Analysis

  • max time kernel
    150s
  • max time network
    193s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01-10-2022 22:33

General

  • Target

    83d6f75a49f99eef7c428029e740cdb13c6010539600c2b49a84fde76b96c483.exe

  • Size

    285KB

  • MD5

    63edfb90569441d924e4cedd7f259a10

  • SHA1

    07d67056cb86ef7ae89c713286ea7c1ec7a60f37

  • SHA256

    83d6f75a49f99eef7c428029e740cdb13c6010539600c2b49a84fde76b96c483

  • SHA512

    94f7001ee77cfd25cd248ff785c6087487e38ce0ad7ceb9a846fb25b14fe3399378baf1d796e5922542ffa1ca3710f456cbbfd7b34fcd3272c2cfac5477b1bf6

  • SSDEEP

    6144:ce/5lXtSgMU2oN9lMzHQEWuAAu/k1g7HfjTP:j/5lYgMFo3GDbgdTffP

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1380
      • C:\Users\Admin\AppData\Local\Temp\83d6f75a49f99eef7c428029e740cdb13c6010539600c2b49a84fde76b96c483.exe
        "C:\Users\Admin\AppData\Local\Temp\83d6f75a49f99eef7c428029e740cdb13c6010539600c2b49a84fde76b96c483.exe"
        2⤵
        • Sets file execution options in registry
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: MapViewOfSection
        • Suspicious behavior: RenamesItself
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          3⤵
          • Modifies firewall policy service
          • Sets file execution options in registry
          • Checks BIOS information in registry
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies Internet Explorer Protected Mode
          • Modifies Internet Explorer Protected Mode Banner
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2032
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1312

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Modify Existing Service

      1
      T1031

      Registry Run Keys / Startup Folder

      2
      T1060

      Defense Evasion

      Modify Registry

      6
      T1112

      Discovery

      Query Registry

      3
      T1012

      System Information Discovery

      4
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1380-73-0x0000000002250000-0x0000000002256000-memory.dmp
        Filesize

        24KB

      • memory/1480-67-0x0000000001EE0000-0x0000000001F42000-memory.dmp
        Filesize

        392KB

      • memory/1480-55-0x0000000000400000-0x000000000046B000-memory.dmp
        Filesize

        428KB

      • memory/1480-56-0x0000000001EE0000-0x0000000001F42000-memory.dmp
        Filesize

        392KB

      • memory/1480-60-0x00000000003D0000-0x00000000003DD000-memory.dmp
        Filesize

        52KB

      • memory/1480-59-0x0000000001EE0000-0x0000000001F42000-memory.dmp
        Filesize

        392KB

      • memory/1480-58-0x0000000000400000-0x000000000046B000-memory.dmp
        Filesize

        428KB

      • memory/1480-61-0x00000000005F0000-0x00000000005FC000-memory.dmp
        Filesize

        48KB

      • memory/1480-62-0x0000000001EE0000-0x0000000001F42000-memory.dmp
        Filesize

        392KB

      • memory/1480-54-0x0000000076831000-0x0000000076833000-memory.dmp
        Filesize

        8KB

      • memory/2032-63-0x0000000000000000-mapping.dmp
      • memory/2032-66-0x0000000077E40000-0x0000000077FC0000-memory.dmp
        Filesize

        1MB

      • memory/2032-68-0x0000000000090000-0x000000000013D000-memory.dmp
        Filesize

        692KB

      • memory/2032-69-0x0000000000290000-0x000000000029D000-memory.dmp
        Filesize

        52KB

      • memory/2032-70-0x0000000001FC0000-0x0000000001FCC000-memory.dmp
        Filesize

        48KB

      • memory/2032-71-0x0000000077E40000-0x0000000077FC0000-memory.dmp
        Filesize

        1MB

      • memory/2032-72-0x0000000000090000-0x000000000013D000-memory.dmp
        Filesize

        692KB

      • memory/2032-65-0x0000000075261000-0x0000000075263000-memory.dmp
        Filesize

        8KB