Analysis

  • max time kernel
    175s
  • max time network
    187s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • resource tags

    arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system
  • submitted
    17-07-2022 03:36

General

  • Target

    523fc53a3afa854ca34abb66f224281f57467bee9cc0eb10beea5fd14ebf60a9.exe

  • Size

    1.7MB

  • MD5

    f2d7e52b6f02da7e308e27681ba27b39

  • SHA1

    b96aba9b3e867c22e29c72e083b14f1865a1c7ff

  • SHA256

    523fc53a3afa854ca34abb66f224281f57467bee9cc0eb10beea5fd14ebf60a9

  • SHA512

    e8e015025b0574e78900c10eaac7d869fec223164181392b2d0683ae87d7a61d645bfed9a1439a586cacc70bb633f5a6d10b7e39b4c5801705bff580412c9623

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 9 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 32 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1296
      • C:\Users\Admin\AppData\Local\Temp\523fc53a3afa854ca34abb66f224281f57467bee9cc0eb10beea5fd14ebf60a9.exe
        "C:\Users\Admin\AppData\Local\Temp\523fc53a3afa854ca34abb66f224281f57467bee9cc0eb10beea5fd14ebf60a9.exe"
        2⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1744
        • C:\Users\Admin\AppData\Roaming\driver.reviver.5.24.0.12-patch.exe
          "C:\Users\Admin\AppData\Roaming\driver.reviver.5.24.0.12-patch.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Maps connected drives based on registry
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:1412
        • C:\Users\Admin\AppData\Roaming\googleup.exe
          "C:\Users\Admin\AppData\Roaming\googleup.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1220
          • C:\Windows\SysWOW64\msiexec.exe
            C:\Windows\SysWOW64\msiexec.exe
            4⤵
              PID:1636
            • C:\Users\Admin\AppData\Roaming\googleup.exe
              "C:\Users\Admin\AppData\Roaming\googleup.exe"
              4⤵
              • Executes dropped EXE
              • Sets file execution options in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Checks processor information in registry
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:544
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                5⤵
                • Modifies firewall policy service
                • Sets file execution options in registry
                • Checks BIOS information in registry
                • Adds Run key to start application
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Checks processor information in registry
                • Enumerates system info in registry
                • Modifies Internet Explorer Protected Mode
                • Modifies Internet Explorer Protected Mode Banner
                • Modifies Internet Explorer settings
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:884
          • C:\Users\Admin\AppData\Local\Temp\523fc53a3afa854ca34abb66f224281f57467bee9cc0eb10beea5fd14ebf60a9.exe
            C:\Users\Admin\AppData\Local\Temp\523fc53a3afa854ca34abb66f224281f57467bee9cc0eb10beea5fd14ebf60a9.exe
            3⤵
            • Loads dropped DLL
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Maps connected drives based on registry
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of FindShellTrayWindow
            PID:2044
      • C:\Windows\system32\Dwm.exe
        "C:\Windows\system32\Dwm.exe"
        1⤵
          PID:1244
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x2f4
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1812
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:968

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Ormolu.dat

            Filesize

            218KB

            MD5

            483909440b46c664ba6038a008740901

            SHA1

            7ad5a1f895cb5b79838f3a65130242b441a47774

            SHA256

            4669de9e3c6e60e94071e8163e5f958f244b468e7809dae38679100a5e5382d7

            SHA512

            c3d5e5842ac07809135205a4a07e562760b70be2f41411352b1c8c9372079087cef1517886f9362df00e2e8706199fb3bcbedbdcb4d142532f2e03a4330baaab

          • C:\Users\Admin\AppData\Roaming\driver.reviver.5.24.0.12-patch.exe

            Filesize

            144KB

            MD5

            0cd8d6746093c2b02b18e0da737a12d4

            SHA1

            19ec4c49c3adedb152137254c35bafc8b64407c8

            SHA256

            800d1d7f8bbdfc6a445bff377f76ee792552232b955b849fa5d86dabd41c16fb

            SHA512

            d63c431704e91afb4e3180d7a29be0d042094858c841229836910d32e7c0a215e284bb7d66d9897d9405dd4d9ab472e6b61e8b78d4127ae350df21df1157728e

          • C:\Users\Admin\AppData\Roaming\googleup.exe

            Filesize

            309KB

            MD5

            7bf0b17bdb0de1668e13502c74ed6cb6

            SHA1

            f42777d66eb75c3f2f560e7ec8b1d5d068b99a78

            SHA256

            de94226a21c3200dd5c2f63f845c4333ef8fcab922311e10a4191da68a2879bb

            SHA512

            fcb042a1dfbfde4fe67ebca05b8979601767f948cef31d59b0e941588a3d56e218265e83e7e8411e70eabf355ed6745958f1e810f8825058272be06c03c44e77

          • C:\Users\Admin\AppData\Roaming\googleup.exe

            Filesize

            309KB

            MD5

            7bf0b17bdb0de1668e13502c74ed6cb6

            SHA1

            f42777d66eb75c3f2f560e7ec8b1d5d068b99a78

            SHA256

            de94226a21c3200dd5c2f63f845c4333ef8fcab922311e10a4191da68a2879bb

            SHA512

            fcb042a1dfbfde4fe67ebca05b8979601767f948cef31d59b0e941588a3d56e218265e83e7e8411e70eabf355ed6745958f1e810f8825058272be06c03c44e77

          • C:\Users\Admin\AppData\Roaming\googleup.exe

            Filesize

            309KB

            MD5

            7bf0b17bdb0de1668e13502c74ed6cb6

            SHA1

            f42777d66eb75c3f2f560e7ec8b1d5d068b99a78

            SHA256

            de94226a21c3200dd5c2f63f845c4333ef8fcab922311e10a4191da68a2879bb

            SHA512

            fcb042a1dfbfde4fe67ebca05b8979601767f948cef31d59b0e941588a3d56e218265e83e7e8411e70eabf355ed6745958f1e810f8825058272be06c03c44e77

          • C:\Users\Admin\AppData\Roaming\mahonia.exe

            Filesize

            1.7MB

            MD5

            f2d7e52b6f02da7e308e27681ba27b39

            SHA1

            b96aba9b3e867c22e29c72e083b14f1865a1c7ff

            SHA256

            523fc53a3afa854ca34abb66f224281f57467bee9cc0eb10beea5fd14ebf60a9

            SHA512

            e8e015025b0574e78900c10eaac7d869fec223164181392b2d0683ae87d7a61d645bfed9a1439a586cacc70bb633f5a6d10b7e39b4c5801705bff580412c9623

          • \Users\Admin\AppData\Local\Temp\Ashkhabad.dll

            Filesize

            64KB

            MD5

            17a4c0292cb99df37a87c7b8f2587847

            SHA1

            94f9ce48130d12171396a213949d7ddca06e9eae

            SHA256

            c9b576460ccb389e13ae2b9b8cd7cced9a4872ac1845ec7fd2b0325563a9ccb3

            SHA512

            62205b025a1b6659231220b37b7b51c53f156f6a1853b8916de105f63c33b7962c71e36acf0ecfa4256fc04ca1304e310d68895cd370b6be76518960a622c567

          • \Users\Admin\AppData\Local\Temp\C5E3399ED9A072FE864748D49BA96094.dll

            Filesize

            2KB

            MD5

            13249bc6aa781475cde4a1c90f95efd4

            SHA1

            0d8698befd283ca69d87ce44dad225ef792b06da

            SHA256

            3922a8c1b0f58b74fc3d89d7eec3fe5c5b0e8bda6b36491d2380431dd8e8284a

            SHA512

            aec8b793c4a1c9789af70fdaad3aa473a581585e8b76669d187cabe6c88363bacbed28200dd8f243f9dd50fc8fc27339f0e687341024d466a4d5078c28a768d2

          • \Users\Admin\AppData\Local\Temp\bassmod.dll

            Filesize

            9KB

            MD5

            780d14604d49e3c634200c523def8351

            SHA1

            e208ef6f421d2260070a9222f1f918f1de0a8eeb

            SHA256

            844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

            SHA512

            a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

          • \Users\Admin\AppData\Local\Temp\dup2patcher.dll

            Filesize

            139KB

            MD5

            d7ded77042b691a5c5db7d501a047b9d

            SHA1

            d4da48a37fbae8f9ae5a0dcf11120374395360d3

            SHA256

            85767ce14351b0da5fdc03219fa45548ac4d42901ca0aec399eee3043bea0932

            SHA512

            d26dda75a97539239ec9ad515b4c29738e23a93db411fdcdad7ccb7ee432f4e424085b8061876f6be7ea09f79b1fc93b733f6c5ede294b2ec58dadfb221981e4

