Analysis

  • max time kernel
    151s
  • max time network
    100s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    19-05-2021 09:02

General

  • Target

    f7e4a28f_by_Libranalysis.exe

  • Size

    3.5MB

  • MD5

    f7e4a28f1ed37123d6e0851e573cd640

  • SHA1

    8068ea253bafbdbdf2647f264d5a8d5405e8772c

  • SHA256

    3a2c441a96936c089c1444f4cd50436593fcd43a18c80a1699fc6b2d62dd6907

  • SHA512

    5a370cb4c0e592141dea9c6b2494548105ad108666353f383e06253171df988781dab6c19bebafb5d1107348ffec92cd329cad4aef02ad974eda258b0d4f531d

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs
  • Sets file to hidden 1 TTPs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 5 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: MapViewOfSection 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1288
      • C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe
        "C:\Users\Admin\AppData\Local\Temp\f7e4a28f_by_Libranalysis.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1084
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\site1\conf\pe.vbs"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1668
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c ""C:\site1\conf\uiy.bat" "
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:600
            • C:\Windows\SysWOW64\timeout.exe
              timeout 0
              5⤵
              • Delays execution with timeout.exe
              PID:320
            • C:\Windows\SysWOW64\PING.EXE
              ping dhgfg sgudy
              5⤵
              • Runs ping.exe
              PID:1472
            • C:\site1\conf\csvr.exe
              "csvr.exe" e -p1vartanderkoolermaster lol.rar
              5⤵
              • Executes dropped EXE
              PID:436
            • C:\Windows\SysWOW64\timeout.exe
              timeout 6
              5⤵
              • Delays execution with timeout.exe
              PID:620
            • C:\Windows\SysWOW64\WScript.exe
              "C:\Windows\System32\WScript.exe" "C:\site1\conf\biling.vbs"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:956
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\site1\conf\site.bat" "
                6⤵
                • Loads dropped DLL
                • Suspicious use of WriteProcessMemory
                PID:1248
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +s +h "C:\site1\conf"
                  7⤵
                  • Views/modifies file attributes
                  PID:652
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 2
                  7⤵
                  • Delays execution with timeout.exe
                  PID:1664
                • C:\site1\conf\psi.exe
                  psi.exe /start
                  7⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:788
                  • C:\site1\conf\psi.exe
                    psi.exe /start
                    8⤵
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Checks processor information in registry
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1620
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      9⤵
                      • Modifies firewall policy service
                      • Checks BIOS information in registry
                      • Adds Run key to start application
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      • Modifies Internet Explorer Protected Mode
                      • Modifies Internet Explorer Protected Mode Banner
                      • Modifies Internet Explorer settings
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of AdjustPrivilegeToken
                      PID:436
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im csvr.exe
                  7⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1816
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im csvr.exe
                  7⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:300
                • C:\Windows\SysWOW64\attrib.exe
                  attrib -s -h "C:\site1\conf\psi.exe"
                  7⤵
                  • Views/modifies file attributes
                  PID:1096
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 4
                  7⤵
                  • Delays execution with timeout.exe
                  PID:1472
            • C:\Windows\SysWOW64\timeout.exe
              timeout 7
              5⤵
              • Delays execution with timeout.exe
              PID:932
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1236
      • C:\Windows\system32\conhost.exe
        \??\C:\Windows\system32\conhost.exe "547576083-18759072821432890865-4388350321311224841-69428211218999539241440614081"
        1⤵
          PID:768
        • C:\Windows\system32\conhost.exe
          \??\C:\Windows\system32\conhost.exe "-7186537421808627365269649056-1381997941791124636-183576623010413814991902985042"
          1⤵
            PID:980
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
            1⤵
              PID:2020

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\site1\conf\8rt.jog

              MD5

              e349fbe030e2524e041f3f60d110b7c7

              SHA1

              763bfa5803bda9d740ff2e31c350e745397308f9

              SHA256

              47a1389daec3f031b2232e7e0dcec00b84f0e4e83bff64ccdcd6b9dbd41e64d8

              SHA512

              ed583faa84bae3f70b0acf89f7b6da08b34633a0bcb766480375ce18c5a26bb15891406f3657eacbb6367d14c97a79bbbdddc39fcb6410eeec33735b34b10129

            • C:\site1\conf\biling.vbs

              MD5

              70f8a68b9e1e00708c64e1d1fec715f4

              SHA1

              63247e2afb4b30892d1d23a903393043abc5a214

              SHA256

              04cff1c0dbbc09f19df77f4b1d2481440c7f408260e95e661ec33ee542bf3cd7

              SHA512

              dd49ac3beefd21484a6e90d8a9d250e63cd2e78bd7fe3916a668316d6b84ec47bb3e6ba680e5a13200e68648d508da0fa5ee4294c425d3f041cee60e86ef4501

            • C:\site1\conf\csvr.exe

              MD5

              397a93800d56a2308bffc872d4a08032

              SHA1

              6f5334d51195a521e8a03f0e05ac777b96c77bc4

              SHA256

              efe3abcfde6e9846a99049a68e6a38d0bc42baa3ac1cf6f236c894abef0a7720

              SHA512

              7fc7b6c8ffe640295085cab4e56ba4c3eea9738a2c9fa27d1032fd60bb3a638e93cd2522058b6212dd7237366510a83c7d1d9b3cbd5f9712852c72959ace53eb

            • C:\site1\conf\csvr.exe

              MD5

              397a93800d56a2308bffc872d4a08032

              SHA1

              6f5334d51195a521e8a03f0e05ac777b96c77bc4

              SHA256

              efe3abcfde6e9846a99049a68e6a38d0bc42baa3ac1cf6f236c894abef0a7720

              SHA512

              7fc7b6c8ffe640295085cab4e56ba4c3eea9738a2c9fa27d1032fd60bb3a638e93cd2522058b6212dd7237366510a83c7d1d9b3cbd5f9712852c72959ace53eb

            • C:\site1\conf\pe.vbs

              MD5

              b022334d0c60338f90e47e2478873d7a

              SHA1

              19c094781ad40ef0efa617cb1fb92d127bdecb7b

              SHA256

              c95053b468dd6b1623432f7676b81bbb43480959537da737fe270f4a8d195ca3

              SHA512

              34e9bc989e52a53e96a6d0e9c11b5d3c8367f3c16ef73101d63dfc3a9464d559430717df109d32dd1dfcdc67763e8824699701785787cbf0a6a38fdf20a7b16c

            • C:\site1\conf\psi.exe

              MD5

              7c1588678299109e5bdf37f40102ef99

              SHA1

              f1e513bef9fc691d5f2eba139c6805e32f5268ee

              SHA256

              a760c1fe14b0202ba3ec08ea035a003600930a61672a1741210580807c7f2d78

              SHA512

              6ba93ae483503abce54c013a31624d5b96b7bbf5726cdcb9a7665736732f8f68a498e336767609025595c685b793849571030f90e5690534c7d630c7c89931c7

            • C:\site1\conf\psi.exe

              MD5

              7c1588678299109e5bdf37f40102ef99

              SHA1

              f1e513bef9fc691d5f2eba139c6805e32f5268ee

              SHA256

              a760c1fe14b0202ba3ec08ea035a003600930a61672a1741210580807c7f2d78

              SHA512

              6ba93ae483503abce54c013a31624d5b96b7bbf5726cdcb9a7665736732f8f68a498e336767609025595c685b793849571030f90e5690534c7d630c7c89931c7

            • C:\site1\conf\psi.exe

              MD5

              7c1588678299109e5bdf37f40102ef99

              SHA1

              f1e513bef9fc691d5f2eba139c6805e32f5268ee

              SHA256

              a760c1fe14b0202ba3ec08ea035a003600930a61672a1741210580807c7f2d78

              SHA512

              6ba93ae483503abce54c013a31624d5b96b7bbf5726cdcb9a7665736732f8f68a498e336767609025595c685b793849571030f90e5690534c7d630c7c89931c7

            • C:\site1\conf\site.bat

              MD5

              8b653c0a3c307777b9cdc2ec28aac98b

              SHA1

              936f2c75461b8a98b55e4d88ccc3e41088e2d584

              SHA256

              f37a565dfd33a94efbb04d04bd8dd1f60b1d42bc9427d3fff4060b51fd318e2f

              SHA512

              16ca9304fea272ec3b3539024df6496119d26774812f9b0119acef33b2837fa60a91ef0389c84718c51a3483339be671dc548904b39bc35057d868c7e0452cdf

            • C:\site1\conf\uiy.bat

              MD5

              f6eb567c6e72344762fe0f1e4223990b

              SHA1

              9a200a0c123c22cbca10e6d16f97eeb63835ab2d

              SHA256

              2ab47d3082c64105d769c62bf96a8c5d05cd19dba6d7728da291041dbeea4a65

              SHA512

              0f49fef4d52d192ece9d228df8fd3acdf9c801c9f6039c0aa6c717d8710a87c41593fbfe1aa2ce45806f5dcd4e8c12562e2a2a20734a16fab88dc661dacd4805

