Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    17-10-2022 14:17

General

  • Target

    942B3749F4317E682E02E879F43928575F80170DD98E4.exe

  • Size

    396KB

  • MD5

    6aacf73b3a873ed750c90f0ac7865d50

  • SHA1

    83a03d58690fb7f156f7329e2dd4c9fff4d4d14b

  • SHA256

    942b3749f4317e682e02e879f43928575f80170dd98e4e99e9008109e4952178

  • SHA512

    bdc0ff735c784427bdde8edb5dda41ce9341ec1abca636bb77f5c2d858614fcc0ff76034b36f8d55134c6d53c710f27400a55b02e7f5fc9ccebbe082a7e19733

  • SSDEEP

    6144:zuWO0vOY+TT4VHhiUJLjWGTkDOvWmdkdJVnkWXsrQI/4:uy7+TsHfvNwW0nVkaskI/4

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1180
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1268
        • C:\Users\Admin\AppData\Local\Temp\942B3749F4317E682E02E879F43928575F80170DD98E4.exe
          "C:\Users\Admin\AppData\Local\Temp\942B3749F4317E682E02E879F43928575F80170DD98E4.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1044
          • C:\Users\Admin\AppData\Local\Temp\942B3749F4317E682E02E879F43928575F80170DD98E4.exe
            "C:\Users\Admin\AppData\Local\Temp\942B3749F4317E682E02E879F43928575F80170DD98E4.exe"
            3⤵
            • Sets file execution options in registry
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Suspicious behavior: MapViewOfSection
            • Suspicious behavior: RenamesItself
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:684
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              4⤵
              • Modifies firewall policy service
              • Sets file execution options in registry
              • Checks BIOS information in registry
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Checks processor information in registry
              • Enumerates system info in registry
              • Modifies Internet Explorer Protected Mode
              • Modifies Internet Explorer Protected Mode Banner
              • Modifies Internet Explorer settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1128
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:980

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/684-69-0x00000000001D0000-0x00000000001DD000-memory.dmp

          Filesize

          52KB

        • memory/684-58-0x00000000004015C6-mapping.dmp

        • memory/684-57-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/684-77-0x0000000001CD0000-0x0000000001D36000-memory.dmp

          Filesize

          408KB

        • memory/684-61-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/684-70-0x0000000001D50000-0x0000000001D5C000-memory.dmp

          Filesize

          48KB

        • memory/684-64-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/684-65-0x0000000001CD0000-0x0000000001D36000-memory.dmp

          Filesize

          408KB

        • memory/684-67-0x0000000000400000-0x0000000000435000-memory.dmp

          Filesize

          212KB

        • memory/684-68-0x0000000001CD0000-0x0000000001D36000-memory.dmp

          Filesize

          408KB

        • memory/1044-63-0x0000000076FE0000-0x0000000077160000-memory.dmp

          Filesize

          1.5MB

        • memory/1044-56-0x0000000075071000-0x0000000075073000-memory.dmp

          Filesize

          8KB

        • memory/1044-60-0x0000000076E00000-0x0000000076FA9000-memory.dmp

          Filesize

          1.7MB

        • memory/1128-71-0x0000000000000000-mapping.dmp

        • memory/1128-73-0x0000000074631000-0x0000000074633000-memory.dmp

          Filesize

          8KB

        • memory/1128-74-0x0000000076FE0000-0x0000000077160000-memory.dmp

          Filesize

          1.5MB

        • memory/1128-75-0x00000000000D0000-0x000000000019D000-memory.dmp

          Filesize

          820KB

        • memory/1128-76-0x00000000002F0000-0x0000000000370000-memory.dmp

          Filesize

          512KB

        • memory/1128-78-0x0000000076FE0000-0x0000000077160000-memory.dmp

          Filesize

          1.5MB

        • memory/1128-79-0x00000000000D0000-0x000000000019D000-memory.dmp

          Filesize

          820KB

        • memory/1128-80-0x00000000002F0000-0x0000000000370000-memory.dmp

          Filesize

          512KB

        • memory/1268-81-0x00000000029C0000-0x00000000029C6000-memory.dmp

          Filesize

          24KB