Overview

overview

10

Static

static

3

8940ee6fe6...10.exe

windows7-x64

10

8940ee6fe6...10.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-01-2025 13:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8940ee6fe6900beb6113cbd48e2f54f81e36b3806bbb6c73ae514982cc98a710.exe

  • Size

    1.2MB

  • MD5

    24c7a082a3712ad00cea6f1bfee81f9c

  • SHA1

    67f06a9982358afdf69163b3fd642c231fa0a9c4

  • SHA256

    8940ee6fe6900beb6113cbd48e2f54f81e36b3806bbb6c73ae514982cc98a710

  • SHA512

    ad9097c842e517fa034e5abecb07851cad0d1e5c0433cc1765bf95ee20869d445290fc71e2d20bf7121f780c3336eb0c2397c20c7e8ee541dbf946061442b783

  • SSDEEP

    24576:q7kybXvovms3JuIfILdzxtJzJOJTe87RMMeQjm:KMZJuIwLdNtJzJOJTJeQS

Score
10/10
betabotbackdoorbotnetdefense_evasiondiscoverypersistencetrojan

Malware Config

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot
  • Betabot family
    betabot
  • Modifies firewall policy service 3 TTPs 4 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    remove IFEO.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 36 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
  • Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 17 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\8940ee6fe6900beb6113cbd48e2f54f81e36b3806bbb6c73ae514982cc98a710.exe
    "C:\Users\Admin\AppData\Local\Temp\8940ee6fe6900beb6113cbd48e2f54f81e36b3806bbb6c73ae514982cc98a710.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4712
    • C:\Windows\SysWOW64\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\세이클x 번개녀 원나잇 홈런 시리즈 3탄 - 몸매 죽이는 E컵 자연산 슴가 현직 모델녀.mp4_20160810_215820.611.jpg" /ForceBootstrapPaint3D
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:440
    • C:\Users\Admin\Pictures\dd.exe
      "C:\Users\Admin\Pictures\dd.exe"
      2⤵
      • UAC bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4384
      • C:\Users\Admin\Pictures\dd.exe
        "C:\Users\Admin\Pictures\dd.exe"
        3⤵
        • Event Triggered Execution: Image File Execution Options Injection
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Indicator Removal: Clear Persistence
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2560
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Modifies firewall policy service
          • Event Triggered Execution: Image File Execution Options Injection
          • Checks BIOS information in registry
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies Internet Explorer Protected Mode
          • Modifies Internet Explorer Protected Mode Banner
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3216
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 1116
            5⤵
            • Program crash
            PID:4480
  • C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
    "C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2984
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3216 -ip 3216
    1⤵
      PID:516

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Event Triggered Execution

    1
    T1546

    Image File Execution Options Injection

    1
    T1546.012

    Privilege Escalation

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Event Triggered Execution

    1
    T1546

    Image File Execution Options Injection

    1
    T1546.012

    Defense Evasion

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Impair Defenses

    2
    T1562

    Disable or Modify System Firewall

    1
    T1562.004

    Disable or Modify Tools

    1
    T1562.001

    Indicator Removal

    1
    T1070

    Clear Persistence

    1
    T1070.009

    Modify Registry

    7
    T1112

    Credential Access

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    5
    T1012

    System Information Discovery

    7
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json
      Filesize

      368B

      MD5

      beb59506c4fcd2fb9eec729d0421739d

      SHA1

      c6d01658dae746609f74f925f24a503f4af8bc99

      SHA256

      b6471a6c906a9a77bef5318532b513ab7652fbca22d1f899b32ff3386e2300ad

      SHA512

      d1176204252f38f8d1c2583ea070adec463738472e426a36bf5e312a2b0704f1f77dfcb0e2de9d66902f1ec1339b83d477d1c1d30e0f4fb549e29d25ccc88f3a

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json
      Filesize

      2KB

      MD5

      f4e4a03ebd0ab3a953c56a300d61d223

      SHA1

      97a9acf22c3bdd6989d7c120c21077c4d5a9a80e

      SHA256

      52bfb22aa2d7b0ce083d312fb8fa8dcda3063207186f99fc259aebd9064cbedc

      SHA512

      12aa71eea45720a4d7d057da0b662635671e4cd165ad2e0d30a3d2a43950b47dd60c26c1bbbe049418f815850e571b8d93e4c8b8cbbd686abc3cf7926ba719c2

      Download Submit

    • C:\Users\Admin\Pictures\dd.exe
      Filesize

      233KB

      MD5

      34ddf5905488a9b275df4c58aaf5d847

      SHA1

      5bb563413be0c957692aa91fdaf86a6e60cba22a

      SHA256

      d5adec27977bf202eb056c2eb8f36115d398cc0536ca38b16bf7514623a5c069

      SHA512

      b3c11b7f4046392f58802c0c0c09041a29478942064ac2834bc0f18cc564549be58101bdf499159021aed0c65e0bd7140ff43bad33520ae549076de8dea891b7

      Download Submit

    • C:\Users\Admin\Pictures\세이클x 번개녀 원나잇 홈런 시리즈 3탄 - 몸매 죽이는 E컵 자연산 슴가 현직 모델녀.mp4_20160810_215820.611.jpg
      Filesize

      93KB

      MD5

      992e7555ccbc6b82af6ab64cad41cdd0

      SHA1

      773616e3f157bddbcde7026b3d2d0b65f3809602

      SHA256

      8deed2818ffed9549644eea1aa5bed8807a5a1ca9e9b76b15a566d827ae25efa

      SHA512

      e28f12e19060a83a4799e0b2f72ae4c970b90b9442a0a0e28f902be5a920d8a7d08acd96d040d0ba580929401221ebfd69218f5ef13340de5a0ca253dd1eb656

      Download Submit

    • memory/2560-34-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

      Download

    • memory/2560-28-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

      Download

    • memory/2560-37-0x00000000030D0000-0x0000000003136000-memory.dmp

      Filesize

      408KB

      Download

    • memory/2560-27-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

      Download

    • memory/2560-29-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

      Download

    • memory/2560-30-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

      Download

    • memory/2560-26-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

      Download

    • memory/2560-33-0x0000000000400000-0x0000000000435000-memory.dmp

      Filesize

      212KB

      Download

    • memory/3216-39-0x0000000000450000-0x0000000000884000-memory.dmp

      Filesize

      4.2MB

      Download

    • memory/3216-71-0x0000000000450000-0x0000000000883000-memory.dmp

      Filesize

      4.2MB

      Download

    • memory/3216-41-0x0000000001060000-0x0000000001104000-memory.dmp

      Filesize

      656KB

      Download

    • memory/3216-40-0x0000000000450000-0x0000000000884000-memory.dmp

      Filesize

      4.2MB

      Download

    • memory/4384-38-0x0000000075580000-0x0000000075B31000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/4384-24-0x0000000075580000-0x0000000075B31000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/4384-25-0x0000000075580000-0x0000000075B31000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/4712-3-0x0000000075580000-0x0000000075B31000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/4712-0-0x0000000075582000-0x0000000075583000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4712-22-0x0000000075580000-0x0000000075B31000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/4712-4-0x0000000075580000-0x0000000075B31000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/4712-2-0x0000000075580000-0x0000000075B31000-memory.dmp

      Filesize

      5.7MB

      Download

    • memory/4712-1-0x0000000075580000-0x0000000075B31000-memory.dmp

      Filesize

      5.7MB

      Download