Overview
overview
10Static
static
10Dropper/Berbew.exe
windows7-x64
10Dropper/Berbew.exe
windows10-2004-x64
10Dropper/Phorphiex.exe
windows7-x64
10Dropper/Phorphiex.exe
windows10-2004-x64
10RAT/31.exe
windows7-x64
10RAT/31.exe
windows10-2004-x64
10RAT/XClient.exe
windows7-x64
10RAT/XClient.exe
windows10-2004-x64
10RAT/file.exe
windows7-x64
7RAT/file.exe
windows10-2004-x64
7Ransomware...-2.exe
windows7-x64
10Ransomware...-2.exe
windows10-2004-x64
10Ransomware...01.exe
windows7-x64
10Ransomware...01.exe
windows10-2004-x64
10Ransomware...lt.exe
windows7-x64
10Ransomware...lt.exe
windows10-2004-x64
10Stealers/Azorult.exe
windows7-x64
10Stealers/Azorult.exe
windows10-2004-x64
10Stealers/B...on.exe
windows7-x64
10Stealers/B...on.exe
windows10-2004-x64
10Stealers/Dridex.dll
windows7-x64
10Stealers/Dridex.dll
windows10-2004-x64
10Stealers/M..._2.exe
windows7-x64
10Stealers/M..._2.exe
windows10-2004-x64
10Stealers/lumma.exe
windows7-x64
1Stealers/lumma.exe
windows10-2004-x64
10Trojan/BetaBot.exe
windows7-x64
10Trojan/BetaBot.exe
windows10-2004-x64
10Trojan/Smo...er.exe
windows7-x64
10Trojan/Smo...er.exe
windows10-2004-x64
10Resubmissions
03-09-2024 14:02
240903-rb57sazdqf 1003-09-2024 13:51
240903-q59avszclf 1002-09-2024 19:51
240902-yk8gtsxbpd 1002-09-2024 02:27
240902-cxh7tazflg 1002-09-2024 02:26
240902-cwxc2sygll 1021-06-2024 19:37
240621-yca7cszgnd 1009-06-2024 17:07
240609-vm7rjadd73 1013-05-2024 17:36
240513-v6qblafe3y 1012-05-2024 17:17
240512-vty3zafh5s 10Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12-05-2024 17:17
Behavioral task
behavioral1
Sample
Dropper/Berbew.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Dropper/Berbew.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Dropper/Phorphiex.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Dropper/Phorphiex.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
RAT/31.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
RAT/31.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
RAT/XClient.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
RAT/XClient.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
RAT/file.exe
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
RAT/file.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Ransomware/Client-2.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Ransomware/Client-2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Ransomware/criticalupdate01.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Ransomware/criticalupdate01.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
Ransomware/default.exe
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Ransomware/default.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Stealers/Azorult.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
Stealers/Azorult.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
Stealers/BlackMoon.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
Stealers/BlackMoon.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
Stealers/Dridex.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Stealers/Dridex.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
Stealers/Masslogger/mouse_2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Stealers/lumma.exe
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Stealers/lumma.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Trojan/BetaBot.exe
Resource
win7-20240220-en
Behavioral task
behavioral28
Sample
Trojan/BetaBot.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
Trojan/SmokeLoader.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
Trojan/SmokeLoader.exe
Resource
win10v2004-20240508-en
General
-
Target
Trojan/BetaBot.exe
-
Size
609KB
-
MD5
347d7700eb4a4537df6bb7492ca21702
-
SHA1
983189dab4b523e19f8efd35eee4d7d43d84aca2
-
SHA256
a9963808a1a358d6ee26ab88bdab4add50512de1a863aa79937815444ee64da8
-
SHA512
5efb1bce5b5fe74c886126c7bf3627628842a73d31550aee61b71e462b0cc4256b07ae2dc8c207917c5e134c15b8b1d5f3bbbd76724a9b12188f32ba48c25ac9
-
SSDEEP
12288:Y71ezsKspcx7aSekHeX/BoVrWyrl/XYUx58wT7tRw:IYzsDyAS/HeyWql/XYUz8wTDw
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe -
ModiLoader Second Stage 6 IoCs
Processes:
resource yara_rule behavioral27/memory/2784-7-0x0000000000400000-0x000000000049F000-memory.dmp modiloader_stage2 behavioral27/memory/2136-16-0x0000000000120000-0x0000000000222000-memory.dmp modiloader_stage2 behavioral27/memory/2136-22-0x0000000000120000-0x0000000000222000-memory.dmp modiloader_stage2 behavioral27/memory/2136-27-0x0000000000120000-0x0000000000222000-memory.dmp modiloader_stage2 behavioral27/memory/2136-42-0x0000000000120000-0x0000000000222000-memory.dmp modiloader_stage2 behavioral27/memory/2136-47-0x0000000000120000-0x0000000000222000-memory.dmp modiloader_stage2 -
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
explorer.exeBetaBot.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "nttvw.exe" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\5cq9173iyqei3qy.exe BetaBot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\5cq9173iyqei3qy.exe\DisableExceptionChainValidation BetaBot.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Google Updater 5.0 = "C:\\ProgramData\\Google Updater 5.0\\5cq9173iyqei3qy.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Google Updater 5.0 = "\"C:\\ProgramData\\Google Updater 5.0\\5cq9173iyqei3qy.exe\"" explorer.exe -
Processes:
BetaBot.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA BetaBot.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
BetaBot.exeexplorer.exepid process 2272 BetaBot.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BetaBot.exedescription pid process target process PID 2784 set thread context of 2272 2784 BetaBot.exe BetaBot.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
BetaBot.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 BetaBot.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString BetaBot.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main explorer.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
explorer.exepid process 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
BetaBot.exeexplorer.exepid process 2272 BetaBot.exe 2272 BetaBot.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe 2136 explorer.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
BetaBot.exepid process 2272 BetaBot.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
BetaBot.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2272 BetaBot.exe Token: SeRestorePrivilege 2272 BetaBot.exe Token: SeBackupPrivilege 2272 BetaBot.exe Token: SeLoadDriverPrivilege 2272 BetaBot.exe Token: SeCreatePagefilePrivilege 2272 BetaBot.exe Token: SeShutdownPrivilege 2272 BetaBot.exe Token: SeTakeOwnershipPrivilege 2272 BetaBot.exe Token: SeChangeNotifyPrivilege 2272 BetaBot.exe Token: SeCreateTokenPrivilege 2272 BetaBot.exe Token: SeMachineAccountPrivilege 2272 BetaBot.exe Token: SeSecurityPrivilege 2272 BetaBot.exe Token: SeAssignPrimaryTokenPrivilege 2272 BetaBot.exe Token: SeCreateGlobalPrivilege 2272 BetaBot.exe Token: 33 2272 BetaBot.exe Token: SeDebugPrivilege 2136 explorer.exe Token: SeRestorePrivilege 2136 explorer.exe Token: SeBackupPrivilege 2136 explorer.exe Token: SeLoadDriverPrivilege 2136 explorer.exe Token: SeCreatePagefilePrivilege 2136 explorer.exe Token: SeShutdownPrivilege 2136 explorer.exe Token: SeTakeOwnershipPrivilege 2136 explorer.exe Token: SeChangeNotifyPrivilege 2136 explorer.exe Token: SeCreateTokenPrivilege 2136 explorer.exe Token: SeMachineAccountPrivilege 2136 explorer.exe Token: SeSecurityPrivilege 2136 explorer.exe Token: SeAssignPrimaryTokenPrivilege 2136 explorer.exe Token: SeCreateGlobalPrivilege 2136 explorer.exe Token: 33 2136 explorer.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
BetaBot.exeBetaBot.exeexplorer.exedescription pid process target process PID 2784 wrote to memory of 2272 2784 BetaBot.exe BetaBot.exe PID 2784 wrote to memory of 2272 2784 BetaBot.exe BetaBot.exe PID 2784 wrote to memory of 2272 2784 BetaBot.exe BetaBot.exe PID 2784 wrote to memory of 2272 2784 BetaBot.exe BetaBot.exe PID 2784 wrote to memory of 2272 2784 BetaBot.exe BetaBot.exe PID 2784 wrote to memory of 2272 2784 BetaBot.exe BetaBot.exe PID 2272 wrote to memory of 2136 2272 BetaBot.exe explorer.exe PID 2272 wrote to memory of 2136 2272 BetaBot.exe explorer.exe PID 2272 wrote to memory of 2136 2272 BetaBot.exe explorer.exe PID 2272 wrote to memory of 2136 2272 BetaBot.exe explorer.exe PID 2272 wrote to memory of 2136 2272 BetaBot.exe explorer.exe PID 2272 wrote to memory of 2136 2272 BetaBot.exe explorer.exe PID 2272 wrote to memory of 2136 2272 BetaBot.exe explorer.exe PID 2136 wrote to memory of 1168 2136 explorer.exe Dwm.exe PID 2136 wrote to memory of 1168 2136 explorer.exe Dwm.exe PID 2136 wrote to memory of 1168 2136 explorer.exe Dwm.exe PID 2136 wrote to memory of 1168 2136 explorer.exe Dwm.exe PID 2136 wrote to memory of 1168 2136 explorer.exe Dwm.exe PID 2136 wrote to memory of 1168 2136 explorer.exe Dwm.exe PID 2136 wrote to memory of 1204 2136 explorer.exe Explorer.EXE PID 2136 wrote to memory of 1204 2136 explorer.exe Explorer.EXE PID 2136 wrote to memory of 1204 2136 explorer.exe Explorer.EXE PID 2136 wrote to memory of 1204 2136 explorer.exe Explorer.EXE PID 2136 wrote to memory of 1204 2136 explorer.exe Explorer.EXE PID 2136 wrote to memory of 1204 2136 explorer.exe Explorer.EXE PID 2136 wrote to memory of 1640 2136 explorer.exe DllHost.exe PID 2136 wrote to memory of 1640 2136 explorer.exe DllHost.exe PID 2136 wrote to memory of 1640 2136 explorer.exe DllHost.exe PID 2136 wrote to memory of 1640 2136 explorer.exe DllHost.exe PID 2136 wrote to memory of 1640 2136 explorer.exe DllHost.exe PID 2136 wrote to memory of 1640 2136 explorer.exe DllHost.exe PID 2136 wrote to memory of 2344 2136 explorer.exe DllHost.exe PID 2136 wrote to memory of 2344 2136 explorer.exe DllHost.exe PID 2136 wrote to memory of 2344 2136 explorer.exe DllHost.exe PID 2136 wrote to memory of 2344 2136 explorer.exe DllHost.exe PID 2136 wrote to memory of 2344 2136 explorer.exe DllHost.exe PID 2136 wrote to memory of 2344 2136 explorer.exe DllHost.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\Trojan\BetaBot.exe"C:\Users\Admin\AppData\Local\Temp\Trojan\BetaBot.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\Trojan\BetaBot.exe"C:\Users\Admin\AppData\Local\Temp\Trojan\BetaBot.exe"3⤵
- Sets file execution options in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1640
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2344
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1