            • \site1\conf\csvr.exe

              MD5

              397a93800d56a2308bffc872d4a08032

              SHA1

              6f5334d51195a521e8a03f0e05ac777b96c77bc4

              SHA256

              efe3abcfde6e9846a99049a68e6a38d0bc42baa3ac1cf6f236c894abef0a7720

              SHA512

              7fc7b6c8ffe640295085cab4e56ba4c3eea9738a2c9fa27d1032fd60bb3a638e93cd2522058b6212dd7237366510a83c7d1d9b3cbd5f9712852c72959ace53eb

            • \site1\conf\psi.exe

              MD5

              7c1588678299109e5bdf37f40102ef99

              SHA1

              f1e513bef9fc691d5f2eba139c6805e32f5268ee

              SHA256

              a760c1fe14b0202ba3ec08ea035a003600930a61672a1741210580807c7f2d78

              SHA512

              6ba93ae483503abce54c013a31624d5b96b7bbf5726cdcb9a7665736732f8f68a498e336767609025595c685b793849571030f90e5690534c7d630c7c89931c7

            • \site1\conf\psi.exe

              MD5

              7c1588678299109e5bdf37f40102ef99

              SHA1

              f1e513bef9fc691d5f2eba139c6805e32f5268ee

              SHA256

              a760c1fe14b0202ba3ec08ea035a003600930a61672a1741210580807c7f2d78

              SHA512

              6ba93ae483503abce54c013a31624d5b96b7bbf5726cdcb9a7665736732f8f68a498e336767609025595c685b793849571030f90e5690534c7d630c7c89931c7

            • memory/300-94-0x0000000000000000-mapping.dmp

            • memory/320-67-0x0000000000000000-mapping.dmp

            • memory/436-115-0x00000000009E0000-0x0000000000A60000-memory.dmp

              Filesize

              512KB

            • memory/436-71-0x0000000000000000-mapping.dmp

            • memory/436-103-0x0000000000000000-mapping.dmp

            • memory/436-105-0x00000000746C1000-0x00000000746C3000-memory.dmp

              Filesize

              8KB

            • memory/436-107-0x00000000000D0000-0x00000000001F6000-memory.dmp

              Filesize

              1.1MB

            • memory/436-106-0x00000000776F0000-0x0000000077870000-memory.dmp

              Filesize

              1.5MB

            • memory/436-110-0x0000000000530000-0x0000000000531000-memory.dmp

              Filesize

              4KB

            • memory/436-112-0x0000000000540000-0x000000000054C000-memory.dmp

              Filesize

              48KB

            • memory/600-65-0x0000000000000000-mapping.dmp

            • memory/620-74-0x0000000000000000-mapping.dmp

            • memory/652-82-0x0000000000000000-mapping.dmp

            • memory/788-87-0x0000000000000000-mapping.dmp

            • memory/932-78-0x0000000000000000-mapping.dmp

            • memory/956-77-0x0000000000000000-mapping.dmp

            • memory/1084-60-0x0000000000250000-0x0000000000251000-memory.dmp

              Filesize

              4KB

            • memory/1084-59-0x00000000752F1000-0x00000000752F3000-memory.dmp

              Filesize

              8KB

            • memory/1096-95-0x0000000000000000-mapping.dmp

            • memory/1248-114-0x0000000002080000-0x00000000021A6000-memory.dmp

              Filesize

              1.1MB

            • memory/1248-81-0x0000000000000000-mapping.dmp

            • memory/1288-116-0x0000000002CA0000-0x0000000002CA6000-memory.dmp

              Filesize

              24KB

            • memory/1472-96-0x0000000000000000-mapping.dmp

            • memory/1472-68-0x0000000000000000-mapping.dmp

            • memory/1620-97-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/1620-102-0x0000000001DD0000-0x0000000001DDC000-memory.dmp

              Filesize

              48KB

            • memory/1620-99-0x00000000001C0000-0x00000000001C1000-memory.dmp

              Filesize

              4KB

            • memory/1620-100-0x00000000001D0000-0x00000000001DD000-memory.dmp

              Filesize

              52KB

            • memory/1620-101-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

              Filesize

              4KB

            • memory/1620-98-0x0000000001CB0000-0x0000000001D16000-memory.dmp

              Filesize

              408KB

            • memory/1620-90-0x00000000004015C6-mapping.dmp

            • memory/1620-89-0x0000000000400000-0x0000000000435000-memory.dmp

              Filesize

              212KB

            • memory/1664-83-0x0000000000000000-mapping.dmp

            • memory/1668-61-0x0000000000000000-mapping.dmp

            • memory/1816-93-0x0000000000000000-mapping.dmp