Technical Information
Malicious functions
Executes the following
- '%WINDIR%\syswow64\taskkill.exe' /f /im opera.exe
- '%WINDIR%\syswow64\taskkill.exe' /f /im chrome.exe
Modifies file system
Creates the following files
- %TEMP%\nsgeb39.tmp\sibuia.dll
- %TEMP%\sibec43.tmp\sibca.dll
- %TEMP%\sibec43.tmp\sibclr.dll
- %TEMP%\sibec43.tmp\0\setup.exe
- %ProgramFiles(x86)%\9u1rmqd53dll\aliens.exe
- %TEMP%\be9fc3fa5685a9e8.exe
- %ALLUSERSPROFILE%\sib\{f9266136-0000-46f8-bc66-fdd9185e4296}\sib.dat
- %ALLUSERSPROFILE%\sib\{f9266136-0000-46f8-bc66-fdd9185e4296}\sibclr.dll
- %ALLUSERSPROFILE%\sib\{f9266136-0000-46f8-bc66-fdd9185e4296}\sibca.dll
- %TEMP%\gdiview.msi
- %TEMP%\msi1209.tmp
- %LOCALAPPDATA%\cookies.sqlite1603424642922-shm
Deletes the following files
- %TEMP%\sibec43.tmp\0\setup.exe
- %TEMP%\sibec43.tmp\sibca.dll
- %TEMP%\sibec43.tmp\sibclr.dll
- %TEMP%\nsgeb39.tmp\sibuia.dll
- %TEMP%\msi1209.tmp
- %ProgramFiles(x86)%\9u1rmqd53dll\aliens.exe
- %LOCALAPPDATA%\cookies.sqlite1603424642922-shm
Network activity
Connects to
- '71#####222390629.xyz':80
TCP
HTTP POST requests
- http://71#####222390629.xyz/info/w
UDP
- DNS ASK 71#####222390629.xyz
Miscellaneous
Adds a root certificate
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '%TEMP%\sibec43.tmp\0\setup.exe' -s
- '%ProgramFiles(x86)%\9u1rmqd53dll\aliens.exe'
- '%TEMP%\be9fc3fa5685a9e8.exe' 0011 installp1
- '%TEMP%\be9fc3fa5685a9e8.exe' 200 installp1
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\gdiview.msi"' (with hidden window)
- '%TEMP%\be9fc3fa5685a9e8.exe' 0011 installp1' (with hidden window)
- '%TEMP%\be9fc3fa5685a9e8.exe' 200 installp1' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "%ProgramFiles(x86)%\9u1rmqd53dll\aliens.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im opera.exe' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "%TEMP%\BE9FC3FA5685A9E8.exe"' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\msiexec.exe' /i "%TEMP%\gdiview.msi"
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "%ProgramFiles(x86)%\9u1rmqd53dll\aliens.exe"
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 3
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im chrome.exe
- '%ProgramFiles(x86)%\mozilla firefox\firefox.exe'
- '%WINDIR%\syswow64\cmd.exe' /c taskkill /f /im opera.exe
- '%WINDIR%\syswow64\cmd.exe' /c ping 127.0.0.1 -n 3 & del "%TEMP%\BE9FC3FA5685A9E8.exe"
