Analysis

  • max time kernel
    146s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    13-07-2022 06:37

General

  • Target

    053e024947a8103550e2250b51a61f65eb0a7f9a99c9c1783d5fd86ecde1d786.exe

  • Size

    613KB

  • MD5

    25809fc57cbbfdbc64b4c5d4e17d1d06

  • SHA1

    0415083490d597fc23ddc7c6e5163ad51ee60213

  • SHA256

    053e024947a8103550e2250b51a61f65eb0a7f9a99c9c1783d5fd86ecde1d786

  • SHA512

    a078e118303ff225c7526a844e8b0984362e7f764a473fd3599781c432280f5ef6b00eaf6c8ed2dd08bde115e66f675795a0f6769a51fbfe1a0a5e14e3f4509a

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 8 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4

    suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4

  • CryptOne packer 2 IoCs

    Detects CryptOne packer defined in NCC blogpost.

  • Disables taskbar notifications via registry modification
  • Disables use of System Restore points 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
  • NTFS ADS 2 IoCs
  • Runs net.exe
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 61 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\053e024947a8103550e2250b51a61f65eb0a7f9a99c9c1783d5fd86ecde1d786.exe
        "C:\Users\Admin\AppData\Local\Temp\053e024947a8103550e2250b51a61f65eb0a7f9a99c9c1783d5fd86ecde1d786.exe"
        2⤵
        • Sets file execution options in registry
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: MapViewOfSection
        • Suspicious behavior: RenamesItself
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:1032
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          3⤵
          • Modifies firewall policy service
          • Sets file execution options in registry
          • Checks BIOS information in registry
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops desktop.ini file(s)
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies Internet Explorer Protected Mode
          • Modifies Internet Explorer Protected Mode Banner
          • Modifies Internet Explorer settings
          • NTFS ADS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1004
          • C:\Users\Admin\AppData\Local\Temp\s59ucg5sg3o91qu_1.exe
            /suac
            4⤵
            • Modifies firewall policy service
            • Executes dropped EXE
            • Checks for any installed AV software in registry
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of UnmapMainImage
            • Suspicious use of WriteProcessMemory
            PID:1044
            • C:\Windows\SysWOW64\regedit.exe
              "C:\Windows\SysWOW64\regedit.exe"
              5⤵
              • Modifies security service
              • UAC bypass
              • Sets service image path in registry
              • Adds Run key to start application
              • Modifies Internet Explorer settings
              • Runs regedit.exe
              • Suspicious use of AdjustPrivilegeToken
              PID:1588
          • C:\Users\Admin\AppData\Local\Temp\7s73cw93u.exe
            "C:\Users\Admin\AppData\Local\Temp\7s73cw93u.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1952
            • C:\Windows\system32\cmd.exe
              "cmd.exe" /c net group "Domain Admins" /domain
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:1560
              • C:\Windows\system32\net.exe
                net group "Domain Admins" /domain
                6⤵
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious use of WriteProcessMemory
                PID:1912
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 group "Domain Admins" /domain
                  7⤵
                    PID:1160
              • C:\Windows\system32\cmd.exe
                "cmd.exe" /c net group "domain computers" /domain
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1756
                • C:\Windows\system32\net.exe
                  net group "domain computers" /domain
                  6⤵
                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                  • Suspicious use of WriteProcessMemory
                  PID:968
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 group "domain computers" /domain
                    7⤵
                      PID:1852
                • C:\Windows\system32\cmd.exe
                  "cmd.exe" /c nltest /domain_trusts /all_trusts
                  5⤵
                    PID:1764
                    • C:\Windows\system32\nltest.exe
                      nltest /domain_trusts /all_trusts
                      6⤵
                      • Suspicious behavior: CmdExeWriteProcessMemorySpam
                      PID:1556
                  • C:\Windows\system32\cmd.exe
                    "cmd.exe" /c nltest /domain_trusts
                    5⤵
                      PID:1692
                      • C:\Windows\system32\nltest.exe
                        nltest /domain_trusts
                        6⤵
                        • Suspicious behavior: CmdExeWriteProcessMemorySpam
                        PID:1336
                    • C:\Windows\system32\cmd.exe
                      "cmd.exe" /c net view /all
                      5⤵
                        PID:1680
                        • C:\Windows\system32\net.exe
                          net view /all
                          6⤵
                          • Discovers systems in the same network
                          • Suspicious behavior: CmdExeWriteProcessMemorySpam
                          PID:1656
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\7s73cw93u.exe" && /C choice /C Y /N /D Y /T 3 & Del "shfolder.dll" && Del LAG1 && Del LAG2
                        5⤵
                          PID:1816
                          • C:\Windows\system32\choice.exe
                            choice /C Y /N /D Y /T 3
                            6⤵
                            • Suspicious behavior: CmdExeWriteProcessMemorySpam
                            PID:1520
                • C:\Windows\system32\Dwm.exe
                  "C:\Windows\system32\Dwm.exe"
                  1⤵
                    PID:1168

