Overview

overview

10

Static

static

10

Botnets PA...t].exe

windows7-x64

8

Botnets PA...t].exe

windows10-2004-x64

8

Botnets PA...d9.dll

windows10-2004-x64

1

Botnets PA...ip.dll

windows7-x64

1

Botnets PA...ip.dll

windows10-2004-x64

1

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Botnets PA...vg.exe

windows7-x64

3

Botnets PA...vg.exe

windows10-2004-x64

3

Botnets PA...til.js

windows7-x64

3

Botnets PA...til.js

windows10-2004-x64

3

Botnets PA...ib.dll

windows7-x64

1

Botnets PA...ib.dll

windows10-2004-x64

1

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Botnets PA...ip.dll

windows7-x64

1

Botnets PA...ip.dll

windows10-2004-x64

1

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Botnets PA...mm.exe

windows7-x64

3

Botnets PA...mm.exe

windows10-2004-x64

3

Botnets PA...UI.exe

windows7-x64

8

Botnets PA...UI.exe

windows10-2004-x64

8

Botnets PA...ce.dll

windows10-2004-x64

1

Botnets PA...ip.dll

windows7-x64

1

Botnets PA...ip.dll

windows10-2004-x64

1

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Botnets PA...32.exe

windows7-x64

3

Botnets PA...32.exe

windows10-2004-x64

3

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    09-08-2024 19:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Botnets PACK/Botnets PACK/BetaBotBuilder Leaked by Bull/BetaBotBuilderGUI.exe

  • Size

    205KB

  • MD5

    8b247c25f5f7f68899a4c0b43b94df07

  • SHA1

    9600a4b143310575459af77c37ad0d4a1ed0c67f

  • SHA256

    dc7d7fbd02ffa98bfd0956d490228e8497000055407e4f2d2438329205f4170b

  • SHA512

    4e1f7dbe2eb6c0e14a3306bd7a8772d40f09c39ab6289c6424f5293252475f2dec1cfd58b4031b846890639a2441e80638e8bc378fca3eb242546662743d75a8

  • SSDEEP

    3072:74lFJeofDM5GQHebTHle2O/fLrzfqJbQKGk3:76Fsofo5VHebTHlZavfwbM

Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 1 IoCs
  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 49 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 37 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\BetaBotBuilder Leaked by Bull\BetaBotBuilderGUI.exe
    "C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\BetaBotBuilder Leaked by Bull\BetaBotBuilderGUI.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\BetaBotBuilder Leaked by Bull\npnul32\Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\BetaBotBuilder Leaked by Bull\npnul32\Launcher.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2996
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2612
      • C:\Windows\IMF\Windows Services.exe
        "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:13972
        • C:\Windows\IMF\Secure System Shell.exe
          "C:\Windows\IMF\Secure System Shell.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:14080
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:14104
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:14204
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:14272
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:14328
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2988
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3744
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2680
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:3980
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4076
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4164
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4328
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4428
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2268
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4620
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1520
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4852
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4968
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2740
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:5144
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1864
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1100
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:5324
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:5436
    • C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\BetaBotBuilder Leaked by Bull\npnul32\secur32.exe
      "C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\BetaBotBuilder Leaked by Bull\npnul32\secur32.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      PID:2744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\IMF\Runtime Explorer.exe
    Filesize

    144KB

    MD5

    ec70c6f4dc443c5ab2b91d64ae04fa8e

    SHA1

    43eb3b3289782fced204f0b4e3edad2ba1b085b7

    SHA256

    276f1bfc6256f4c1ddd544d5a556d299ebddcf200a64ee7c9c3edef686df727d

    SHA512

    6217c232edbcf60ae1337120aa9b51956e06f591c660fd720b02fe8abf01923dd4dca28f69ece88c12c705a4c3a392d0cbb6f4f6c6759306123db141ed05d584

    Download Submit

  • C:\Windows\IMF\Secure System Shell.exe
    Filesize

    45KB

    MD5

    7d0c7359e5b2daa5665d01afdc98cc00

    SHA1

    c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

    SHA256

    f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

    SHA512

    a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

    Download Submit

  • C:\Windows\IMF\Windows Services.exe
    Filesize

    46KB

    MD5

    ad0ce1302147fbdfecaec58480eb9cf9

    SHA1

    874efbc76e5f91bc1425a43ea19400340f98d42b

    SHA256

    2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

    SHA512

    adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

    Download Submit

  • memory/2316-0-0x000000007469E000-0x000000007469F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2316-1-0x0000000000B90000-0x0000000000BCA000-memory.dmp

    Filesize

    232KB

    Download

  • memory/2316-2-0x0000000074690000-0x0000000074D7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2316-10-0x0000000008000000-0x00000000082C7000-memory.dmp

    Filesize

    2.8MB

    Download

  • memory/2316-12-0x0000000074690000-0x0000000074D7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2744-854-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-844-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-884-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-882-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-880-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-878-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-876-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-874-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-872-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-870-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-868-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-866-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-862-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-860-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-858-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-856-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-836-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-848-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-864-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-850-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-846-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-852-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-838-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-832-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-830-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-828-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-842-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-840-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-826-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-824-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-823-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-834-0x0000000002450000-0x0000000002561000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/2744-11-0x0000000000400000-0x00000000006C7000-memory.dmp

    Filesize

    2.8MB

    Download

  • memory/2744-13-0x0000000076EE0000-0x0000000076F27000-memory.dmp

    Filesize

    284KB

    Download

  • memory/2996-5-0x0000000004AB0000-0x0000000004B2E000-memory.dmp

    Filesize

    504KB

    Download

  • memory/2996-6-0x0000000074690000-0x0000000074D7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2996-7-0x0000000074690000-0x0000000074D7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2996-8731-0x0000000074690000-0x0000000074D7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2996-4-0x0000000074690000-0x0000000074D7E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2996-3-0x00000000010C0000-0x00000000010D4000-memory.dmp

    Filesize

    80KB

    Download

  • memory/13972-8733-0x0000000000D10000-0x0000000000D22000-memory.dmp

    Filesize

    72KB

    Download

  • memory/14080-8741-0x00000000001A0000-0x00000000001B2000-memory.dmp

    Filesize

    72KB

    Download