610128dfe875cc00f67106653df758e07b6d845fc4e7a7ee290f8d7d8a58d58a90a018f6a

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\fit3274.bat

MD5 814380ebb377d7ebca662c6ac563eec0
SHA1 3487cf2382cd0bc87a677e637de1ae40ccfbc13b
SHA256 b58d9796ee64ea6731a6e54fdeb997ebc4ac148e3982e9c48fdc1f79d1531136
SHA512 41737175039c4f62159be44fcd683aff05be9f7ea97b7061222d34528995768cf1656c617991a5d7a5595bd958687a5adbeb208fe961aa2afb4fd2bf2a8d7d66

memory/4376-133-0x0000000000000000-mapping.dmp

memory/4232-134-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Preferences.dat

MD5 b1aa11c4722efbcaaf5ebf5f17880d17
SHA1 b4b8578e13eb1a860524e827ac8bdd5d8ece604b
SHA256 2e7ba0fb3f5edd6091e13e0d3a127210813433e46cea81a61a211d6a95457e27
SHA512 a7668dfca645f63b571aff7ac11709b5578a4cd5947bf468fba11e4f5d455ef1b0917acc12c558e7b27d2eff1a8debb19b2c7783b7742c97c81b54fedcedd7b5

memory/1920-136-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

memory/4896-138-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\7els.vbs

MD5 8f5293bc4ace65a9f51ba97bddcd7eee
SHA1 e11a5055530092c3a805d757110c4f8761976eef
SHA256 a48489f790e76faeaaed41f123031e708881226c224030213861cba419ca34f4
SHA512 c319cf12985d57b3d00737107a20e0c06a236d654064255dcc7023aa312871b52d399a9e9a55743fb3a446d2624a1049013f0ca8132ed6b6432658c396fa981d

memory/3768-140-0x0000000000000000-mapping.dmp

memory/4192-141-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\def.bat

MD5 bf223a7df3a7feecfcb49a5d01d781d9
SHA1 d8b2b0f48887e63928576773efe1ab5776d7dfb0
SHA256 494cc4d4211c1ed3f88255a46d501040b885c9b5cca26dcae5e37185d883957e
SHA512 e15ca76450e99b21982efeeba4c148c9f28dddd85ae0fdb43e496813a4556b83022e2bb1d553de1c851065e09c7866bc6a9829da84dc0fcf3b269a03b0857fc2

memory/4812-143-0x0000000000000000-mapping.dmp

memory/436-144-0x0000000000000000-mapping.dmp

memory/3568-145-0x0000000000000000-mapping.dmp

memory/4288-146-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

memory/4656-149-0x0000000000000000-mapping.dmp

memory/4656-150-0x0000000000400000-0x0000000000435000-memory.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\miktotik.exe

MD5 6ed0cca96fe69be3b775499509f0b029
SHA1 e1c57829dd8947cc09b8b4ffcaaad07939efbb2d
SHA256 bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab
SHA512 a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

memory/4288-152-0x0000000000400000-0x000000000049B000-memory.dmp

memory/4656-154-0x0000000000400000-0x0000000000435000-memory.dmp

memory/2248-155-0x0000000000000000-mapping.dmp

memory/4656-156-0x0000000000400000-0x0000000000435000-memory.dmp

memory/4608-158-0x0000000000000000-mapping.dmp

memory/4656-157-0x0000000002130000-0x0000000002196000-memory.dmp

memory/3872-160-0x0000000000000000-mapping.dmp

memory/3416-161-0x0000000000000000-mapping.dmp

memory/2044-162-0x0000000000000000-mapping.dmp

memory/4656-163-0x0000000000400000-0x0000000000435000-memory.dmp

memory/4656-164-0x0000000002130000-0x0000000002196000-memory.dmp

memory/4656-166-0x0000000002690000-0x000000000269C000-memory.dmp

memory/4656-165-0x00000000004F0000-0x00000000004FD000-memory.dmp

memory/4656-167-0x0000000002130000-0x0000000002196000-memory.dmp

memory/2044-168-0x0000000000E30000-0x0000000001263000-memory.dmp

memory/2044-169-0x0000000001270000-0x00000000013C6000-memory.dmp

C:\Users\Admin\AppData\Roaming\controllevel\foldersDef\Gozip.exe

MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

memory/4376-171-0x00000000031A0000-0x00000000032F6000-memory.dmp

memory/2044-172-0x0000000001270000-0x00000000013C6000-memory.dmp