Analysis

  • max time kernel
    152s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    20-05-2021 01:02

General

  • Target

    a3a799eb_by_Libranalysis.exe

  • Size

    802KB

  • MD5

    a3a799eb1435896baea3a8e079c8dd02

  • SHA1

    cb0ce4c57cd8e4561a88ce20e80888d097b00900

  • SHA256

    55c12cb22033e12af48c4bb80b660e4ace8ed2364e7147979e30355bab7d5469

  • SHA512

    7cf21f437cb33fb2fe03b496309509266db8863650d175072f57b278e96a82b508651cdbc61aa08334858ffe18e251039a3c3d421d97a3749ab21ae16c89a3d9

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1192
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1220
        • C:\Users\Admin\AppData\Local\Temp\a3a799eb_by_Libranalysis.exe
          "C:\Users\Admin\AppData\Local\Temp\a3a799eb_by_Libranalysis.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1348
          • C:\Users\Admin\AppData\Local\Temp\a3a799eb_by_Libranalysis.exe
            "C:\Users\Admin\AppData\Local\Temp\a3a799eb_by_Libranalysis.exe"
            3⤵
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Suspicious behavior: MapViewOfSection
            • Suspicious behavior: RenamesItself
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2028
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              4⤵
              • Modifies firewall policy service
              • Checks BIOS information in registry
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Checks processor information in registry
              • Enumerates system info in registry
              • Modifies Internet Explorer Protected Mode
              • Modifies Internet Explorer Protected Mode Banner
              • Modifies Internet Explorer settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1992

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1220-81-0x0000000002AD0000-0x0000000002AD6000-memory.dmp

        Filesize

        24KB

      • memory/1992-69-0x0000000000000000-mapping.dmp

      • memory/1992-80-0x0000000001F10000-0x0000000001F12000-memory.dmp

        Filesize

        8KB

      • memory/1992-77-0x00000000009D0000-0x00000000009DC000-memory.dmp

        Filesize

        48KB

      • memory/1992-73-0x0000000000470000-0x00000000005A2000-memory.dmp

        Filesize

        1.2MB

      • memory/1992-72-0x0000000077E00000-0x0000000077F80000-memory.dmp

        Filesize

        1.5MB

      • memory/1992-71-0x0000000075341000-0x0000000075343000-memory.dmp

        Filesize

        8KB

      • memory/2028-65-0x00000000001C0000-0x00000000001C1000-memory.dmp

        Filesize

        4KB

      • memory/2028-68-0x0000000001ED0000-0x0000000001EDC000-memory.dmp

        Filesize

        48KB

      • memory/2028-67-0x0000000001EA0000-0x0000000001EA1000-memory.dmp

        Filesize

        4KB

      • memory/2028-63-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2028-66-0x00000000001E0000-0x00000000001ED000-memory.dmp

        Filesize

        52KB

      • memory/2028-60-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

      • memory/2028-78-0x0000000001EC0000-0x0000000001EC1000-memory.dmp

        Filesize

        4KB

      • memory/2028-64-0x0000000001CF0000-0x0000000001D56000-memory.dmp

        Filesize

        408KB

      • memory/2028-62-0x00000000762C1000-0x00000000762C3000-memory.dmp

        Filesize

        8KB

      • memory/2028-61-0x00000000004015C6-mapping.dmp