Overview

overview

10

Static

static

3

b9091ef41d...20.exe

windows7-x64

10

b9091ef41d...20.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Uninstall_...r .exe

windows7-x64

7

Uninstall_...r .exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b9091ef41de734fdbd7c7df7b2a5ea20

  • Size

    316KB

  • Sample

    240307-sk54tafb9x

  • MD5

    b9091ef41de734fdbd7c7df7b2a5ea20

  • SHA1

    4d313c6379933dfcfc79cab04a7c83899862b0d7

  • SHA256

    3ad3e9feca98bd1c94415f0319340c3c9416541f4592f7373aeeab289a03c7ac

  • SHA512

    f3aa29e6d4f77d36d1d6a0da1d88e69e69af9bed81a63b85869b1d2582a3e5ff121b9ac8a8b33e2d3f329569fcc3c5370b23da3bdca5636db91c9b6a98813733

  • SSDEEP

    6144:E1onIw+yeYJGW5jt6IAqQXkZ52XZFF64v9VXbBkl/TEJf5:soIwZ5HQ083FPlVX6p+f5

Score
10/10
betabotbackdoorbotnetevasionpersistencetrojan

Malware Config

Targets

    • Target

      b9091ef41de734fdbd7c7df7b2a5ea20

    • Size

      316KB

    • MD5

      b9091ef41de734fdbd7c7df7b2a5ea20

    • SHA1

      4d313c6379933dfcfc79cab04a7c83899862b0d7

    • SHA256

      3ad3e9feca98bd1c94415f0319340c3c9416541f4592f7373aeeab289a03c7ac

    • SHA512

      f3aa29e6d4f77d36d1d6a0da1d88e69e69af9bed81a63b85869b1d2582a3e5ff121b9ac8a8b33e2d3f329569fcc3c5370b23da3bdca5636db91c9b6a98813733

    • SSDEEP

      6144:E1onIw+yeYJGW5jt6IAqQXkZ52XZFF64v9VXbBkl/TEJf5:soIwZ5HQ083FPlVX6p+f5

    Score
    10/10
    betabotbackdoorbotnetevasionpersistencetrojan

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

      trojanbackdoorbotnetbetabot

    • Modifies firewall policy service

      evasion

    • Sets file execution options in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      b26b412d9f1050ad53f663c972fdcd9f

    • SHA1

      7bc4ed444f3f8fd14c2c36784d828175bace8c17

    • SHA256

      70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a

    • SHA512

      ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46

    • SSDEEP

      48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2

    Score
    3/10
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      3f176d1ee13b0d7d6bd92e1c7a0b9bae

    • SHA1

      fe582246792774c2c9dd15639ffa0aca90d6fd0b

    • SHA256

      fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

    • SHA512

      0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

    • SSDEEP

      192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn

    Score
    3/10
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      b3070cf20db659fdfb3cb2ed38130e8d

    • SHA1

      aa234b0620bebddde1414ff6b0840d883890b413

    • SHA256

      f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0

    • SHA512

      4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1

    • SSDEEP

      96:oEqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx40qndYHnxss:oEq+CP3uKrpyREs06YxEdGn

    Score
    3/10
    behavioral7behavioral8

    • Target

      Uninstall_FoldingBrowser .exe

    • Size

      71KB

    • MD5

      8dd15bbaa635358aa8bb9af00cdf4e9c

    • SHA1

      62dd57c30a1950d4558ee2d7189fa2836d188098

    • SHA256

      51d1e2664649b716a8c73c314d6485b4edacec76ebe343bcfe6c0392caf2dd5d

    • SHA512

      e55095f2b562ea8ddcd7e59749805ee696c25d44845de5df816354a0c6ff0ceec6641689b3175eb25109b6ec6a33b3d16420a265ecd40581b6c84e64d3fc660f

    • SSDEEP

      1536:E1E/rzW2pakRmB7BW3nKsclgdLeAyN7Q4r7q4XdZ:E1E/rS2paccKntclceA/g7q4X3

    Score
    7/10

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral10behavioral9

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      b26b412d9f1050ad53f663c972fdcd9f

    • SHA1

      7bc4ed444f3f8fd14c2c36784d828175bace8c17

    • SHA256

      70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a

    • SHA512

      ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46

    • SSDEEP

      48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2

    Score
    3/10
    behavioral11behavioral12

    • Target

      $PLUGINSDIR/System.dll

    • Size

      11KB

    • MD5

      3f176d1ee13b0d7d6bd92e1c7a0b9bae

    • SHA1

      fe582246792774c2c9dd15639ffa0aca90d6fd0b

    • SHA256

      fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e

    • SHA512

      0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6

    • SSDEEP

      192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn

    Score
    3/10
    behavioral13behavioral14

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      b3070cf20db659fdfb3cb2ed38130e8d

    • SHA1

      aa234b0620bebddde1414ff6b0840d883890b413

    • SHA256

      f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0

    • SHA512

      4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1

    • SSDEEP

      96:oEqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx40qndYHnxss:oEq+CP3uKrpyREs06YxEdGn

    Score
    3/10
    behavioral15behavioral16

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

6
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks