Resubmissions

03-09-2024 14:02

240903-rb57sazdqf 10

03-09-2024 13:51

240903-q59avszclf 10

02-09-2024 19:51

240902-yk8gtsxbpd 10

02-09-2024 02:27

240902-cxh7tazflg 10

02-09-2024 02:26

240902-cwxc2sygll 10

21-06-2024 19:37

240621-yca7cszgnd 10

09-06-2024 17:07

240609-vm7rjadd73 10

13-05-2024 17:36

240513-v6qblafe3y 10

12-05-2024 17:17

240512-vty3zafh5s 10

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    12-05-2024 17:17

General

  • Target

    Trojan/BetaBot.exe

  • Size

    609KB

  • MD5

    347d7700eb4a4537df6bb7492ca21702

  • SHA1

    983189dab4b523e19f8efd35eee4d7d43d84aca2

  • SHA256

    a9963808a1a358d6ee26ab88bdab4add50512de1a863aa79937815444ee64da8

  • SHA512

    5efb1bce5b5fe74c886126c7bf3627628842a73d31550aee61b71e462b0cc4256b07ae2dc8c207917c5e134c15b8b1d5f3bbbd76724a9b12188f32ba48c25ac9

  • SSDEEP

    12288:Y71ezsKspcx7aSekHeX/BoVrWyrl/XYUx58wT7tRw:IYzsDyAS/HeyWql/XYUz8wTDw

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • ModiLoader Second Stage 6 IoCs
  • Sets file execution options in registry 2 TTPs 4 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1168
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1204
        • C:\Users\Admin\AppData\Local\Temp\Trojan\BetaBot.exe
          "C:\Users\Admin\AppData\Local\Temp\Trojan\BetaBot.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2784
          • C:\Users\Admin\AppData\Local\Temp\Trojan\BetaBot.exe
            "C:\Users\Admin\AppData\Local\Temp\Trojan\BetaBot.exe"
            3⤵
            • Sets file execution options in registry
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Suspicious behavior: MapViewOfSection
            • Suspicious behavior: RenamesItself
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2272
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              4⤵
              • Modifies firewall policy service
              • Sets file execution options in registry
              • Checks BIOS information in registry
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Checks processor information in registry
              • Enumerates system info in registry
              • Modifies Internet Explorer Protected Mode
              • Modifies Internet Explorer Protected Mode Banner
              • Modifies Internet Explorer settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2136
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:1640
        • C:\Windows\system32\DllHost.exe
          C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
          1⤵
            PID:2344

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1204-48-0x00000000771B1000-0x00000000771B2000-memory.dmp

            Filesize

            4KB

          • memory/1640-37-0x00000000771B1000-0x00000000771B2000-memory.dmp

            Filesize

            4KB

          • memory/2136-30-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-41-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-54-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-31-0x0000000000730000-0x0000000000731000-memory.dmp

            Filesize

            4KB

          • memory/2136-53-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-49-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-13-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-14-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-18-0x0000000000320000-0x0000000000326000-memory.dmp

            Filesize

            24KB

          • memory/2136-15-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-50-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-17-0x0000000000330000-0x000000000033D000-memory.dmp

            Filesize

            52KB

          • memory/2136-32-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-20-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-22-0x0000000000120000-0x0000000000222000-memory.dmp

            Filesize

            1.0MB

          • memory/2136-27-0x0000000000120000-0x0000000000222000-memory.dmp

            Filesize

            1.0MB

          • memory/2136-26-0x0000000000740000-0x000000000074C000-memory.dmp

            Filesize

            48KB

          • memory/2136-25-0x0000000000710000-0x0000000000711000-memory.dmp

            Filesize

            4KB

          • memory/2136-24-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-21-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-16-0x0000000000120000-0x0000000000222000-memory.dmp

            Filesize

            1.0MB

          • memory/2136-47-0x0000000000120000-0x0000000000222000-memory.dmp

            Filesize

            1.0MB

          • memory/2136-19-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-33-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-34-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-35-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-36-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-46-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-38-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-39-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-40-0x0000000077160000-0x0000000077309000-memory.dmp

            Filesize

            1.7MB

          • memory/2136-45-0x0000000000320000-0x0000000000326000-memory.dmp

            Filesize

            24KB

          • memory/2136-42-0x0000000000120000-0x0000000000222000-memory.dmp

            Filesize

            1.0MB

          • memory/2136-43-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2136-44-0x0000000077340000-0x00000000774C1000-memory.dmp

            Filesize

            1.5MB

          • memory/2272-8-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/2272-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

          • memory/2272-4-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/2272-1-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/2272-11-0x00000000002E0000-0x0000000000346000-memory.dmp

            Filesize

            408KB

          • memory/2272-10-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/2272-6-0x0000000000400000-0x0000000000435000-memory.dmp

            Filesize

            212KB

          • memory/2344-51-0x00000000771B1000-0x00000000771B2000-memory.dmp

            Filesize

            4KB

          • memory/2784-7-0x0000000000400000-0x000000000049F000-memory.dmp

            Filesize

            636KB