Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    20-05-2021 01:02

General

  • Target

    a3a799eb_by_Libranalysis.exe

  • Size

    802KB

  • MD5

    a3a799eb1435896baea3a8e079c8dd02

  • SHA1

    cb0ce4c57cd8e4561a88ce20e80888d097b00900

  • SHA256

    55c12cb22033e12af48c4bb80b660e4ace8ed2364e7147979e30355bab7d5469

  • SHA512

    7cf21f437cb33fb2fe03b496309509266db8863650d175072f57b278e96a82b508651cdbc61aa08334858ffe18e251039a3c3d421d97a3749ab21ae16c89a3d9

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a3a799eb_by_Libranalysis.exe
    "C:\Users\Admin\AppData\Local\Temp\a3a799eb_by_Libranalysis.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3772
    • C:\Users\Admin\AppData\Local\Temp\a3a799eb_by_Libranalysis.exe
      "C:\Users\Admin\AppData\Local\Temp\a3a799eb_by_Libranalysis.exe"
      2⤵
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious behavior: MapViewOfSection
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:724
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Modifies firewall policy service
        • Checks BIOS information in registry
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:152
        • C:\Users\Admin\AppData\Local\Temp\g1agecw7e19_1.exe
          /suac
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:3720
        • C:\Users\Admin\AppData\Local\Temp\7u7i3i3c5yu.exe
          "C:\Users\Admin\AppData\Local\Temp\7u7i3i3c5yu.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3512
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1532
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3912
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:204
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData\Google Updater 2.09\'
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1556

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

    MD5

    8592ba100a78835a6b94d5949e13dfc1

    SHA1

    63e901200ab9a57c7dd4c078d7f75dcd3b357020

    SHA256

    fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

    SHA512

    87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    a1e8c8d29544019391fa9a0d54eeda4b

    SHA1

    9f9ed881bbd249be72492a04dfe24c7a58ecae2c

    SHA256

    85cf180bc2bbb5b5a5628b7184419789bbbc6908a390b6a1dc16dd5cb3f022a6

    SHA512

    9727004b88e177a81f619cc0d9b1766c1a5853b9260fa3970837e5d59e337aeec4e7923729ae77be4455572b9459fd75da7df20075d57596a3eca20bbb33da8c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    a1e8c8d29544019391fa9a0d54eeda4b

    SHA1

    9f9ed881bbd249be72492a04dfe24c7a58ecae2c

    SHA256

    85cf180bc2bbb5b5a5628b7184419789bbbc6908a390b6a1dc16dd5cb3f022a6

    SHA512

    9727004b88e177a81f619cc0d9b1766c1a5853b9260fa3970837e5d59e337aeec4e7923729ae77be4455572b9459fd75da7df20075d57596a3eca20bbb33da8c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    MD5

    e1d80047794ddb8c4450784eec9feeda

    SHA1

    97b97dd61473c50a8ca9367e347a40b227c92038

    SHA256

    b0465ca19c5674b36c035734ab1da30652fafc01f8b97511b5f82a2c796cc861

    SHA512

    7f45fe180d07e0addd3464b77cfa6be05157bc2c6b4de1032290732c904b5d2424628c67681bb9ba067a1de843a0171016fb51b9ab3f36fe7da9490aeafa6dbe

  • C:\Users\Admin\AppData\Local\Temp\7u7i3i3c5yu.exe

    MD5

    07f2ddc571ace474d3d7c0e5efd051a2

    SHA1

    ddb49e4e422c5a7a6e9db9c92776c2531bf10ca8

    SHA256

    4524311e34beb91833ab812e17dc231724539c892dfeacd24ccdd8c2951a1b8f

    SHA512

    4d453dfe4d4b642a71917efd75f2f4aebf8d3e964f3be589a643694d633ed5f7934c1a392559a264ba870746da122735dc7999ad4cc40d58f19a60d04e20ae3e

  • C:\Users\Admin\AppData\Local\Temp\7u7i3i3c5yu.exe

    MD5

    07f2ddc571ace474d3d7c0e5efd051a2

    SHA1

    ddb49e4e422c5a7a6e9db9c92776c2531bf10ca8

    SHA256

    4524311e34beb91833ab812e17dc231724539c892dfeacd24ccdd8c2951a1b8f

    SHA512

    4d453dfe4d4b642a71917efd75f2f4aebf8d3e964f3be589a643694d633ed5f7934c1a392559a264ba870746da122735dc7999ad4cc40d58f19a60d04e20ae3e

  • C:\Users\Admin\AppData\Local\Temp\g1agecw7e19_1.exe

    MD5

    a3a799eb1435896baea3a8e079c8dd02

    SHA1

    cb0ce4c57cd8e4561a88ce20e80888d097b00900

    SHA256

    55c12cb22033e12af48c4bb80b660e4ace8ed2364e7147979e30355bab7d5469

    SHA512

    7cf21f437cb33fb2fe03b496309509266db8863650d175072f57b278e96a82b508651cdbc61aa08334858ffe18e251039a3c3d421d97a3749ab21ae16c89a3d9

