General

  • Target

    1B2C4ED9193792BFE48A5722705085E2AFA7C14FD1951.exe

  • Size

    280KB

  • Sample

    211114-zkwnpsghb2

  • MD5

    41c024a983c2d275508094a92538eb1e

  • SHA1

    eb56e503ab95dfdeeedfa1a6f67a783b602b6f2c

  • SHA256

    1b2c4ed9193792bfe48a5722705085e2afa7c14fd19512cb280e9750924852b4

  • SHA512

    61f78efb195f3dd6e556c50d6ee07a8d0cf4a50001ec608610014c6b321a3a52c12a311e9bb8b1d975385ac16e94b207403de08e188be888201523b28ceaf67d

Malware Config

Targets

    • Target

      1B2C4ED9193792BFE48A5722705085E2AFA7C14FD1951.exe

    • Size

      280KB

    • MD5

      41c024a983c2d275508094a92538eb1e

    • SHA1

      eb56e503ab95dfdeeedfa1a6f67a783b602b6f2c

    • SHA256

      1b2c4ed9193792bfe48a5722705085e2afa7c14fd19512cb280e9750924852b4

    • SHA512

      61f78efb195f3dd6e556c50d6ee07a8d0cf4a50001ec608610014c6b321a3a52c12a311e9bb8b1d975385ac16e94b207403de08e188be888201523b28ceaf67d

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

    • Modifies firewall policy service

    • Sets file execution options in registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks