Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    18-04-2021 05:50

General

  • Target

    6EC77929D5F70F9BC4724D23DDBC2653.exe

  • Size

    838KB

  • MD5

    6ec77929d5f70f9bc4724d23ddbc2653

  • SHA1

    da208bfa51ed091056f03dff8f1ba540472210d8

  • SHA256

    03e3837f16d46a1a0a13904fae467c105b1aae66b382e8313b20b90269e53ed6

  • SHA512

    370d956fb270a6f136a85983542195414790b116dd4166d448b7c55c9846e18959758117cd399196c62c51f1817a2e633e2e95d10565c4858250f7162f0ddfe6

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Executes dropped EXE 5 IoCs
  • Sets file execution options in registry 2 TTPs
  • Sets file to hidden 1 TTPs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 5 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe
    "C:\Users\Admin\AppData\Local\Temp\6EC77929D5F70F9BC4724D23DDBC2653.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:784
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\booking\data\startbook.vbs" /f=CREATE_NO_WINDOW install.cmd
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:200
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\booking\data\start1.bat" "
        3⤵
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4092
        • C:\Windows\SysWOW64\timeout.exe
          timeout 7
          4⤵
          • Delays execution with timeout.exe
          PID:3708
        • C:\booking\data\K480101741BH.exe
          "K480101741BH.exe" e -psetup wid.rar
          4⤵
          • Executes dropped EXE
          PID:3856
        • C:\Windows\SysWOW64\timeout.exe
          timeout 6
          4⤵
          • Delays execution with timeout.exe
          PID:2528
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\booking\data\fbk.vbs"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2844
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\booking\data\445.bat" "
            5⤵
            • Checks whether UAC is enabled
            • Suspicious use of WriteProcessMemory
            PID:1456
            • C:\Windows\SysWOW64\attrib.exe
              attrib +s +h "C:\booking"
              6⤵
              • Views/modifies file attributes
              PID:3712
            • C:\Windows\SysWOW64\timeout.exe
              timeout 2
              6⤵
              • Delays execution with timeout.exe
              PID:3532
            • C:\booking\data\modylsid.exe
              modylsid.exe /start
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:932
              • C:\booking\data\modylsid.exe
                modylsid.exe /start
                7⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Checks processor information in registry
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2660
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  8⤵
                  • Modifies firewall policy service
                  • Checks BIOS information in registry
                  • Adds Run key to start application
                  • Drops desktop.ini file(s)
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Modifies Internet Explorer Protected Mode
                  • Modifies Internet Explorer Protected Mode Banner
                  • Modifies Internet Explorer settings
                  • NTFS ADS
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2464
                  • C:\Users\Admin\AppData\Local\Temp\1s75i91qs3_1.exe
                    /suac
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:1352
                  • C:\Users\Admin\AppData\Local\Temp\959m3m1kk7o7aq1.exe
                    "C:\Users\Admin\AppData\Local\Temp\959m3m1kk7o7aq1.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2924
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\'
                      10⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2128
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'
                      10⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3164
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData\Google Updater 2.09\'
                      10⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3044
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'
                      10⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3856
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /f /im K480101741BH.exe
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3736
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /f /im K480101741BH.exe
              6⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2792
            • C:\Windows\SysWOW64\attrib.exe
              attrib -s -h "C:\booking\data"
              6⤵
              • Views/modifies file attributes
              PID:2384
            • C:\Windows\SysWOW64\timeout.exe
              timeout 4
              6⤵
              • Delays execution with timeout.exe
              PID:2324
        • C:\Windows\SysWOW64\timeout.exe
          timeout 8
          4⤵
          • Delays execution with timeout.exe
          PID:2848

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    MD5

    8592ba100a78835a6b94d5949e13dfc1

    SHA1

    63e901200ab9a57c7dd4c078d7f75dcd3b357020

    SHA256

    fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

    SHA512

    87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    31f894d386c4374ba64eacfd1ab2b47f

    SHA1

    72181aca9d0cdc4232cf75f5275afc136b1e1aa4

    SHA256

    8e66dd7b34130dba19567a5cf542c750400c582325e97e26e74e02e6be13baf2

    SHA512

    c669fcc5fdc4ecc08cdebd0188aa81df9cc202be5f7174a56288cf7771a8fbbb3be3e07145d8c329f60a6ee354506fc81893c5130a8fb34785069597c789256c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    31f894d386c4374ba64eacfd1ab2b47f

    SHA1

    72181aca9d0cdc4232cf75f5275afc136b1e1aa4

    SHA256

    8e66dd7b34130dba19567a5cf542c750400c582325e97e26e74e02e6be13baf2

    SHA512

    c669fcc5fdc4ecc08cdebd0188aa81df9cc202be5f7174a56288cf7771a8fbbb3be3e07145d8c329f60a6ee354506fc81893c5130a8fb34785069597c789256c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    759ef4704efebb1d21ecebc379a0b999

    SHA1

    271572feece625083caf1d1418ee90e55aaf2b3b

    SHA256

    faafdb35e42dad41e7a052804d093529d094a2cd0b94b85ec45099605790a666

    SHA512

    6081a208946d31ebc7d0ae9f58944584bd43f44712b8daf82209c75dbf7b4713a8eb048ef27af6eec57ed5754b8ffae214784f09be6e24ea2890936064db9a40

  • C:\Users\Admin\AppData\Local\Temp\1s75i91qs3_1.exe

    MD5

    3b65b072503385254773acf8b3192a7e

    SHA1

    50b06faf9b45ca1fbb3d30d8c0974a153d17855b

    SHA256

    e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70

    SHA512

    8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

  • C:\Users\Admin\AppData\Local\Temp\1s75i91qs3_1.exe

    MD5

    3b65b072503385254773acf8b3192a7e

    SHA1

    50b06faf9b45ca1fbb3d30d8c0974a153d17855b

    SHA256

    e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70

    SHA512

    8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

  • C:\Users\Admin\AppData\Local\Temp\959m3m1kk7o7aq1.exe

    MD5

    85f0fb9dafac47fb151d2a33f6556112

    SHA1

    0e021df3e0a91983c34bc9620bbcd6c9aa74edd7

    SHA256

    fea0fdad9f440f68feb5c3b6f4952a952375397a6220c253fe7d3eeb15523397

    SHA512

    1a11801302042dde8706cb0a0f6ad27650d74396bf270bc0a0cc3969370d2324de20f46c4a619b6f275586e87fe489b80dfe69c70712c175c881740a14bfa9b1

  • C:\Users\Admin\AppData\Local\Temp\959m3m1kk7o7aq1.exe

    MD5

    85f0fb9dafac47fb151d2a33f6556112

    SHA1

    0e021df3e0a91983c34bc9620bbcd6c9aa74edd7

    SHA256

    fea0fdad9f440f68feb5c3b6f4952a952375397a6220c253fe7d3eeb15523397

    SHA512

    1a11801302042dde8706cb0a0f6ad27650d74396bf270bc0a0cc3969370d2324de20f46c4a619b6f275586e87fe489b80dfe69c70712c175c881740a14bfa9b1

  • C:\booking\data\445.bat

    MD5

    3c4875cff185c701a9f28f58ead13d33

    SHA1

    7585bca806fdeb727177c3fba6c371aa8d9c2951

    SHA256

    ad8c7a4cc068b36c5227b9076fe60e0529f080a6a849f8764750e2c173a0bf96

    SHA512

    ad9404fad164a57eb9577ff2569f5e237901d2a03059267d032d5b853dd2d8f5bf50375c981baf2064ee3b0b9cb8929eccc32c920843bba43fb4f7cdde7cd972

  • C:\booking\data\K480101741BH.exe

    MD5

    061f64173293969577916832be29b90d

    SHA1

    b05b80385de20463a80b6c9c39bd1d53123aab9b

    SHA256

    34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce

    SHA512

    66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

  • C:\booking\data\K480101741BH.exe

    MD5

    061f64173293969577916832be29b90d

    SHA1

    b05b80385de20463a80b6c9c39bd1d53123aab9b

    SHA256

    34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce

    SHA512

    66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

  • C:\booking\data\fbk.vbs

    MD5

    12c302b2a7afa9d52bbc04875144319f

    SHA1

    5c5b5a2024a0f2838a0d94268282ad95ba388b25

    SHA256

    3e8e92c822501efaae4e4ae0c4e63d6822bc5aa5e2178ab5f5cf6bb74c77e283

    SHA512

    18b197db47f2bb2853de592a672a321f4188722eb48fd6165f9bc6d9f3dfe69dff2c0fdc49f9e5cfe939722c9ce47dd5dc31424619660c6e745122f5590a022f