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\7s73cw93u.exe

                    Filesize

                    10KB

                    MD5

                    60a1564d18f20769eb65478cc5bc56c0

                    SHA1

                    15ba12509eb288ed4e47162714f86777d8819976

                    SHA256

                    deccabcc57c6a41b9e2e1f3f97b9425831304f69387299adf1405350d2f5d110

                    SHA512

                    e1e2228963e1f0f0b80b9c5deb47da740b6fec376ebb7ae8e23ce31c2cadc02d63959f6bf3c66c949498f66a1eb44def5a8e467cf82d6ac3855bfc9241ebfc71

                  • C:\Users\Admin\AppData\Local\Temp\7s73cw93u.exe

                    Filesize

                    10KB

                    MD5

                    60a1564d18f20769eb65478cc5bc56c0

                    SHA1

                    15ba12509eb288ed4e47162714f86777d8819976

                    SHA256

                    deccabcc57c6a41b9e2e1f3f97b9425831304f69387299adf1405350d2f5d110

                    SHA512

                    e1e2228963e1f0f0b80b9c5deb47da740b6fec376ebb7ae8e23ce31c2cadc02d63959f6bf3c66c949498f66a1eb44def5a8e467cf82d6ac3855bfc9241ebfc71

                  • C:\Users\Admin\AppData\Local\Temp\s59ucg5sg3o91qu_1.exe

                    Filesize

                    613KB

                    MD5

                    25809fc57cbbfdbc64b4c5d4e17d1d06

                    SHA1

                    0415083490d597fc23ddc7c6e5163ad51ee60213

                    SHA256

                    053e024947a8103550e2250b51a61f65eb0a7f9a99c9c1783d5fd86ecde1d786

                    SHA512

                    a078e118303ff225c7526a844e8b0984362e7f764a473fd3599781c432280f5ef6b00eaf6c8ed2dd08bde115e66f675795a0f6769a51fbfe1a0a5e14e3f4509a

                  • \Users\Admin\AppData\Local\Temp\7s73cw93u.exe

                    Filesize

                    10KB

                    MD5

                    60a1564d18f20769eb65478cc5bc56c0

                    SHA1

                    15ba12509eb288ed4e47162714f86777d8819976

                    SHA256

                    deccabcc57c6a41b9e2e1f3f97b9425831304f69387299adf1405350d2f5d110

                    SHA512

                    e1e2228963e1f0f0b80b9c5deb47da740b6fec376ebb7ae8e23ce31c2cadc02d63959f6bf3c66c949498f66a1eb44def5a8e467cf82d6ac3855bfc9241ebfc71

                  • \Users\Admin\AppData\Local\Temp\s59ucg5sg3o91qu_1.exe

                    Filesize

                    613KB

                    MD5

                    25809fc57cbbfdbc64b4c5d4e17d1d06

                    SHA1

                    0415083490d597fc23ddc7c6e5163ad51ee60213

                    SHA256

                    053e024947a8103550e2250b51a61f65eb0a7f9a99c9c1783d5fd86ecde1d786

                    SHA512

                    a078e118303ff225c7526a844e8b0984362e7f764a473fd3599781c432280f5ef6b00eaf6c8ed2dd08bde115e66f675795a0f6769a51fbfe1a0a5e14e3f4509a

