General
-
Target
06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645
-
Size
957KB
-
Sample
220713-hdgsjaead8
-
MD5
cf4e015eeabfd226f997a8aa258c3d97
-
SHA1
eb2c8d789ab2e2b4c12dff88f7553114ada1f054
-
SHA256
06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645
-
SHA512
01283868f2887fcf2527d3cbaf2db860e010d1a77c6af7b409a7ebfc677cf3437c86b2dfeeda02ed316ef723cf3c0a3457aa977e1f3eea2f9d8f834f07dd8317
Static task
static1
Behavioral task
behavioral1
Sample
06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645.exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645
-
Size
957KB
-
MD5
cf4e015eeabfd226f997a8aa258c3d97
-
SHA1
eb2c8d789ab2e2b4c12dff88f7553114ada1f054
-
SHA256
06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645
-
SHA512
01283868f2887fcf2527d3cbaf2db860e010d1a77c6af7b409a7ebfc677cf3437c86b2dfeeda02ed316ef723cf3c0a3457aa977e1f3eea2f9d8f834f07dd8317
-
Modifies firewall policy service
-
suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4
suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4
-
Executes dropped EXE
-
Sets file execution options in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-