betabot | 45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648

General

Target

45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Size

308KB
MD5

43328dc39cc24500c5d4b9b735f08332
SHA1

9755de1f71e5fe30b8e9b9b9fb4d9302a4b847ab
SHA256

45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648
SHA512

7c214746fe0d9cecc774324b9ffc13217bd91fbfe3c66cc1a9ec4002d7b8dce1e8e03921a64e01f406cf00f65d21d2f6678aa1c27d2f1d4b3cdb6c77219db08c

Score

10^/10

betabot backdoor botnet evasion persistence suricata trojan

Malware Config

Signatures

BetaBot
Beta Bot is a Trojan that infects computers and disables Antivirus.
trojan backdoor botnet betabot

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	explorer.exe

suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4
suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4
suricata

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\5au77ywg7.exe\DisableExceptionChainValidation	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "jgm.exe"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\5au77ywg7.exe	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe

Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe

Loads dropped DLL 2 IoCs

Processes:

45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe

pid	process
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 2.0 = "C:\\ProgramData\\Google Updater 2.0\\5au77ywg7.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 2.0 = "\"C:\\ProgramData\\Google Updater 2.0\\5au77ywg7.exe\""	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs

Processes:

45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exeexplorer.exe

pid	process
1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1844	explorer.exe
1844	explorer.exe
1844	explorer.exe
1844	explorer.exe
1844	explorer.exe
1844	explorer.exe
1844	explorer.exe
1844	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe

description	pid	process	target process
PID 1500 set thread context of 1840	1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	explorer.exe

Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	explorer.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe

pid	process
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe

Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exeexplorer.exe

pid	process
1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
1844	explorer.exe
1844	explorer.exe
1844	explorer.exe
1844	explorer.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe

pid process

1840 45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: SeRestorePrivilege	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: SeBackupPrivilege	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: SeLoadDriverPrivilege	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: SeCreatePagefilePrivilege	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: SeShutdownPrivilege	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: SeTakeOwnershipPrivilege	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: SeChangeNotifyPrivilege	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: SeCreateTokenPrivilege	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: SeMachineAccountPrivilege	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: SeSecurityPrivilege	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: SeAssignPrimaryTokenPrivilege	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: SeCreateGlobalPrivilege	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: 33	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
Token: SeDebugPrivilege	1844	explorer.exe
Token: SeRestorePrivilege	1844	explorer.exe
Token: SeBackupPrivilege	1844	explorer.exe
Token: SeLoadDriverPrivilege	1844	explorer.exe
Token: SeCreatePagefilePrivilege	1844	explorer.exe
Token: SeShutdownPrivilege	1844	explorer.exe
Token: SeTakeOwnershipPrivilege	1844	explorer.exe
Token: SeChangeNotifyPrivilege	1844	explorer.exe
Token: SeCreateTokenPrivilege	1844	explorer.exe
Token: SeMachineAccountPrivilege	1844	explorer.exe
Token: SeSecurityPrivilege	1844	explorer.exe
Token: SeAssignPrimaryTokenPrivilege	1844	explorer.exe
Token: SeCreateGlobalPrivilege	1844	explorer.exe
Token: 33	1844	explorer.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exeexplorer.exe

description	pid	process	target process
PID 1500 wrote to memory of 1840	1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
PID 1500 wrote to memory of 1840	1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
PID 1500 wrote to memory of 1840	1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
PID 1500 wrote to memory of 1840	1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
PID 1500 wrote to memory of 1840	1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
PID 1500 wrote to memory of 1840	1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
PID 1500 wrote to memory of 1840	1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
PID 1500 wrote to memory of 1840	1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
PID 1500 wrote to memory of 1840	1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
PID 1500 wrote to memory of 1840	1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
PID 1500 wrote to memory of 1840	1500	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
PID 1840 wrote to memory of 1844	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	explorer.exe
PID 1840 wrote to memory of 1844	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	explorer.exe
PID 1840 wrote to memory of 1844	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	explorer.exe
PID 1840 wrote to memory of 1844	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	explorer.exe
PID 1840 wrote to memory of 1844	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	explorer.exe
PID 1840 wrote to memory of 1844	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	explorer.exe
PID 1840 wrote to memory of 1844	1840	45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe	explorer.exe
PID 1844 wrote to memory of 1208	1844	explorer.exe	Dwm.exe
PID 1844 wrote to memory of 1208	1844	explorer.exe	Dwm.exe
PID 1844 wrote to memory of 1208	1844	explorer.exe	Dwm.exe
PID 1844 wrote to memory of 1208	1844	explorer.exe	Dwm.exe
PID 1844 wrote to memory of 1208	1844	explorer.exe	Dwm.exe
PID 1844 wrote to memory of 1208	1844	explorer.exe	Dwm.exe
PID 1844 wrote to memory of 1264	1844	explorer.exe	Explorer.EXE
PID 1844 wrote to memory of 1264	1844	explorer.exe	Explorer.EXE
PID 1844 wrote to memory of 1264	1844	explorer.exe	Explorer.EXE
PID 1844 wrote to memory of 1264	1844	explorer.exe	Explorer.EXE
PID 1844 wrote to memory of 1264	1844	explorer.exe	Explorer.EXE
PID 1844 wrote to memory of 1264	1844	explorer.exe	Explorer.EXE
PID 1844 wrote to memory of 1044	1844	explorer.exe	DllHost.exe
PID 1844 wrote to memory of 1044	1844	explorer.exe	DllHost.exe
PID 1844 wrote to memory of 1044	1844	explorer.exe	DllHost.exe
PID 1844 wrote to memory of 1044	1844	explorer.exe	DllHost.exe
PID 1844 wrote to memory of 1044	1844	explorer.exe	DllHost.exe
PID 1844 wrote to memory of 1044	1844	explorer.exe	DllHost.exe
PID 1844 wrote to memory of 1932	1844	explorer.exe	DllHost.exe
PID 1844 wrote to memory of 1932	1844	explorer.exe	DllHost.exe
PID 1844 wrote to memory of 1932	1844	explorer.exe	DllHost.exe
PID 1844 wrote to memory of 1932	1844	explorer.exe	DllHost.exe
PID 1844 wrote to memory of 1932	1844	explorer.exe	DllHost.exe
PID 1844 wrote to memory of 1932	1844	explorer.exe	DllHost.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1264

C:\Users\Admin\AppData\Local\Temp\45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
"C:\Users\Admin\AppData\Local\Temp\45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1500

C:\Users\Admin\AppData\Local\Temp\45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe
"C:\Users\Admin\AppData\Local\Temp\45fa0aed1db052d2dc31f3d3b1696908f33dd542f76fefbd5774746d64e5f648.exe"
3⤵
- Sets file execution options in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1208

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1044

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1932

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

6

T1112

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

5

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\manufactures.dll
Filesize
76KB

MD5
063157d3b018177821b7ab29e06fb5e8

SHA1
1ae389e2710a4e01e47d64fbb24dcb1c83f31cc1

SHA256
0d986150b53a81be98e82d7275543549e71df832d978f631ed18c051ae734ebe

SHA512
1e5d109306309fc7b27748f35bd9a0e39ee61241478e91675c6381f5bd92af879a5090da00774fc197b352ec10bb0ac0af426c5f7204bb0e3435964f6c20f943

Download Submit
\Users\Admin\AppData\Local\Temp\nsi31.tmp\System.dll
Filesize
11KB

MD5
fc90dfb694d0e17b013d6f818bce41b0

SHA1
3243969886d640af3bfa442728b9f0dff9d5f5b0

SHA256
7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528

SHA512
324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6

Download Submit
memory/1264-86-0x0000000002680000-0x0000000002686000-memory.dmp

Filesize
24KB

Download
memory/1500-54-0x0000000074F91000-0x0000000074F93000-memory.dmp

Filesize
8KB

Download
memory/1500-57-0x00000000004D0000-0x00000000004E4000-memory.dmp

Filesize
80KB

Download
memory/1840-71-0x0000000000570000-0x00000000005D6000-memory.dmp

Filesize
408KB

Download
memory/1840-74-0x0000000000570000-0x00000000005D6000-memory.dmp

Filesize
408KB

Download
memory/1840-68-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1840-66-0x00000000004015C6-mapping.dmp

Download
memory/1840-65-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1840-64-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1840-63-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1840-62-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1840-70-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1840-59-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1840-75-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/1840-60-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1840-76-0x0000000001DA0000-0x0000000001DAC000-memory.dmp

Filesize
48KB

Download
memory/1840-73-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1840-58-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1840-81-0x0000000000570000-0x00000000005D6000-memory.dmp

Filesize
408KB

Download
memory/1844-80-0x0000000077030000-0x00000000771B0000-memory.dmp

Filesize
1.5MB

Download
memory/1844-77-0x0000000000000000-mapping.dmp

Download
memory/1844-83-0x0000000000940000-0x000000000094C000-memory.dmp

Filesize
48KB

Download
memory/1844-82-0x0000000000130000-0x00000000001E7000-memory.dmp

Filesize
732KB

Download
memory/1844-84-0x0000000077030000-0x00000000771B0000-memory.dmp

Filesize
1.5MB

Download
memory/1844-85-0x0000000000130000-0x00000000001E7000-memory.dmp

Filesize
732KB

Download
memory/1844-79-0x0000000074661000-0x0000000074663000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads