Analysis

  • max time kernel
    91s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-10-2022 14:17

General

  • Target

    942B3749F4317E682E02E879F43928575F80170DD98E4.exe

  • Size

    396KB

  • MD5

    6aacf73b3a873ed750c90f0ac7865d50

  • SHA1

    83a03d58690fb7f156f7329e2dd4c9fff4d4d14b

  • SHA256

    942b3749f4317e682e02e879f43928575f80170dd98e4e99e9008109e4952178

  • SHA512

    bdc0ff735c784427bdde8edb5dda41ce9341ec1abca636bb77f5c2d858614fcc0ff76034b36f8d55134c6d53c710f27400a55b02e7f5fc9ccebbe082a7e19733

  • SSDEEP

    6144:zuWO0vOY+TT4VHhiUJLjWGTkDOvWmdkdJVnkWXsrQI/4:uy7+TsHfvNwW0nVkaskI/4

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\942B3749F4317E682E02E879F43928575F80170DD98E4.exe
    "C:\Users\Admin\AppData\Local\Temp\942B3749F4317E682E02E879F43928575F80170DD98E4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:536
    • C:\Users\Admin\AppData\Local\Temp\942B3749F4317E682E02E879F43928575F80170DD98E4.exe
      "C:\Users\Admin\AppData\Local\Temp\942B3749F4317E682E02E879F43928575F80170DD98E4.exe"
      2⤵
      • Sets file execution options in registry
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious behavior: MapViewOfSection
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:980
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
        • Modifies firewall policy service
        • Sets file execution options in registry
        • Checks BIOS information in registry
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies Internet Explorer Protected Mode
        • Modifies Internet Explorer Protected Mode Banner
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4396
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 1068
          4⤵
          • Program crash
          PID:4996
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4396 -ip 4396
    1⤵
      PID:1936

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/536-138-0x00007FF8EE470000-0x00007FF8EE665000-memory.dmp

      Filesize

      2.0MB

    • memory/536-141-0x0000000077130000-0x00000000772D3000-memory.dmp

      Filesize

      1.6MB

    • memory/980-145-0x00000000022B0000-0x0000000002316000-memory.dmp

      Filesize

      408KB

    • memory/980-146-0x00000000005B0000-0x00000000005BD000-memory.dmp

      Filesize

      52KB

    • memory/980-137-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/980-135-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/980-142-0x00000000022B0000-0x0000000002316000-memory.dmp

      Filesize

      408KB

    • memory/980-149-0x00000000022B0000-0x0000000002316000-memory.dmp

      Filesize

      408KB

    • memory/980-134-0x0000000000000000-mapping.dmp

    • memory/980-139-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/980-147-0x00000000027C0000-0x00000000027CC000-memory.dmp

      Filesize

      48KB

    • memory/980-148-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

    • memory/4396-144-0x0000000000000000-mapping.dmp

    • memory/4396-150-0x0000000000B60000-0x0000000000F93000-memory.dmp

      Filesize

      4.2MB

    • memory/4396-151-0x0000000000430000-0x00000000004FD000-memory.dmp

      Filesize

      820KB

    • memory/4396-152-0x0000000000430000-0x00000000004FD000-memory.dmp

      Filesize

      820KB