Analysis
-
max time kernel
150s -
max time network
61s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
04-09-2020 09:25
General
-
Target
PO-1364774 Final.xlsx
-
Size
749KB
-
MD5
2efbf412cd56c2203e8548512a68ef51
-
SHA1
5d0e3245ec2f35aaecfecb5cfa2af10db8e51451
-
SHA256
66b8e804eda79f364e6cd2ee2fdd967f199a1fe3dd7440e8c0ff313568f74531
-
SHA512
bfd71d8fa1c951b2705bab886060ebe926710ca32c9ea1a84f1caa586fd30c7e31804e27c7515632ad05ae78f18a4a68e93a56e10a8a9dece942496a8e0a8103
Score
10/10
Malware Config
Signatures
-
BetaBot
Beta Bot is a Trojan that infects computers and disables Antivirus.
-
Modifies firewall policy service 2 TTPs 4 IoCs
-
Blacklisted process makes network request 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Sets file execution options in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 4 IoCs
-
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
-
NSIS installer 10 IoCs
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 280 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious behavior: MapViewOfSection 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 28 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 83 IoCs
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\PO-1364774 Final.xlsx"2⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blacklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\vbc.exe"C:\Users\Admin\AppData\Roaming\vbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe ShoonCataclysm,Uboats3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe5⤵
- Modifies firewall policy service
- Checks BIOS information in registry
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Bonehead
-
C:\Users\Admin\AppData\Local\Temp\ShoonCataclysm.DLL
-
C:\Users\Admin\AppData\Roaming\vbc.exe
-
C:\Users\Admin\AppData\Roaming\vbc.exe
-
\Users\Admin\AppData\Local\Temp\ShoonCataclysm.dll
-
\Users\Admin\AppData\Roaming\vbc.exe
-
\Users\Admin\AppData\Roaming\vbc.exe
-
\Users\Admin\AppData\Roaming\vbc.exe
-
memory/428-10-0x0000000000000000-mapping.dmp
-
memory/428-14-0x00000000008A0000-0x00000000008D5000-memory.dmpFilesize
212KB
-
memory/976-19-0x0000000000000000-mapping.dmp
-
memory/976-27-0x0000000074E70000-0x0000000074E8C000-memory.dmpFilesize
112KB
-
memory/976-26-0x00000000754F0000-0x00000000754F7000-memory.dmpFilesize
28KB
-
memory/976-25-0x0000000075380000-0x00000000753BC000-memory.dmpFilesize
240KB
-
memory/1332-7-0x00000000020B0000-0x00000000020B1000-memory.dmpFilesize
4KB
-
memory/1332-9-0x00000000020B0000-0x00000000020B1000-memory.dmpFilesize
4KB
-
memory/1484-0-0x000007FEF83B0000-0x000007FEF862A000-memory.dmpFilesize
2.5MB
-
memory/1772-16-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1772-17-0x0000000002060000-0x0000000002113000-memory.dmpFilesize
716KB
-
memory/1772-18-0x0000000002CD0000-0x0000000002E51000-memory.dmpFilesize
1.5MB
-
memory/1772-15-0x0000000000000000-mapping.dmp
-
memory/1964-4-0x0000000000000000-mapping.dmp