  • C:\Users\Admin\AppData\Local\Temp\g1agecw7e19_1.exe

    MD5

    a3a799eb1435896baea3a8e079c8dd02

    SHA1

    cb0ce4c57cd8e4561a88ce20e80888d097b00900

    SHA256

    55c12cb22033e12af48c4bb80b660e4ace8ed2364e7147979e30355bab7d5469

    SHA512

    7cf21f437cb33fb2fe03b496309509266db8863650d175072f57b278e96a82b508651cdbc61aa08334858ffe18e251039a3c3d421d97a3749ab21ae16c89a3d9

  • memory/152-123-0x0000000003040000-0x0000000003172000-memory.dmp

    Filesize

    1.2MB

  • memory/152-125-0x0000000002D40000-0x0000000002D63000-memory.dmp

    Filesize

    140KB

  • memory/152-124-0x0000000002D40000-0x0000000002D63000-memory.dmp

    Filesize

    140KB

  • memory/152-122-0x0000000000050000-0x000000000048F000-memory.dmp

    Filesize

    4.2MB

  • memory/152-127-0x0000000004790000-0x0000000004791000-memory.dmp

    Filesize

    4KB

  • memory/152-129-0x00000000048B0000-0x00000000048B2000-memory.dmp

    Filesize

    8KB

  • memory/152-121-0x0000000000000000-mapping.dmp

  • memory/204-214-0x00000244D9C76000-0x00000244D9C78000-memory.dmp

    Filesize

    8KB

  • memory/204-169-0x00000244D9C73000-0x00000244D9C75000-memory.dmp

    Filesize

    8KB

  • memory/204-166-0x00000244D9C70000-0x00000244D9C72000-memory.dmp

    Filesize

    8KB

  • memory/204-141-0x0000000000000000-mapping.dmp

  • memory/204-216-0x00000244D9C78000-0x00000244D9C79000-memory.dmp

    Filesize

    4KB

  • memory/724-120-0x0000000000990000-0x000000000099C000-memory.dmp

    Filesize

    48KB

  • memory/724-117-0x0000000002180000-0x00000000021E6000-memory.dmp

    Filesize

    408KB

  • memory/724-118-0x0000000000440000-0x000000000058A000-memory.dmp

    Filesize

    1.3MB

  • memory/724-114-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/724-116-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB

  • memory/724-115-0x00000000004015C6-mapping.dmp

  • memory/724-119-0x00000000006D0000-0x00000000006D1000-memory.dmp

    Filesize

    4KB

  • memory/1532-138-0x0000000000000000-mapping.dmp

  • memory/1532-215-0x00000206B6318000-0x00000206B6319000-memory.dmp

    Filesize

    4KB

  • memory/1532-164-0x00000206B6313000-0x00000206B6315000-memory.dmp

    Filesize

    8KB

  • memory/1532-163-0x00000206B6310000-0x00000206B6312000-memory.dmp

    Filesize

    8KB

  • memory/1532-213-0x00000206B6316000-0x00000206B6318000-memory.dmp

    Filesize

    8KB

  • memory/1556-140-0x0000000000000000-mapping.dmp

  • memory/1556-218-0x00000282D32A8000-0x00000282D32A9000-memory.dmp

    Filesize

    4KB

  • memory/1556-208-0x00000282D32A6000-0x00000282D32A8000-memory.dmp

    Filesize

    8KB

  • memory/1556-171-0x00000282D32A3000-0x00000282D32A5000-memory.dmp

    Filesize

    8KB

  • memory/1556-168-0x00000282D32A0000-0x00000282D32A2000-memory.dmp

    Filesize

    8KB

  • memory/1556-172-0x00000282D3430000-0x00000282D3431000-memory.dmp

    Filesize

    4KB

  • memory/3512-133-0x0000000000000000-mapping.dmp

  • memory/3720-130-0x0000000000000000-mapping.dmp

  • memory/3912-217-0x00000161E5058000-0x00000161E5059000-memory.dmp

    Filesize

    4KB

  • memory/3912-162-0x00000161E5050000-0x00000161E5052000-memory.dmp

    Filesize

    8KB

  • memory/3912-158-0x00000161E4FE0000-0x00000161E4FE1000-memory.dmp

    Filesize

    4KB

  • memory/3912-139-0x0000000000000000-mapping.dmp

  • memory/3912-165-0x00000161E5053000-0x00000161E5055000-memory.dmp

    Filesize

    8KB

  • memory/3912-203-0x00000161E5056000-0x00000161E5058000-memory.dmp

    Filesize

    8KB