  • C:\booking\data\lip

    MD5

    f75ae8515bc7bc47354f22b6b4f20046

    SHA1

    03b1dc027bac21b149337e07d2d1f4af363cb6f4

    SHA256

    2e5c9d234c85488239cc3c55ed2053ae166222bdb668defe9c3bd0d93ece632a

    SHA512

    cdd90aaed29aac6e91fcb964480379e0e114b363c5e286d51e22ea1e617364319989143b205298dd15e875d8f349f2bec54001480e31d01acbb95e4eeaaad255

  • C:\booking\data\modylsid.exe

    MD5

    3b65b072503385254773acf8b3192a7e

    SHA1

    50b06faf9b45ca1fbb3d30d8c0974a153d17855b

    SHA256

    e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70

    SHA512

    8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

  • C:\booking\data\modylsid.exe

    MD5

    3b65b072503385254773acf8b3192a7e

    SHA1

    50b06faf9b45ca1fbb3d30d8c0974a153d17855b

    SHA256

    e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70

    SHA512

    8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

  • C:\booking\data\modylsid.exe

    MD5

    3b65b072503385254773acf8b3192a7e

    SHA1

    50b06faf9b45ca1fbb3d30d8c0974a153d17855b

    SHA256

    e28c66491d701757a7b370aae235521e5e409edc45a1a90b544b4fb704324f70

    SHA512

    8b5203cfe8b2413f5678c6ca999ae6a8f6ec5328dc74994d334e47e80cc6f51d3a4aa6efe5940b124fc5630a71ee85c15102f45f22a631a4c8deb4dc7d825b20

  • C:\booking\data\start1.bat

    MD5

    0ccf45b2c7aad8f25d8a8f3a6ff7b620

    SHA1

    7785a6d2b22a8b64dd549bc0a8a08a85b6404525

    SHA256

    8df03bfad7860d4f609e48de215c6f40fbb0de78bdaeb08fdf3409e722585efb

    SHA512

    3fb8dd5fa9cdbb59d5d195e66f6108954c4a89b358a2f75bbb6e03739a67965ead3d91a24a648a4204fc32c6d753815e4cf98e17a2fdc5913704c28fdb159f6c

  • C:\booking\data\startbook.vbs

    MD5

    594e0cb7f4486880945b986f1adf9f49

    SHA1

    8155f7be615cd60017a1af07aac17801de2a64ba

    SHA256

    265d486a8fac96e0c3ce1309c50bcb88b0a37f739e533ed92483fe66b946c220

    SHA512

    3093b6e45fc17654e2419b08d6519dd891afd1672bcf6e61c77dca19258ae8bf7d46db98facb38e0a27527cae865a8d1445d8546be78af6cbc465e5fd56d87c4

