Overview

overview

10

Static

static

Sample of order.exe

windows7_x64

10

Sample of order.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Sample of order.exe

  • Size

    597KB

  • Sample

    201009-vp8e2f2zz6

  • MD5

    3c9212d20d32a311f0d3bc7e0706e5a2

  • SHA1

    b20f5b80b34b04091e1d64a16d22d727acd5955e

  • SHA256

    2962eba90f4c76463186e170ae32e1ad8ed50b589a83bee7016dc942b80cd0df

  • SHA512

    b2c8fb44661b1bcd2765c22a8474d35c78b051de6306e6dfd5257f4fe052850c4c3e117488e327b6bfeabc49dba8d609af63eb6b31aff344899ab7d83deb1453

Score
10/10
betabotbackdoorbotnetevasionpersistencetrojan

Malware Config

Targets

    • Target

      Sample of order.exe

    • Size

      597KB

    • MD5

      3c9212d20d32a311f0d3bc7e0706e5a2

    • SHA1

      b20f5b80b34b04091e1d64a16d22d727acd5955e

    • SHA256

      2962eba90f4c76463186e170ae32e1ad8ed50b589a83bee7016dc942b80cd0df

    • SHA512

      b2c8fb44661b1bcd2765c22a8474d35c78b051de6306e6dfd5257f4fe052850c4c3e117488e327b6bfeabc49dba8d609af63eb6b31aff344899ab7d83deb1453

    Score
    10/10
    trojanbackdoorbotnetbetabotevasionpersistence

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

      trojanbackdoorbotnetbetabot

    • Modifies firewall policy service

      evasion

    • Sets file execution options in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks