Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    13-07-2022 06:37

General

  • Target

    06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645.exe

  • Size

    957KB

  • MD5

    cf4e015eeabfd226f997a8aa258c3d97

  • SHA1

    eb2c8d789ab2e2b4c12dff88f7553114ada1f054

  • SHA256

    06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645

  • SHA512

    01283868f2887fcf2527d3cbaf2db860e010d1a77c6af7b409a7ebfc677cf3437c86b2dfeeda02ed316ef723cf3c0a3457aa977e1f3eea2f9d8f834f07dd8317

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4

    suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4

  • Executes dropped EXE 1 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1192
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1220
        • C:\Users\Admin\AppData\Local\Temp\06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645.exe
          "C:\Users\Admin\AppData\Local\Temp\06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:376
          • C:\Users\Admin\AppData\Local\Temp\06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645.exe
            C:\Users\Admin\AppData\Local\Temp\06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645.exe
            3⤵
            • Sets file execution options in registry
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Suspicious behavior: MapViewOfSection
            • Suspicious behavior: RenamesItself
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1932
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              4⤵
              • Modifies firewall policy service
              • Sets file execution options in registry
              • Checks BIOS information in registry
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops desktop.ini file(s)
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Checks processor information in registry
              • Enumerates system info in registry
              • Modifies Internet Explorer Protected Mode
              • Modifies Internet Explorer Protected Mode Banner
              • Modifies Internet Explorer settings
              • NTFS ADS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1652
              • C:\Users\Admin\AppData\Local\Temp\i1csg3ks5eg_1.exe
                /suac
                5⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                PID:1260
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
          PID:1236

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\i1csg3ks5eg_1.exe

          Filesize

          957KB

          MD5

          cf4e015eeabfd226f997a8aa258c3d97

          SHA1

          eb2c8d789ab2e2b4c12dff88f7553114ada1f054

          SHA256

          06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645

          SHA512

          01283868f2887fcf2527d3cbaf2db860e010d1a77c6af7b409a7ebfc677cf3437c86b2dfeeda02ed316ef723cf3c0a3457aa977e1f3eea2f9d8f834f07dd8317

        • \Users\Admin\AppData\Local\Temp\i1csg3ks5eg_1.exe

          Filesize

          957KB

          MD5

          cf4e015eeabfd226f997a8aa258c3d97

          SHA1

          eb2c8d789ab2e2b4c12dff88f7553114ada1f054

          SHA256

          06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645

          SHA512

          01283868f2887fcf2527d3cbaf2db860e010d1a77c6af7b409a7ebfc677cf3437c86b2dfeeda02ed316ef723cf3c0a3457aa977e1f3eea2f9d8f834f07dd8317

        • memory/376-54-0x00000000764C1000-0x00000000764C3000-memory.dmp

          Filesize

          8KB

        • memory/376-55-0x0000000002AE0000-0x0000000002BE0000-memory.dmp

          Filesize

          1024KB

        • memory/1220-80-0x0000000002710000-0x0000000002716000-memory.dmp

          Filesize

          24KB

        • memory/1260-82-0x0000000000000000-mapping.dmp

        • memory/1652-78-0x00000000776A0000-0x0000000077820000-memory.dmp

          Filesize

          1.5MB

        • memory/1652-76-0x00000000004C0000-0x0000000000619000-memory.dmp

          Filesize

          1.3MB

        • memory/1652-79-0x00000000004C0000-0x0000000000619000-memory.dmp

          Filesize

          1.3MB

        • memory/1652-71-0x0000000000000000-mapping.dmp

        • memory/1652-73-0x00000000737A1000-0x00000000737A3000-memory.dmp

          Filesize

          8KB

        • memory/1652-77-0x0000000000640000-0x000000000064C000-memory.dmp

          Filesize

          48KB

        • memory/1652-75-0x00000000776A0000-0x0000000077820000-memory.dmp

          Filesize

          1.5MB

        • memory/1932-69-0x0000000000310000-0x000000000031D000-memory.dmp

          Filesize

          52KB

        • memory/1932-74-0x0000000000500000-0x0000000000566000-memory.dmp

          Filesize

          408KB

        • memory/1932-68-0x0000000000500000-0x0000000000566000-memory.dmp

          Filesize

          408KB

        • memory/1932-70-0x00000000025B0000-0x00000000025BC000-memory.dmp

          Filesize

          48KB

        • memory/1932-66-0x0000000000500000-0x0000000000566000-memory.dmp

          Filesize

          408KB

        • memory/1932-64-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/1932-63-0x00000000004015C6-mapping.dmp

        • memory/1932-56-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB