To me, a virtual machine represents what a petri dish does to a Scientist... welcome to my lab! :o)
Lets slice up some botnets!
Specimen 41b9df60db731805fe22413dfb0806ee.exe
Captured via Nepenthes from http://217.***.***.122:15040/ObzgIA== via its attempted RFI exploit of one of my honeypots. Thursday 27th November 2.47am GMT.
NETWORK BASED ACTIVITY
Connects to ns.ircstyle.net TCP 1867 (irc), joins IRC channel #ns.
Connects to zonetech.info TCP 80 (www), downloads lb3.exe.
Connects to alwayssam.com TCP 80 (www), downloads lal222.exe.
Botnet master (nicknamed "EH") issues following command: * ipscan s.s.s.s dcom2 -s
Infected machine starts scanning class C for TCP 135, starting from its own IP address, increases source port with each host.
IRC is *completely* locked down, unable to do /list, /lusers, /links, /mode, /map, etc. Possibly M0dded R0Xnet, fatalz or UNK IRCD.
HOST BASED ACTIVITY
Creates:
C:\Windows\system32\ws2_32.dll
C:\Windows\system32\ws2help.dll
C:\Windows\system32\imm32.dll
C:\Windows\system32\shell32.dll
C:\Windows\system32\pstorec.dll
C:\Windows\system32\atl.dll
C:\Windows\system32\psapi.dll
C:\Windows\system32\rsaenh.dll
C:\Windows\system32\crypt32.dll
Changes Registry key in:
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed
Creates:
C:\Windows\system32\firewall.exe
Which spawns and then creates:
%currentdir%\celibzeg.bat
C:\Windows\system32\rpcss.dll
C:\Windows\system32\uxtheme.dll
C:\Windows\system32\MSCTF.dll
C:\Windows\system32\ieframe.dll
C:\Windows\system32\clbcatq.dll
C:\Windows\system32\COMRes.dll
C:\Windows\Registration\R000000000007.clb
Queries registry for hostname, makes modifications to TCPIP properties and parameters to maximise sockets, etc.
Creates:
C:\Windows\system32\rasadhlp.dll
C:\Windows\system32\hnetcfg.dll
C:\Windows\system32\wshtcpip.dll
C:\Windows\system32\webcl32.dll
Firewall.exe then sends a TCP SYN packet from source port 1054 to 67.43.232.35:1867 which correspondes to the network activity; IRC connection to ns.ircstyle.net.
Cleans itself up, removes initial binary and other .bat files. Adds "firewall.exe" to Registry under "...\Current Version\Run" so that it is run on startup.
Do you want ice with that?