          • \Users\Admin\AppData\Local\Temp\nseCC38.tmp\System.dll

            Filesize

            11KB

            MD5

            fc90dfb694d0e17b013d6f818bce41b0

            SHA1

            3243969886d640af3bfa442728b9f0dff9d5f5b0

            SHA256

            7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528

            SHA512

            324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6

          • \Users\Admin\AppData\Local\Temp\nsjB973.tmp\System.dll

            Filesize

            11KB

            MD5

            fc90dfb694d0e17b013d6f818bce41b0

            SHA1

            3243969886d640af3bfa442728b9f0dff9d5f5b0

            SHA256

            7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528

            SHA512

            324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6

          • \Users\Admin\AppData\Local\Temp\nstCA25.tmp\System.dll

            Filesize

            11KB

            MD5

            fc90dfb694d0e17b013d6f818bce41b0

            SHA1

            3243969886d640af3bfa442728b9f0dff9d5f5b0

            SHA256

            7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528

            SHA512

            324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6

          • \Users\Admin\AppData\Roaming\driver.reviver.5.24.0.12-patch.exe

            Filesize

            144KB

            MD5

            0cd8d6746093c2b02b18e0da737a12d4

            SHA1

            19ec4c49c3adedb152137254c35bafc8b64407c8

            SHA256

            800d1d7f8bbdfc6a445bff377f76ee792552232b955b849fa5d86dabd41c16fb

            SHA512

            d63c431704e91afb4e3180d7a29be0d042094858c841229836910d32e7c0a215e284bb7d66d9897d9405dd4d9ab472e6b61e8b78d4127ae350df21df1157728e

          • \Users\Admin\AppData\Roaming\googleup.exe

            Filesize

            309KB

            MD5

            7bf0b17bdb0de1668e13502c74ed6cb6

            SHA1

            f42777d66eb75c3f2f560e7ec8b1d5d068b99a78

            SHA256

            de94226a21c3200dd5c2f63f845c4333ef8fcab922311e10a4191da68a2879bb

            SHA512

            fcb042a1dfbfde4fe67ebca05b8979601767f948cef31d59b0e941588a3d56e218265e83e7e8411e70eabf355ed6745958f1e810f8825058272be06c03c44e77

          • memory/544-93-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/544-94-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/544-108-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/544-109-0x0000000000240000-0x00000000002A6000-memory.dmp

            Filesize

            408KB

          • memory/544-99-0x0000000000240000-0x00000000002A6000-memory.dmp

            Filesize

            408KB

          • memory/544-100-0x00000000002C0000-0x00000000002CD000-memory.dmp

            Filesize

            52KB

          • memory/544-101-0x0000000001DA0000-0x0000000001DAC000-memory.dmp

            Filesize

            48KB

          • memory/544-97-0x0000000000240000-0x00000000002A6000-memory.dmp

            Filesize

            408KB

          • memory/544-82-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/544-83-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/544-90-0x00000000004015C6-mapping.dmp

          • memory/544-84-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/544-89-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/544-88-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/544-87-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/544-86-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/884-113-0x0000000000090000-0x0000000000147000-memory.dmp

            Filesize

            732KB

          • memory/884-105-0x0000000077750000-0x00000000778D0000-memory.dmp

            Filesize

            1.5MB

          • memory/884-107-0x00000000003D0000-0x00000000003DC000-memory.dmp

            Filesize

            48KB

          • memory/884-112-0x0000000077750000-0x00000000778D0000-memory.dmp

            Filesize

            1.5MB

          • memory/884-106-0x0000000000090000-0x0000000000147000-memory.dmp

            Filesize

            732KB

          • memory/884-102-0x0000000000000000-mapping.dmp

          • memory/884-104-0x0000000074571000-0x0000000074573000-memory.dmp

            Filesize

            8KB

          • memory/1220-63-0x0000000000000000-mapping.dmp

          • memory/1220-77-0x0000000000360000-0x0000000000370000-memory.dmp

            Filesize

            64KB

          • memory/1296-116-0x0000000002580000-0x0000000002586000-memory.dmp

            Filesize

            24KB

          • memory/1412-111-0x0000000002C10000-0x0000000002C1C000-memory.dmp

            Filesize

            48KB

          • memory/1412-117-0x0000000003C50000-0x0000000003DAC000-memory.dmp

            Filesize

            1.4MB

          • memory/1412-74-0x00000000749A0000-0x0000000074A2F000-memory.dmp

            Filesize

            572KB

          • memory/1412-75-0x0000000000100000-0x0000000000103000-memory.dmp

            Filesize

            12KB

          • memory/1412-110-0x0000000003C50000-0x0000000003DAC000-memory.dmp

            Filesize

            1.4MB

          • memory/1412-58-0x0000000000000000-mapping.dmp

          • memory/1636-80-0x0000000000000000-mapping.dmp

          • memory/1744-55-0x00000000748E1000-0x00000000748E3000-memory.dmp

            Filesize

            8KB

          • memory/1744-54-0x0000000076451000-0x0000000076453000-memory.dmp

            Filesize

            8KB

          • memory/2044-66-0x0000000000000000-mapping.dmp

          • memory/2044-115-0x000000000F230000-0x000000000F23C000-memory.dmp

            Filesize

            48KB

          • memory/2044-71-0x00000000747F1000-0x00000000747F3000-memory.dmp

            Filesize

            8KB

          • memory/2044-114-0x00000000022E0000-0x0000000002F2A000-memory.dmp

            Filesize

            12.3MB

          • memory/2044-118-0x00000000022E0000-0x0000000002F2A000-memory.dmp

            Filesize

            12.3MB