General

  • Target

    6ed0cca96fe69be3b775499509f0b029.exe

  • Size

    947KB

  • Sample

    220126-z42n3aahc6

  • MD5

    6ed0cca96fe69be3b775499509f0b029

  • SHA1

    e1c57829dd8947cc09b8b4ffcaaad07939efbb2d

  • SHA256

    bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab

  • SHA512

    a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

Malware Config

Targets

    • Target

      6ed0cca96fe69be3b775499509f0b029.exe

    • Size

      947KB

    • MD5

      6ed0cca96fe69be3b775499509f0b029

    • SHA1

      e1c57829dd8947cc09b8b4ffcaaad07939efbb2d

    • SHA256

      bcb590cab5558665d9728ce52a8ea71c3f6fd348725071cec88dfb8bfd8989ab

    • SHA512

      a64e382cd0ecdc3eba26709c6b94c737349b51a4ffb4a50b5805104c87661a5cb3c6b6902af8a926de9f248e0712343d1533d8129ba401fbe7712ddbabbf37b5

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

    • Modifies firewall policy service

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Sets file execution options in registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks