Resubmissions

25-01-2021 18:42

210125-r1hfrr5jc6 10

19-01-2021 19:41

210119-88n6rsk2w6 10

Analysis

  • max time kernel
    149s
  • max time network
    98s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    25-01-2021 18:42

General

  • Target

    CFDI__Manager__12365.exe

  • Size

    809KB

  • MD5

    5b7c3ff3556606c67a61527f81579eee

  • SHA1

    75299ed8a21eebe1b1969e065e80f02ad21d4267

  • SHA256

    82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f

  • SHA512

    6484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
        "C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1340
        • C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe
          "C:\Users\Admin\AppData\Local\Temp\CFDI__Manager__12365.exe"
          3⤵
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Suspicious behavior: MapViewOfSection
          • Suspicious behavior: RenamesItself
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1240
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            4⤵
            • Modifies firewall policy service
            • Checks BIOS information in registry
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops desktop.ini file(s)
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Enumerates system info in registry
            • Modifies Internet Explorer Protected Mode
            • Modifies Internet Explorer Protected Mode Banner
            • Modifies Internet Explorer settings
            • NTFS ADS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:320
            • C:\Users\Admin\AppData\Local\Temp\997us99sm_1.exe
              /suac
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:964
            • C:\Users\Admin\AppData\Local\Temp\713mou1w.exe
              "C:\Users\Admin\AppData\Local\Temp\713mou1w.exe"
              5⤵
              • Executes dropped EXE
              PID:1056
            • C:\Users\Admin\AppData\Local\Temp\gug5c795.exe
              "C:\Users\Admin\AppData\Local\Temp\gug5c795.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1656
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1164

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\713mou1w.exe

        MD5

        dc9127dc898edcb166176abfc891ee59

        SHA1

        400466e887170c260628143430d08335a88d5298

        SHA256

        4490550a55d971b2305d209e9a9d6fdb4954fb1c4c435d0b1f4e98d84a938074

        SHA512

        85347b252c34c39b8781a592af94de66dc65908c8d2c92a447cc8fca4996eea65e4c0875f891c9372ff51873c05894f846d9e37e965959f4c5c5d0367e0afb4c

      • C:\Users\Admin\AppData\Local\Temp\713mou1w.exe

        MD5

        dc9127dc898edcb166176abfc891ee59

        SHA1

        400466e887170c260628143430d08335a88d5298

        SHA256

        4490550a55d971b2305d209e9a9d6fdb4954fb1c4c435d0b1f4e98d84a938074

        SHA512

        85347b252c34c39b8781a592af94de66dc65908c8d2c92a447cc8fca4996eea65e4c0875f891c9372ff51873c05894f846d9e37e965959f4c5c5d0367e0afb4c

      • C:\Users\Admin\AppData\Local\Temp\997us99sm_1.exe

        MD5

        5b7c3ff3556606c67a61527f81579eee

        SHA1

        75299ed8a21eebe1b1969e065e80f02ad21d4267

        SHA256

        82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f

        SHA512

        6484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c

      • C:\Users\Admin\AppData\Local\Temp\997us99sm_1.exe

        MD5

        5b7c3ff3556606c67a61527f81579eee

        SHA1

        75299ed8a21eebe1b1969e065e80f02ad21d4267

        SHA256

        82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f

        SHA512

        6484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c

      • C:\Users\Admin\AppData\Local\Temp\gug5c795.exe

        MD5

        4fd50d4173e873a52e7841fe2a3f921e

        SHA1

        4ffd734a7877f78fdf2b65b37e90b2db3be20fe3

        SHA256

        456b6497adb103204e78b1888c75cc73a6e61e8aa1d5eec27eb594f98e0601ed

        SHA512

        5c272aeb5a27d905251d4e41216d69060eebe2d978602f339776486bbb007ea294183921a7c57c8a8dafaf50080df08b411f45610dfebd6a61d7dc28658d8ab0

