Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    20-05-2021 00:31

General

  • Target

    1.exe

  • Size

    802KB

  • MD5

    a3a799eb1435896baea3a8e079c8dd02

  • SHA1

    cb0ce4c57cd8e4561a88ce20e80888d097b00900

  • SHA256

    55c12cb22033e12af48c4bb80b660e4ace8ed2364e7147979e30355bab7d5469

  • SHA512

    7cf21f437cb33fb2fe03b496309509266db8863650d175072f57b278e96a82b508651cdbc61aa08334858ffe18e251039a3c3d421d97a3749ab21ae16c89a3d9

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1264
      • C:\Users\Admin\AppData\Local\Temp\1.exe
        "C:\Users\Admin\AppData\Local\Temp\1.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1088
        • C:\Users\Admin\AppData\Local\Temp\1.exe
          "C:\Users\Admin\AppData\Local\Temp\1.exe"
          3⤵
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Suspicious behavior: MapViewOfSection
          • Suspicious behavior: RenamesItself
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1904
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            4⤵
            • Modifies firewall policy service
            • Checks BIOS information in registry
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops desktop.ini file(s)
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Enumerates system info in registry
            • Modifies Internet Explorer Protected Mode
            • Modifies Internet Explorer Protected Mode Banner
            • Modifies Internet Explorer settings
            • NTFS ADS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1828
            • C:\Users\Admin\AppData\Local\Temp\y59c5um9gc_1.exe
              /suac
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:1072
            • C:\Users\Admin\AppData\Local\Temp\o1ea9q1cu15q7.exe
              "C:\Users\Admin\AppData\Local\Temp\o1ea9q1cu15q7.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:668
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1232
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:528

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\o1ea9q1cu15q7.exe

          MD5

          07f2ddc571ace474d3d7c0e5efd051a2

          SHA1

          ddb49e4e422c5a7a6e9db9c92776c2531bf10ca8

          SHA256

          4524311e34beb91833ab812e17dc231724539c892dfeacd24ccdd8c2951a1b8f

          SHA512

          4d453dfe4d4b642a71917efd75f2f4aebf8d3e964f3be589a643694d633ed5f7934c1a392559a264ba870746da122735dc7999ad4cc40d58f19a60d04e20ae3e

        • C:\Users\Admin\AppData\Local\Temp\y59c5um9gc_1.exe

          MD5

          a3a799eb1435896baea3a8e079c8dd02

          SHA1

          cb0ce4c57cd8e4561a88ce20e80888d097b00900

          SHA256

          55c12cb22033e12af48c4bb80b660e4ace8ed2364e7147979e30355bab7d5469

          SHA512

          7cf21f437cb33fb2fe03b496309509266db8863650d175072f57b278e96a82b508651cdbc61aa08334858ffe18e251039a3c3d421d97a3749ab21ae16c89a3d9

        • C:\Users\Admin\AppData\Local\Temp\y59c5um9gc_1.exe

          MD5

          a3a799eb1435896baea3a8e079c8dd02

          SHA1

          cb0ce4c57cd8e4561a88ce20e80888d097b00900

          SHA256

          55c12cb22033e12af48c4bb80b660e4ace8ed2364e7147979e30355bab7d5469

          SHA512

          7cf21f437cb33fb2fe03b496309509266db8863650d175072f57b278e96a82b508651cdbc61aa08334858ffe18e251039a3c3d421d97a3749ab21ae16c89a3d9

        • \Users\Admin\AppData\Local\Temp\o1ea9q1cu15q7.exe

          MD5

          07f2ddc571ace474d3d7c0e5efd051a2

          SHA1

          ddb49e4e422c5a7a6e9db9c92776c2531bf10ca8

          SHA256

          4524311e34beb91833ab812e17dc231724539c892dfeacd24ccdd8c2951a1b8f

          SHA512

          4d453dfe4d4b642a71917efd75f2f4aebf8d3e964f3be589a643694d633ed5f7934c1a392559a264ba870746da122735dc7999ad4cc40d58f19a60d04e20ae3e

        • \Users\Admin\AppData\Local\Temp\y59c5um9gc_1.exe

          MD5

          a3a799eb1435896baea3a8e079c8dd02

          SHA1

          cb0ce4c57cd8e4561a88ce20e80888d097b00900

          SHA256

          55c12cb22033e12af48c4bb80b660e4ace8ed2364e7147979e30355bab7d5469

          SHA512

          7cf21f437cb33fb2fe03b496309509266db8863650d175072f57b278e96a82b508651cdbc61aa08334858ffe18e251039a3c3d421d97a3749ab21ae16c89a3d9

        • memory/528-89-0x0000000003A60000-0x0000000003A66000-memory.dmp

          Filesize

          24KB

        • memory/668-85-0x0000000000000000-mapping.dmp

        • memory/1072-81-0x0000000000000000-mapping.dmp

        • memory/1264-90-0x0000000002A50000-0x0000000002A56000-memory.dmp

          Filesize

          24KB

        • memory/1828-79-0x0000000000650000-0x0000000000652000-memory.dmp

          Filesize

          8KB

        • memory/1828-68-0x0000000000000000-mapping.dmp

        • memory/1828-70-0x0000000074B81000-0x0000000074B83000-memory.dmp

          Filesize

          8KB

        • memory/1828-71-0x0000000077550000-0x00000000776D0000-memory.dmp

          Filesize

          1.5MB

        • memory/1828-76-0x0000000000590000-0x000000000059C000-memory.dmp

          Filesize

          48KB

        • memory/1828-72-0x0000000000250000-0x0000000000382000-memory.dmp

          Filesize

          1.2MB

        • memory/1904-66-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

          Filesize

          4KB

        • memory/1904-77-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

          Filesize

          4KB

        • memory/1904-67-0x00000000024E0000-0x00000000024EC000-memory.dmp

          Filesize

          48KB

        • memory/1904-65-0x0000000000440000-0x000000000044D000-memory.dmp

          Filesize

          52KB

        • memory/1904-59-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/1904-64-0x00000000003E0000-0x00000000003E1000-memory.dmp

          Filesize

          4KB

        • memory/1904-63-0x0000000000230000-0x0000000000296000-memory.dmp

          Filesize

          408KB

        • memory/1904-62-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/1904-61-0x00000000753B1000-0x00000000753B3000-memory.dmp

          Filesize

          8KB

        • memory/1904-60-0x00000000004015C6-mapping.dmp