Analysis

  • max time kernel
    146s
  • max time network
    50s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    01-10-2022 18:58

General

  • Target

    cccb98520d7b5747bbec8af8fcc1d245eaccea92a346c30309c3333519933451.exe

  • Size

    270KB

  • MD5

    72a5fd774abbbcbdc38527826122b580

  • SHA1

    08da270a2c68a7b113aaaee8b2cbffb7665163c9

  • SHA256

    cccb98520d7b5747bbec8af8fcc1d245eaccea92a346c30309c3333519933451

  • SHA512

    51abac0551b7e97c9691b0a2f821d22a258022c25dcc7c1c7bd6e873e658ea3bf7affdae06d8b6929e2473600c55abbc7a1b1decdd17b76e376b9c54eca6218f

  • SSDEEP

    6144:LAsBZPuFKtb1svWp8uAUf2lNbhu1ZHqsM7hQzZT8PjUs:tUOb1svWpaUfgNbhu1csqu3s

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\cccb98520d7b5747bbec8af8fcc1d245eaccea92a346c30309c3333519933451.exe
        "C:\Users\Admin\AppData\Local\Temp\cccb98520d7b5747bbec8af8fcc1d245eaccea92a346c30309c3333519933451.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1700
        • C:\Users\Admin\AppData\Local\Temp\cccb98520d7b5747bbec8af8fcc1d245eaccea92a346c30309c3333519933451.exe
          "C:\Users\Admin\AppData\Local\Temp\cccb98520d7b5747bbec8af8fcc1d245eaccea92a346c30309c3333519933451.exe"
          3⤵
          • Sets file execution options in registry
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Checks processor information in registry
          • Suspicious behavior: MapViewOfSection
          • Suspicious behavior: RenamesItself
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1728
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            4⤵
            • Modifies firewall policy service
            • Sets file execution options in registry
            • Checks BIOS information in registry
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Enumerates system info in registry
            • Modifies Internet Explorer Protected Mode
            • Modifies Internet Explorer Protected Mode Banner
            • Modifies Internet Explorer settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1548
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1180
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:1064

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Modify Existing Service

        1
        T1031

        Registry Run Keys / Startup Folder

        2
        T1060

        Defense Evasion

        Modify Registry

        6
        T1112

        Discovery

        Query Registry

        3
        T1012

        System Information Discovery

        5
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\nsi8BA.tmp\System.dll
          Filesize

          11KB

          MD5

          883eff06ac96966270731e4e22817e11

          SHA1

          523c87c98236cbc04430e87ec19b977595092ac8

          SHA256

          44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

          SHA512

          60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

        • \Users\Admin\AppData\Local\Temp\rabblements.dll
          Filesize

          74KB

          MD5

          e0291ba7745237498e06465b622cee9d

          SHA1

          f1bac955e343ea7530f63197b7c29af40ae0388a

          SHA256

          e389ea70bde9d21be265a9adda6cdfd3aae6d59b2526df2bb18ae7c7cc4aa13a

          SHA512

          87d6834e1a8c4166a0f1cdcc38908798c9a75684ea118ea4b99ee2d322c26268d0a352fa437840c1f45de0830fe2361cbc21a516ef49c88be9c3f8eb415f3dd6

        • memory/1208-85-0x00000000025E0000-0x00000000025E6000-memory.dmp
          Filesize

          24KB

        • memory/1548-83-0x00000000000D0000-0x000000000017A000-memory.dmp
          Filesize

          680KB

        • memory/1548-86-0x0000000077DD0000-0x0000000077F50000-memory.dmp
          Filesize

          1.5MB

        • memory/1548-87-0x00000000000D0000-0x000000000017A000-memory.dmp
          Filesize

          680KB

        • memory/1548-78-0x0000000000000000-mapping.dmp
        • memory/1548-84-0x00000000008B0000-0x00000000008BC000-memory.dmp
          Filesize

          48KB

        • memory/1548-82-0x0000000077DD0000-0x0000000077F50000-memory.dmp
          Filesize

          1.5MB

        • memory/1548-80-0x0000000075301000-0x0000000075303000-memory.dmp
          Filesize

          8KB

        • memory/1700-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp
          Filesize

          8KB

        • memory/1700-65-0x0000000075250000-0x0000000075276000-memory.dmp
          Filesize

          152KB

        • memory/1700-68-0x0000000075250000-0x0000000075276000-memory.dmp
          Filesize

          152KB

        • memory/1728-61-0x0000000000400000-0x0000000000434000-memory.dmp
          Filesize

          208KB

        • memory/1728-69-0x0000000000400000-0x0000000000434000-memory.dmp
          Filesize

          208KB

        • memory/1728-72-0x0000000001C90000-0x0000000001CF3000-memory.dmp
          Filesize

          396KB

        • memory/1728-74-0x0000000000400000-0x0000000000434000-memory.dmp
          Filesize

          208KB

        • memory/1728-75-0x0000000001C90000-0x0000000001CF3000-memory.dmp
          Filesize

          396KB

        • memory/1728-76-0x00000000003E0000-0x00000000003ED000-memory.dmp
          Filesize

          52KB

        • memory/1728-77-0x0000000002500000-0x000000000250C000-memory.dmp
          Filesize

          48KB

        • memory/1728-71-0x0000000000400000-0x0000000000434000-memory.dmp
          Filesize

          208KB

        • memory/1728-66-0x00000000004015C6-mapping.dmp
        • memory/1728-81-0x0000000001C90000-0x0000000001CF3000-memory.dmp
          Filesize

          396KB

        • memory/1728-64-0x0000000000400000-0x0000000000434000-memory.dmp
          Filesize

          208KB

        • memory/1728-63-0x0000000000400000-0x0000000000434000-memory.dmp
          Filesize

          208KB

        • memory/1728-60-0x0000000000400000-0x0000000000434000-memory.dmp
          Filesize

          208KB

        • memory/1728-59-0x0000000000400000-0x0000000000434000-memory.dmp
          Filesize

          208KB

        • memory/1728-58-0x0000000000400000-0x0000000000434000-memory.dmp
          Filesize

          208KB

        • memory/1728-57-0x0000000000400000-0x0000000000434000-memory.dmp
          Filesize

          208KB