Overview

overview

4

Static

static

IL_Beta.exe

windows10-1703-x64

4

Analysis

  • max time kernel
    29s
  • max time network
    30s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06-10-2022 05:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    IL_Beta.exe

  • Size

    3.0MB

  • MD5

    d8dfab4fe38c31c0f673c3e96672c65f

  • SHA1

    84764b41c87b9f02e680cd4fe800f9597ddadd59

  • SHA256

    529c86a3a641cebd27567331ab8305827cb79acba5928e8ce04cf7e55e84bf92

  • SHA512

    6ebb50a65af4aa882c9b6c0ef5f5099f8a1306c811091cc777292f4dd10934f02efaa4995f1e580e49a258ea6e1b5afb8166fd751d8fd0f66110d8f8efce35ba

  • SSDEEP

    49152:ILonJif7tAodaOm53wOD9aQHwGRP26r9+OXpFl6JEGmBYFpO6qmyAJhH:IV6z53a4SzRxDJ

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\IL_Beta.exe
    "C:\Users\Admin\AppData\Local\Temp\IL_Beta.exe"
    1⤵
      PID:2684
    • C:\Windows\System32\SystemSettingsBroker.exe
      C:\Windows\System32\SystemSettingsBroker.exe -Embedding
      1⤵
        PID:4612
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
        1⤵
          PID:2296
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k localservice -s SstpSvc
          1⤵
            PID:4508
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:4480
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
            1⤵
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:4200
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s RasMan
            1⤵
              PID:2144

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\INF\netsstpa.PNF
              Filesize

              6KB

              MD5

              01e21456e8000bab92907eec3b3aeea9

              SHA1

              39b34fe438352f7b095e24c89968fca48b8ce11c

              SHA256

              35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

              SHA512

              9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

              Download Submit