Overview

overview

10

Static

static

CFDI_Manag...31.exe

windows7_x64

10

CFDI_Manag...31.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CFDI_Manager_80831.exe

  • Size

    785KB

  • Sample

    210125-wdfbzm8lea

  • MD5

    d776c8207ca1a020530692d6db741b09

  • SHA1

    2a4623b17683996333b9d2afabeb1f60eee5ccdc

  • SHA256

    a4cf004074849571bb93e91dd43985d914bafd646ee7f630cd44db1e09fa3fab

  • SHA512

    1b788e8c30b01ec95a49d8d30b0138c43a0cb02d837a273c44f51085287356a9300b8c1ef1220d9e62c1a26f1937b0696fce2e317c756097395081140805e158

Score
10/10
betabotbackdoorbotnetevasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target

      CFDI_Manager_80831.exe

    • Size

      785KB

    • MD5

      d776c8207ca1a020530692d6db741b09

    • SHA1

      2a4623b17683996333b9d2afabeb1f60eee5ccdc

    • SHA256

      a4cf004074849571bb93e91dd43985d914bafd646ee7f630cd44db1e09fa3fab

    • SHA512

      1b788e8c30b01ec95a49d8d30b0138c43a0cb02d837a273c44f51085287356a9300b8c1ef1220d9e62c1a26f1937b0696fce2e317c756097395081140805e158

    Score
    10/10
    betabotbackdoorbotnetevasionpersistencetrojanransomware

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

      trojanbackdoorbotnetbetabot

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

5
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks