Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    10-03-2021 09:25

General

  • Target

    3fad84ee18e4583656019ae08b317607.exe

  • Size

    709KB

  • MD5

    3fad84ee18e4583656019ae08b317607

  • SHA1

    fb719a92039d2892fc6a7d91de15454554215543

  • SHA256

    273811e7b3de14abc8cfbbb28be4ab3c39922ff09c869f1a4b6b357577f0d374

  • SHA512

    496d0359641b844042af175ce4bda3801150af9ee720fad8d43a6a7cdf6ab4de96ac263525aa1c36dec89be71a71ce9f28b5a0017798b5c40ef8d2602bf66378

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3fad84ee18e4583656019ae08b317607.exe
    "C:\Users\Admin\AppData\Local\Temp\3fad84ee18e4583656019ae08b317607.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Users\Admin\AppData\Local\Temp\3fad84ee18e4583656019ae08b317607.exe
      "C:\Users\Admin\AppData\Local\Temp\3fad84ee18e4583656019ae08b317607.exe"
      2⤵
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious behavior: MapViewOfSection
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Modifies firewall policy service
        • Checks BIOS information in registry
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3832
        • C:\Users\Admin\AppData\Local\Temp\q9y197755_1.exe
          /suac
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:1304
        • C:\Users\Admin\AppData\Local\Temp\9cg555owe5.exe
          "C:\Users\Admin\AppData\Local\Temp\9cg555owe5.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3728
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2744
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1020
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData\Google Updater 2.0\'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:728
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3684
        • C:\Users\Admin\AppData\Local\Temp\3o9ai9793m.exe
          "C:\Users\Admin\AppData\Local\Temp\3o9ai9793m.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4204

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    MD5

    8592ba100a78835a6b94d5949e13dfc1

    SHA1

    63e901200ab9a57c7dd4c078d7f75dcd3b357020

    SHA256

    fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

    SHA512

    87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    2c2bb338a40d907fd93662f5996065f9

    SHA1

    81612d05a4ad9c22ada48b2885fc4d0e33d3848e

    SHA256

    c7d84f4988e43f32ed99ffeb651869fb103dc2229df5d817f3ba167ed85a171e

    SHA512

    99d729219f58343545dd70d1abda12785a93f8763f229ea478aac0f7c9a9ac254bbacd918967dbcbf935246770b92ec05adf8ab91b9e0770b1fac26d21013ed4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    5a3bceac4b13131180aa230e7d8a138f

    SHA1

    e9edc3f5d14f2dafe7b56e9faa51a9964ddb9315

    SHA256

    6d09c2dc3c599a60c2586e27eebd080a6927db686d07d9bf8506bc351fc08511

    SHA512

    0b56a9ed279db4504f2da96c4255f3079f8f3747694759b2c4fec79bf8d15c154d41873b104d1cf46a5f237640956e274b10b81dcf8cd07d56127106828cbfc5

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    6436c6aa9e332ce6b355481efe35f861

    SHA1

    c091e4a5b7957ff515888bc58b0b3a3a88956c75

    SHA256

    ecea4426d5d3f6e26fad2acc420fe479c9b1dc4b9f3524039062956a1e52a002

    SHA512

    ec42ed0bcc34287c4e9d8059a5faf5930f6814c9cc28dda7bed73f50142b3b6ae35d95db4623e7efe350b1cae6538cd175e65851ff83760204e90cd93607927e

  • C:\Users\Admin\AppData\Local\Temp\3o9ai9793m.exe

    MD5

    50803bdba827e6ae4600da26b5e81800

    SHA1

    e3650665dd57b79514d33fe8e8d8ff8429b52c55

    SHA256

    02dce269070bfec91e4f01a67d774167f8208f17211e8027d8a7fe3dc62a356b

    SHA512

    c641b6937d93b76e592f69b35d8e0f8236c985a56bae41b78fca29a1b6f16f2c75fb25941d6957a1e761a64d66acbdf9673cf13434d3cc6f7901904105e19c50

  • C:\Users\Admin\AppData\Local\Temp\3o9ai9793m.exe

    MD5

    50803bdba827e6ae4600da26b5e81800

    SHA1

    e3650665dd57b79514d33fe8e8d8ff8429b52c55

    SHA256

    02dce269070bfec91e4f01a67d774167f8208f17211e8027d8a7fe3dc62a356b

    SHA512

    c641b6937d93b76e592f69b35d8e0f8236c985a56bae41b78fca29a1b6f16f2c75fb25941d6957a1e761a64d66acbdf9673cf13434d3cc6f7901904105e19c50

  • C:\Users\Admin\AppData\Local\Temp\9cg555owe5.exe

    MD5

    08cdfd0d3a406601c42f087da16ec6c8

    SHA1

    48fd8eef568d2372e2a883283e58e5def81fef07

    SHA256

    eb7cea525ecef555356c13b6948c21ddad4b8a622ff4c027f285c0c096570253

    SHA512

    d522fc9c5815c93a1dc114c63db53879346e435397cad79a105a412cb18459335a1bfc3cfc9e7f6469cd703e2014538aa3c649442b80214a945e76ed50d26940

  • C:\Users\Admin\AppData\Local\Temp\9cg555owe5.exe

    MD5

    08cdfd0d3a406601c42f087da16ec6c8

    SHA1

    48fd8eef568d2372e2a883283e58e5def81fef07

    SHA256

    eb7cea525ecef555356c13b6948c21ddad4b8a622ff4c027f285c0c096570253

    SHA512

    d522fc9c5815c93a1dc114c63db53879346e435397cad79a105a412cb18459335a1bfc3cfc9e7f6469cd703e2014538aa3c649442b80214a945e76ed50d26940

  • C:\Users\Admin\AppData\Local\Temp\q9y197755_1.exe

    MD5

    3fad84ee18e4583656019ae08b317607

    SHA1

    fb719a92039d2892fc6a7d91de15454554215543

    SHA256

    273811e7b3de14abc8cfbbb28be4ab3c39922ff09c869f1a4b6b357577f0d374

    SHA512

    496d0359641b844042af175ce4bda3801150af9ee720fad8d43a6a7cdf6ab4de96ac263525aa1c36dec89be71a71ce9f28b5a0017798b5c40ef8d2602bf66378

  • C:\Users\Admin\AppData\Local\Temp\q9y197755_1.exe

    MD5

    3fad84ee18e4583656019ae08b317607

    SHA1

    fb719a92039d2892fc6a7d91de15454554215543

    SHA256

    273811e7b3de14abc8cfbbb28be4ab3c39922ff09c869f1a4b6b357577f0d374

    SHA512

    496d0359641b844042af175ce4bda3801150af9ee720fad8d43a6a7cdf6ab4de96ac263525aa1c36dec89be71a71ce9f28b5a0017798b5c40ef8d2602bf66378

  • \Users\Admin\AppData\Local\Temp\Costura\1ACF592E7018DA88DDC32B96D203A4BE\32\sqlite3.dll

    MD5

    0a855f27a1e48991d14c593cb930d2b2

    SHA1

    01935b77a59ab90be4af37bb4e8bc57fbdcf23a1

    SHA256

    43d11ddfa64be9a2eeb94574f21fd45334e4598506f3d5ae1446c7a0add10300

    SHA512

    bfc680d50d043c438c0c4bc97f7830010bf302e9e81296c57b1a06e3e87a2000444e44fadec20ca2025260bf745629971bfca02ff59469085fc7eada7912e873

  • memory/728-57-0x000002366C0C8000-0x000002366C0C9000-memory.dmp

    Filesize

    4KB

  • memory/728-40-0x000002366C0C3000-0x000002366C0C5000-memory.dmp

    Filesize

    8KB

  • memory/728-39-0x000002366C0C0000-0x000002366C0C2000-memory.dmp

    Filesize

    8KB

  • memory/728-48-0x000002366C0C6000-0x000002366C0C8000-memory.dmp

    Filesize

    8KB

  • memory/728-32-0x00007FFA00610000-0x00007FFA00FFC000-memory.dmp

    Filesize

    9.9MB

  • memory/728-28-0x0000000000000000-mapping.dmp

  • memory/1020-27-0x0000000000000000-mapping.dmp

  • memory/1020-49-0x0000022E7C246000-0x0000022E7C248000-memory.dmp

    Filesize

    8KB

  • memory/1020-43-0x0000022E7C243000-0x0000022E7C245000-memory.dmp

    Filesize

    8KB

  • memory/1020-45-0x0000022E7E500000-0x0000022E7E501000-memory.dmp

    Filesize

    4KB

  • memory/1020-41-0x0000022E7C240000-0x0000022E7C242000-memory.dmp

    Filesize

    8KB

  • memory/1020-58-0x0000022E7C248000-0x0000022E7C249000-memory.dmp

    Filesize

    4KB

  • memory/1020-30-0x00007FFA00610000-0x00007FFA00FFC000-memory.dmp

    Filesize

    9.9MB

  • memory/1304-18-0x0000000000000000-mapping.dmp

  • memory/2612-4-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2612-3-0x00000000004015C6-mapping.dmp

  • memory/2612-2-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2612-6-0x00000000005B0000-0x00000000005BD000-memory.dmp

    Filesize

    52KB

  • memory/2612-15-0x00000000027A0000-0x00000000027A1000-memory.dmp

    Filesize

    4KB

  • memory/2612-7-0x0000000002780000-0x0000000002781000-memory.dmp

    Filesize

    4KB

  • memory/2612-8-0x00000000027B0000-0x00000000027BC000-memory.dmp

    Filesize

    48KB

  • memory/2612-5-0x0000000002280000-0x00000000022E6000-memory.dmp

    Filesize

    408KB

  • memory/2744-50-0x000001D273486000-0x000001D273488000-memory.dmp

    Filesize

    8KB

  • memory/2744-31-0x00007FFA00610000-0x00007FFA00FFC000-memory.dmp

    Filesize

    9.9MB

  • memory/2744-42-0x000001D273480000-0x000001D273482000-memory.dmp

    Filesize

    8KB

  • memory/2744-59-0x000001D273488000-0x000001D273489000-memory.dmp

    Filesize

    4KB

  • memory/2744-26-0x0000000000000000-mapping.dmp

  • memory/2744-44-0x000001D273483000-0x000001D273485000-memory.dmp

    Filesize

    8KB

  • memory/3684-29-0x0000000000000000-mapping.dmp

  • memory/3684-38-0x000002F1F1F93000-0x000002F1F1F95000-memory.dmp

    Filesize

    8KB

  • memory/3684-33-0x00007FFA00610000-0x00007FFA00FFC000-memory.dmp

    Filesize

    9.9MB

  • memory/3684-34-0x000002F1F19E0000-0x000002F1F19E1000-memory.dmp

    Filesize

    4KB

  • memory/3684-37-0x000002F1F1F90000-0x000002F1F1F92000-memory.dmp

    Filesize

    8KB

  • memory/3684-56-0x000002F1F1F98000-0x000002F1F1F99000-memory.dmp

    Filesize

    4KB

  • memory/3684-51-0x000002F1F1F96000-0x000002F1F1F98000-memory.dmp

    Filesize

    8KB

  • memory/3728-21-0x0000000000000000-mapping.dmp

  • memory/3832-17-0x0000000005170000-0x0000000005172000-memory.dmp

    Filesize

    8KB

  • memory/3832-11-0x0000000000E80000-0x0000000000F9B000-memory.dmp

    Filesize

    1.1MB

  • memory/3832-10-0x0000000001340000-0x0000000001780000-memory.dmp

    Filesize

    4.2MB

  • memory/3832-9-0x0000000000000000-mapping.dmp

  • memory/4204-60-0x0000000000000000-mapping.dmp

  • memory/4204-63-0x0000000002980000-0x0000000002981000-memory.dmp

    Filesize

    4KB