Overview

overview

10

Static

static

3

02bd842c7b...6c.exe

windows7-x64

10

02bd842c7b...6c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02bd842c7b587c145a18836f8180846c.exe

  • Size

    284KB

  • Sample

    240628-24hx3avbph

  • MD5

    02bd842c7b587c145a18836f8180846c

  • SHA1

    9a17bab1f56906321a4574e87b6720ab24946b3d

  • SHA256

    f4d358d649b4194238e4f9ef8fc2722da3aa8fb6a9eb89e590359fbed7205989

  • SHA512

    d8bcad2d452f51bfbfde6dc6546d9893e9a869c7475962626c60b54187d6937f6114aa3ef0bc1fac20f9e55ebdcee952630797dc24cf54f4779230add820c7d2

  • SSDEEP

    6144:uiOJeNdupo0RmQt9zt1ZRtK8Q9HcPtmCmptGGsBYW/6d9Yr:nhfm3RRtDuH8tFYGGsz6dS

Score
10/10
betabotbackdoorbotnetevasionpersistencetrojan

Malware Config

Targets

    • Target

      02bd842c7b587c145a18836f8180846c.exe

    • Size

      284KB

    • MD5

      02bd842c7b587c145a18836f8180846c

    • SHA1

      9a17bab1f56906321a4574e87b6720ab24946b3d

    • SHA256

      f4d358d649b4194238e4f9ef8fc2722da3aa8fb6a9eb89e590359fbed7205989

    • SHA512

      d8bcad2d452f51bfbfde6dc6546d9893e9a869c7475962626c60b54187d6937f6114aa3ef0bc1fac20f9e55ebdcee952630797dc24cf54f4779230add820c7d2

    • SSDEEP

      6144:uiOJeNdupo0RmQt9zt1ZRtK8Q9HcPtmCmptGGsBYW/6d9Yr:nhfm3RRtDuH8tFYGGsz6dS

    Score
    10/10
    betabotbackdoorbotnetevasionpersistencetrojan

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

      trojanbackdoorbotnetbetabot

    • Modifies firewall policy service

      evasion

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks