Analysis
- max time kernel
67s - max time network
71s - platform
windows10_x64 - resource
win10v200722 - submitted
19/08/2020, 07:53
General
- Target PO099494949494pdf.exe
- Size 359KB
- Sample200819-p2mpwjespe
- SHA256 d25607e7e693ec4556dc8a4a125c2c1548d9d4f8be0fa7c3300fe76f6aee1f5d
Score
10/10
Malware Config
Signatures
- BetaBot
Beta Bot is a Trojan that infects computers and disables Antivirus.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO099494949494pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO099494949494pdf.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 7242⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3776-0-0x0000000001BA6000-0x0000000001BA7000-memory.dmp
memory/3776-1-0x0000000003800000-0x0000000003801000-memory.dmp