Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    14-07-2022 05:34

General

  • Target

    47c4ecd0b8599f6df90b4ae35bd270dc845a2c9a28cb9d3a261e6f105138112c.exe

  • Size

    400KB

  • MD5

    642ec6abbe3587317725f444ab6489a7

  • SHA1

    63cbc9d13a9e7bf9e4a0e2908cdee40deaaab0f5

  • SHA256

    47c4ecd0b8599f6df90b4ae35bd270dc845a2c9a28cb9d3a261e6f105138112c

  • SHA512

    3672b47ac0771ad3d212c2e02dc97d12eb6295bc063a745fbf95b43217574974faa400c626c09dfe39d24f3c52aede74df7521dd7d6d4f30dce258342cbaf888

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4

    suricata: ET MALWARE Win32/Neurevt.A/Betabot Check-in 4

  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1312
      • C:\Users\Admin\AppData\Local\Temp\47c4ecd0b8599f6df90b4ae35bd270dc845a2c9a28cb9d3a261e6f105138112c.exe
        "C:\Users\Admin\AppData\Local\Temp\47c4ecd0b8599f6df90b4ae35bd270dc845a2c9a28cb9d3a261e6f105138112c.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:532
        • C:\Users\Admin\AppData\Local\Temp\47c4ecd0b8599f6df90b4ae35bd270dc845a2c9a28cb9d3a261e6f105138112c.exe
          "C:\Users\Admin\AppData\Local\Temp\47c4ecd0b8599f6df90b4ae35bd270dc845a2c9a28cb9d3a261e6f105138112c.exe"
          3⤵
          • Sets file execution options in registry
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Suspicious behavior: MapViewOfSection
          • Suspicious behavior: RenamesItself
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:964
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            4⤵
            • Modifies firewall policy service
            • Sets file execution options in registry
            • Checks BIOS information in registry
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Enumerates system info in registry
            • Modifies Internet Explorer Protected Mode
            • Modifies Internet Explorer Protected Mode Banner
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1308
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1240
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:1196

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/532-60-0x0000000076E60000-0x0000000077009000-memory.dmp

          Filesize

          1.7MB

        • memory/532-56-0x0000000075711000-0x0000000075713000-memory.dmp

          Filesize

          8KB

        • memory/532-63-0x0000000077040000-0x00000000771C0000-memory.dmp

          Filesize

          1.5MB

        • memory/964-69-0x00000000003C0000-0x00000000003CD000-memory.dmp

          Filesize

          52KB

        • memory/964-77-0x0000000001CC0000-0x0000000001D26000-memory.dmp

          Filesize

          408KB

        • memory/964-57-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/964-64-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/964-65-0x0000000001CC0000-0x0000000001D26000-memory.dmp

          Filesize

          408KB

        • memory/964-67-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/964-70-0x0000000001BA0000-0x0000000001BAC000-memory.dmp

          Filesize

          48KB

        • memory/964-58-0x00000000004015C6-mapping.dmp

        • memory/964-68-0x0000000001CC0000-0x0000000001D26000-memory.dmp

          Filesize

          408KB

        • memory/964-61-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/1196-81-0x00000000027E0000-0x00000000027E6000-memory.dmp

          Filesize

          24KB

        • memory/1308-71-0x0000000000000000-mapping.dmp

        • memory/1308-76-0x00000000005F0000-0x00000000005FC000-memory.dmp

          Filesize

          48KB

        • memory/1308-75-0x0000000000500000-0x00000000005CE000-memory.dmp

          Filesize

          824KB

        • memory/1308-74-0x0000000077040000-0x00000000771C0000-memory.dmp

          Filesize

          1.5MB

        • memory/1308-78-0x0000000077040000-0x00000000771C0000-memory.dmp

          Filesize

          1.5MB

        • memory/1308-79-0x0000000000500000-0x00000000005CE000-memory.dmp

          Filesize

          824KB

        • memory/1308-73-0x00000000746B1000-0x00000000746B3000-memory.dmp

          Filesize

          8KB

        • memory/1312-80-0x0000000001C50000-0x0000000001C56000-memory.dmp

          Filesize

          24KB