      • \Users\Admin\AppData\Local\Temp\713mou1w.exe

        MD5

        dc9127dc898edcb166176abfc891ee59

        SHA1

        400466e887170c260628143430d08335a88d5298

        SHA256

        4490550a55d971b2305d209e9a9d6fdb4954fb1c4c435d0b1f4e98d84a938074

        SHA512

        85347b252c34c39b8781a592af94de66dc65908c8d2c92a447cc8fca4996eea65e4c0875f891c9372ff51873c05894f846d9e37e965959f4c5c5d0367e0afb4c

      • \Users\Admin\AppData\Local\Temp\997us99sm_1.exe

        MD5

        5b7c3ff3556606c67a61527f81579eee

        SHA1

        75299ed8a21eebe1b1969e065e80f02ad21d4267

        SHA256

        82e756b74e20e351fe5c695768d7849ebd1cf4f852c53bfafd2388dd5a5aa17f

        SHA512

        6484459bd38bb1e5f6a1ec32f05f71c948431f3e2e08d15a90a1c8779ec9695e0f6a0f062e9a5c26b21ec4cf387dd5e0da47e3f32a04c6b6d9df4930b62e942c

      • \Users\Admin\AppData\Local\Temp\gug5c795.exe

        MD5

        4fd50d4173e873a52e7841fe2a3f921e

        SHA1

        4ffd734a7877f78fdf2b65b37e90b2db3be20fe3

        SHA256

        456b6497adb103204e78b1888c75cc73a6e61e8aa1d5eec27eb594f98e0601ed

        SHA512

        5c272aeb5a27d905251d4e41216d69060eebe2d978602f339776486bbb007ea294183921a7c57c8a8dafaf50080df08b411f45610dfebd6a61d7dc28658d8ab0

      • memory/320-14-0x0000000077A30000-0x0000000077BB1000-memory.dmp

        Filesize

        1.5MB

      • memory/320-11-0x0000000000000000-mapping.dmp

      • memory/320-13-0x0000000075051000-0x0000000075053000-memory.dmp

        Filesize

        8KB

      • memory/320-15-0x00000000006A0000-0x00000000006AC000-memory.dmp

        Filesize

        48KB

      • memory/320-16-0x0000000000290000-0x00000000003C4000-memory.dmp

        Filesize

        1.2MB

      • memory/320-22-0x0000000002110000-0x0000000002112000-memory.dmp

        Filesize

        8KB

      • memory/964-25-0x0000000000000000-mapping.dmp

      • memory/1056-29-0x0000000000000000-mapping.dmp

      • memory/1056-32-0x0000000073760000-0x0000000073E4E000-memory.dmp

        Filesize

        6.9MB

      • memory/1056-33-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

        Filesize

        4KB

      • memory/1196-40-0x0000000002A50000-0x0000000002A56000-memory.dmp

        Filesize

        24KB

      • memory/1240-9-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

        Filesize

        4KB

      • memory/1240-20-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

        Filesize

        4KB

      • memory/1240-10-0x0000000001ED0000-0x0000000001EDC000-memory.dmp

        Filesize

        48KB

      • memory/1240-3-0x00000000004015C6-mapping.dmp

      • memory/1240-8-0x0000000000240000-0x000000000024D000-memory.dmp

        Filesize

        52KB

      • memory/1240-7-0x0000000000230000-0x0000000000231000-memory.dmp

        Filesize

        4KB

      • memory/1240-6-0x00000000007B0000-0x0000000000816000-memory.dmp

        Filesize

        408KB

      • memory/1240-5-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/1240-4-0x0000000076691000-0x0000000076693000-memory.dmp

        Filesize

        8KB

      • memory/1240-2-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/1656-36-0x0000000000000000-mapping.dmp

      • memory/1844-23-0x000007FEF7D20000-0x000007FEF7F9A000-memory.dmp

        Filesize

        2.5MB