  • memory/200-114-0x0000000000000000-mapping.dmp

  • memory/932-130-0x0000000000000000-mapping.dmp

  • memory/1352-157-0x0000000000000000-mapping.dmp

  • memory/1456-154-0x0000000003B20000-0x0000000003C46000-memory.dmp

    Filesize

    1.1MB

  • memory/1456-127-0x0000000000000000-mapping.dmp

  • memory/2128-183-0x00000213FC710000-0x00000213FC712000-memory.dmp

    Filesize

    8KB

  • memory/2128-185-0x00000213FC713000-0x00000213FC715000-memory.dmp

    Filesize

    8KB

  • memory/2128-193-0x00000213FD200000-0x00000213FD201000-memory.dmp

    Filesize

    4KB

  • memory/2128-165-0x0000000000000000-mapping.dmp

  • memory/2128-241-0x00000213FC716000-0x00000213FC718000-memory.dmp

    Filesize

    8KB

  • memory/2128-247-0x00000213FC718000-0x00000213FC719000-memory.dmp

    Filesize

    4KB

  • memory/2324-144-0x0000000000000000-mapping.dmp

  • memory/2384-143-0x0000000000000000-mapping.dmp

  • memory/2464-145-0x0000000000000000-mapping.dmp

  • memory/2464-146-0x0000000000E80000-0x00000000012BF000-memory.dmp

    Filesize

    4.2MB

  • memory/2464-147-0x0000000000460000-0x0000000000586000-memory.dmp

    Filesize

    1.1MB

  • memory/2464-148-0x0000000000CF0000-0x0000000000CFD000-memory.dmp

    Filesize

    52KB

  • memory/2464-156-0x0000000006040000-0x0000000006042000-memory.dmp

    Filesize

    8KB

  • memory/2528-122-0x0000000000000000-mapping.dmp

  • memory/2660-133-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2660-134-0x00000000004015C6-mapping.dmp

  • memory/2660-151-0x0000000002650000-0x0000000002651000-memory.dmp

    Filesize

    4KB

  • memory/2660-142-0x0000000002660000-0x000000000266C000-memory.dmp

    Filesize

    48KB

  • memory/2660-139-0x0000000002180000-0x00000000021E6000-memory.dmp

    Filesize

    408KB

  • memory/2660-141-0x0000000002630000-0x0000000002631000-memory.dmp

    Filesize

    4KB

  • memory/2660-140-0x0000000000440000-0x00000000004EE000-memory.dmp

    Filesize

    696KB

  • memory/2660-138-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/2792-137-0x0000000000000000-mapping.dmp

  • memory/2844-124-0x0000000000000000-mapping.dmp

  • memory/2848-125-0x0000000000000000-mapping.dmp

  • memory/2924-161-0x0000000000000000-mapping.dmp

  • memory/3044-167-0x0000000000000000-mapping.dmp

  • memory/3044-189-0x0000018538DF3000-0x0000018538DF5000-memory.dmp

    Filesize

    8KB

  • memory/3044-246-0x0000018538DF8000-0x0000018538DF9000-memory.dmp

    Filesize

    4KB

  • memory/3044-240-0x0000018538DF6000-0x0000018538DF8000-memory.dmp

    Filesize

    8KB

  • memory/3044-203-0x0000018551E00000-0x0000018551E01000-memory.dmp

    Filesize

    4KB

  • memory/3044-188-0x0000018538DF0000-0x0000018538DF2000-memory.dmp

    Filesize

    8KB

  • memory/3164-238-0x000002216FED6000-0x000002216FED8000-memory.dmp

    Filesize

    8KB

  • memory/3164-180-0x000002216FED3000-0x000002216FED5000-memory.dmp

    Filesize

    8KB

  • memory/3164-166-0x0000000000000000-mapping.dmp

  • memory/3164-249-0x000002216FED8000-0x000002216FED9000-memory.dmp

    Filesize

    4KB

  • memory/3164-178-0x000002216FED0000-0x000002216FED2000-memory.dmp

    Filesize

    8KB

  • memory/3532-129-0x0000000000000000-mapping.dmp

  • memory/3708-118-0x0000000000000000-mapping.dmp

  • memory/3712-128-0x0000000000000000-mapping.dmp

  • memory/3736-136-0x0000000000000000-mapping.dmp

  • memory/3856-218-0x000001FF68DD3000-0x000001FF68DD5000-memory.dmp

    Filesize

    8KB

  • memory/3856-239-0x000001FF68DD6000-0x000001FF68DD8000-memory.dmp

    Filesize

    8KB

  • memory/3856-168-0x0000000000000000-mapping.dmp

  • memory/3856-120-0x0000000000000000-mapping.dmp

  • memory/3856-248-0x000001FF68DD8000-0x000001FF68DD9000-memory.dmp

    Filesize

    4KB

  • memory/3856-217-0x000001FF68DD0000-0x000001FF68DD2000-memory.dmp

    Filesize

    8KB

  • memory/4092-117-0x0000000000000000-mapping.dmp

  • memory/4092-155-0x00000000050E0000-0x0000000005206000-memory.dmp

    Filesize

    1.1MB