Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    02-08-2022 02:58

General

  • Target

    5a99bc6aa70681c21c6eb298a479f3d72ff16b033129d750cf8249ee24ed9531.exe

  • Size

    551KB

  • MD5

    3454232330370e6c035524983677ac69

  • SHA1

    45c6624631a989e37f91816021c97d80b3060de5

  • SHA256

    5a99bc6aa70681c21c6eb298a479f3d72ff16b033129d750cf8249ee24ed9531

  • SHA512

    287d84bf8b3476a7d426f180ed601533524d8f0f441237db16fc0421c8d51a6e0d2cf63708328eac82e10797a78a376868ce8582239d1d740671bc1be67055be

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1412
      • C:\Users\Admin\AppData\Local\Temp\5a99bc6aa70681c21c6eb298a479f3d72ff16b033129d750cf8249ee24ed9531.exe
        "C:\Users\Admin\AppData\Local\Temp\5a99bc6aa70681c21c6eb298a479f3d72ff16b033129d750cf8249ee24ed9531.exe"
        2⤵
        • Sets file execution options in registry
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: MapViewOfSection
        • Suspicious behavior: RenamesItself
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:860
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          3⤵
          • Modifies firewall policy service
          • Sets file execution options in registry
          • Checks BIOS information in registry
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies Internet Explorer Protected Mode
          • Modifies Internet Explorer Protected Mode Banner
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:984
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1368

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/860-62-0x00000000008A0000-0x00000000008AC000-memory.dmp

        Filesize

        48KB

      • memory/860-67-0x00000000004B0000-0x0000000000516000-memory.dmp

        Filesize

        408KB

      • memory/860-56-0x0000000000400000-0x00000000004AE000-memory.dmp

        Filesize

        696KB

      • memory/860-58-0x00000000004B0000-0x0000000000516000-memory.dmp

        Filesize

        408KB

      • memory/860-61-0x00000000003F0000-0x00000000003FD000-memory.dmp

        Filesize

        52KB

      • memory/860-60-0x00000000004B0000-0x0000000000516000-memory.dmp

        Filesize

        408KB

      • memory/860-55-0x0000000000320000-0x0000000000399000-memory.dmp

        Filesize

        484KB

      • memory/860-66-0x0000000000400000-0x00000000004AE000-memory.dmp

        Filesize

        696KB

      • memory/860-54-0x0000000075851000-0x0000000075853000-memory.dmp

        Filesize

        8KB

      • memory/984-65-0x0000000074BE1000-0x0000000074BE3000-memory.dmp

        Filesize

        8KB

      • memory/984-63-0x0000000000000000-mapping.dmp

      • memory/984-68-0x00000000776A0000-0x0000000077820000-memory.dmp

        Filesize

        1.5MB

      • memory/984-70-0x0000000000660000-0x000000000066C000-memory.dmp

        Filesize

        48KB

      • memory/984-69-0x00000000001A0000-0x0000000000293000-memory.dmp

        Filesize

        972KB

      • memory/1412-71-0x0000000002210000-0x0000000002216000-memory.dmp

        Filesize

        24KB