Betabot Process Injection
Summary: Cisco Talos analyzed a Betabot sample (MD5 34105EF38CEA1B4B2ABADD0CB3404E69) that spawns suspended copies of itself with CreateProcessW and CREATE_SUSPENDED, writes a UPX-packed embedded PE into the child at 0x400000 via NtWriteVirtualMemory, and decodes a full Betabot PE into a 0x4B000 chunk allocated at 0x430000. The malware checks registry Run keys for Symantec, McAfee, ESET, Sophos and other AV products, compares the HKLM ProductID against values tied to sandboxes including Joebox, CWSandbox and Anubis, and injects into explorer.exe by sharing a section between processes and hooking ntdll.dll so ZwContinue transfers control to Betabot at 0xF313D8.
Why it matters: The injection avoids the API calls that usually trip analysis tooling: a shared section handler lets Betabot write into explorer.exe while only touching local memory, and ntdll.dll at 0x7C900000 is unmapped and replaced with a hooked copy, so process-level monitoring sees a legitimate Windows binary behaving normally.
Read the original at Cisco Talos ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026