                  • memory/968-101-0x0000000000000000-mapping.dmp

                  • memory/1004-71-0x00000000004B0000-0x00000000004BC000-memory.dmp

                    Filesize

                    48KB

                  • memory/1004-63-0x0000000000000000-mapping.dmp

                  • memory/1004-65-0x0000000074CB1000-0x0000000074CB3000-memory.dmp

                    Filesize

                    8KB

                  • memory/1004-66-0x0000000077810000-0x0000000077990000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1004-73-0x0000000077810000-0x0000000077990000-memory.dmp

                    Filesize

                    1.5MB

                  • memory/1004-72-0x0000000000200000-0x0000000000303000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/1004-69-0x00000000001A0000-0x00000000001AD000-memory.dmp

                    Filesize

                    52KB

                  • memory/1004-67-0x0000000000200000-0x0000000000303000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/1032-61-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                  • memory/1032-70-0x0000000002260000-0x00000000022C6000-memory.dmp

                    Filesize

                    408KB

                  • memory/1032-68-0x0000000000400000-0x0000000000435000-memory.dmp

                    Filesize

                    212KB

                  • memory/1032-62-0x0000000002B10000-0x0000000002B1C000-memory.dmp

                    Filesize

                    48KB

                  • memory/1032-54-0x0000000075B71000-0x0000000075B73000-memory.dmp

                    Filesize

                    8KB

                  • memory/1032-60-0x0000000002260000-0x00000000022C6000-memory.dmp

                    Filesize

                    408KB

                  • memory/1032-59-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                  • memory/1032-58-0x00000000020E0000-0x0000000002113000-memory.dmp

                    Filesize

                    204KB

                  • memory/1032-56-0x0000000002260000-0x00000000022C6000-memory.dmp

                    Filesize

                    408KB

                  • memory/1044-84-0x00000000021B0000-0x0000000002216000-memory.dmp

                    Filesize

                    408KB

                  • memory/1044-76-0x0000000000000000-mapping.dmp

                  • memory/1044-85-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                  • memory/1044-86-0x00000000024D0000-0x00000000024DC000-memory.dmp

                    Filesize

                    48KB

                  • memory/1044-89-0x0000000000400000-0x0000000000435000-memory.dmp

                    Filesize

                    212KB

                  • memory/1044-83-0x0000000000400000-0x000000000049C000-memory.dmp

                    Filesize

                    624KB

                  • memory/1044-81-0x00000000021B0000-0x0000000002216000-memory.dmp

                    Filesize

                    408KB

                  • memory/1044-79-0x00000000020F0000-0x0000000002123000-memory.dmp

                    Filesize

                    204KB

                  • memory/1160-99-0x0000000000000000-mapping.dmp

                  • memory/1200-74-0x0000000002640000-0x0000000002646000-memory.dmp

                    Filesize

                    24KB

                  • memory/1336-106-0x0000000000000000-mapping.dmp

                  • memory/1520-111-0x0000000000000000-mapping.dmp

                  • memory/1556-104-0x0000000000000000-mapping.dmp

                  • memory/1560-97-0x0000000000000000-mapping.dmp

                  • memory/1588-91-0x0000000000090000-0x000000000009B000-memory.dmp

                    Filesize

                    44KB

                  • memory/1588-90-0x00000000000B0000-0x0000000000115000-memory.dmp

                    Filesize

                    404KB

                  • memory/1588-87-0x0000000000000000-mapping.dmp

                  • memory/1656-108-0x0000000000000000-mapping.dmp

                  • memory/1680-107-0x0000000000000000-mapping.dmp

                  • memory/1692-105-0x0000000000000000-mapping.dmp

                  • memory/1756-100-0x0000000000000000-mapping.dmp

                  • memory/1764-103-0x0000000000000000-mapping.dmp

                  • memory/1816-110-0x0000000000000000-mapping.dmp

                  • memory/1852-102-0x0000000000000000-mapping.dmp

                  • memory/1912-98-0x0000000000000000-mapping.dmp

                  • memory/1952-93-0x0000000000000000-mapping.dmp

                  • memory/1952-96-0x00000000009A0000-0x00000000009A8000-memory.dmp

                    Filesize

                    32KB

                  • memory/1952-109-0x000007FEFBEB1000-0x000007FEFBEB3000-memory.dmp

                    Filesize

                    8KB