Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    22-03-2021 15:28

General

  • Target

    6A1B1BD71C348B1701B67555A2AC314D.exe

  • Size

    829KB

  • MD5

    6a1b1bd71c348b1701b67555a2ac314d

  • SHA1

    cb6241cc299e72b22035b3a2d15063e93622c409

  • SHA256

    4241044fce8bace299a5a348c736970be1c89ecaf3aa0f28533486c915b8e1c1

  • SHA512

    315cdc82eeb209c2b5f60b1c1b9b8827f9a8be81db633f832735347f5828d149d0559cd69be2891df333bd2b605dcc7c912d5772b0476b4e2250bcb92ed99022

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1260
      • C:\Users\Admin\AppData\Local\Temp\6A1B1BD71C348B1701B67555A2AC314D.exe
        "C:\Users\Admin\AppData\Local\Temp\6A1B1BD71C348B1701B67555A2AC314D.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:892
        • C:\Users\Admin\AppData\Local\Temp\6A1B1BD71C348B1701B67555A2AC314D.exe
          "C:\Users\Admin\AppData\Local\Temp\6A1B1BD71C348B1701B67555A2AC314D.exe"
          3⤵
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Suspicious behavior: MapViewOfSection
          • Suspicious behavior: RenamesItself
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:872
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            4⤵
            • Modifies firewall policy service
            • Checks BIOS information in registry
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Enumerates system info in registry
            • Modifies Internet Explorer Protected Mode
            • Modifies Internet Explorer Protected Mode Banner
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1520
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1228
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:1884
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 1884 -s 428
            2⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1484

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/872-7-0x0000000000320000-0x0000000000321000-memory.dmp

          Filesize

          4KB

        • memory/872-20-0x00000000024D0000-0x00000000024D1000-memory.dmp

          Filesize

          4KB

        • memory/872-4-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

          Filesize

          8KB

        • memory/872-5-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/872-6-0x0000000000230000-0x0000000000296000-memory.dmp

          Filesize

          408KB

        • memory/872-8-0x0000000000370000-0x000000000037D000-memory.dmp

          Filesize

          52KB

        • memory/872-3-0x00000000004015C6-mapping.dmp

        • memory/872-9-0x00000000007C0000-0x00000000007C1000-memory.dmp

          Filesize

          4KB

        • memory/872-2-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/872-10-0x00000000024E0000-0x00000000024EC000-memory.dmp

          Filesize

          48KB

        • memory/1260-28-0x0000000002C20000-0x0000000002C26000-memory.dmp

          Filesize

          24KB

        • memory/1484-27-0x0000000002370000-0x0000000002371000-memory.dmp

          Filesize

          4KB

        • memory/1484-25-0x0000000001F60000-0x0000000001F71000-memory.dmp

          Filesize

          68KB

        • memory/1484-24-0x000007FEFBB21000-0x000007FEFBB23000-memory.dmp

          Filesize

          8KB

        • memory/1520-13-0x00000000749F1000-0x00000000749F3000-memory.dmp

          Filesize

          8KB

        • memory/1520-22-0x00000000008B0000-0x00000000008B2000-memory.dmp

          Filesize

          8KB

        • memory/1520-15-0x00000000000F0000-0x0000000000229000-memory.dmp

          Filesize

          1.2MB

        • memory/1520-19-0x0000000000830000-0x000000000083C000-memory.dmp

          Filesize

          48KB

        • memory/1520-14-0x00000000774B0000-0x0000000077631000-memory.dmp

          Filesize

          1.5MB

        • memory/1520-11-0x0000000000000000-mapping.dmp

        • memory/1884-23-0x000007FEF61D0000-0x000007FEF644A000-memory.dmp

          Filesize

          2.5MB

        • memory/1884-26-0x0000000001EE0000-0x0000000001EE6000-memory.dmp

          Filesize

          24KB